fremder zugriff auf mein MSN

PinaColada · 28.11.2011, 11:23

Hallo.

ich hoffe ich bin hier jetzt im richtigen Forum.

ich schilder mal eben mein Problem.. Jemand hat gestern scheinbar mein MSN geknackt und sich dadurch zugang zu meiner Hotmail, meinem Facebook konto und auch zu meinem Jappy account verschafft....
diese Person hatte alle Passwörter geändert so das ich erstmal dumm da stand wie ich mich nirgends wo anmelden konnte, ich war nur erstaunt das meine Freunde meinten das ich überall online war..

nach langem hin und her habe ich es über meine weitere MSN addy geschafft meine konten alle wieder zubekommen.
ich war sogar gleichzeitig mit der anderen Person bei Facebook online und durfe kurz mit ansehen was er dort für ein müll postet, daraufhin hab ich fix das konto gemeldet und deaktiviert...

meine Frage ist nun: Hat diese Peson noch zugriff auf meine Daten oder ist er weg??? und
wie kann ich verhindern das sowas erneut passiert?

Ich bedanke mich schonmal im vorraus

Gruß Pina Colada

cosinus · 28.11.2011, 14:12

Zitat:

und wie kann ich verhindern das sowas erneut passiert?

Wie wärs mit: Sichere Passwörter vergeben und aufpassen, dass die Windows-Kiste nicht vermüllt?

Bitte nun routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

PinaColada · 28.11.2011, 14:14

Danke schön für die hilfe

LG

cosinus · 28.11.2011, 14:15

Zitat:

Zitat von PinaColada

Danke schön für die hilfe

LG

Komtm da noch mehr? Machst du die Logs?

PinaColada · 28.11.2011, 14:26

ja bin gerade dabei es auszuführen

sobald die scans durch sind schreibe ich es

PinaColada · 28.11.2011, 15:21

Malwarebytes' Anti-Malware 1.51.2.1300
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 8256

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

28.11.2011 15:18:51
mbam-log-2011-11-28 (15-18-51).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|)
Durchsuchte Objekte: 339293
Laufzeit: 55 Minute(n), 53 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

PinaColada · 28.11.2011, 15:22

werde jetzt ESET asführen

PinaColada · 28.11.2011, 16:49

und nun noch das ergebniss vom ESET scan
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=6b6407d8b2da6049882ff9e02852892a
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-10-23 12:27:13
# local_time=2011-10-23 02:27:13 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776574 100 100 20505992 156856816 0 0
# compatibility_mode=8192 67108863 100 0 89 89 0 0
# scanned=112779
# found=0
# cleaned=0
# scan_time=5545
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=6b6407d8b2da6049882ff9e02852892a
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-11-27 08:01:55
# local_time=2011-11-27 09:01:55 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776574 100 100 23598770 159949594 0 0
# compatibility_mode=8192 67108863 100 0 3092867 3092867 0 0
# scanned=190938
# found=0
# cleaned=0
# scan_time=7248
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=6b6407d8b2da6049882ff9e02852892a
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-11-28 01:32:22
# local_time=2011-11-28 02:32:22 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776574 100 100 23668052 160018876 0 0
# compatibility_mode=8192 67108863 100 0 3162149 3162149 0 0
# scanned=10212
# found=0
# cleaned=0
# scan_time=994
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=6b6407d8b2da6049882ff9e02852892a
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-11-28 03:47:57
# local_time=2011-11-28 04:47:57 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776574 100 100 23672174 160022998 0 0
# compatibility_mode=8192 67108863 100 0 3166271 3166271 0 0
# scanned=192840
# found=0
# cleaned=0
# scan_time=5006

cosinus · 28.11.2011, 18:24

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

Code:

ATTFilter

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf .
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

PinaColada · 28.11.2011, 18:30

Ok mach ich sofort

Aber komisch ist immer noch das die mein MSN knacken konnten

Laut Hotmail war mein PW als sicher eingestuft. hatte viel groß und kleinschreibung, zahlen und sogar satzzeichen drin

PinaColada · 28.11.2011, 18:49

Soooo erledigt... und nochmal SUPER LIEBEN DANK fürs helfen

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 28.11.2011 18:33:12 - Run 2
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Pizzaro\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,72 Gb Available Physical Memory | 36,01% Memory free
4,23 Gb Paging File | 2,23 Gb Available in Paging File | 52,77% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 244,14 Gb Total Space | 169,84 Gb Free Space | 69,57% Space Free | Partition Type: NTFS
Drive D: | 221,62 Gb Total Space | 207,04 Gb Free Space | 93,42% Space Free | Partition Type: NTFS
 
Computer Name: PIZZARO-PC | User Name: Pizzaro | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.11.28 10:08:35 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Pizzaro\Desktop\OTL.exe
PRC - [2011.11.11 07:52:37 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2011.09.20 11:39:48 | 000,801,792 | ---- | M] (Yuna Software) -- C:\Programme\Yuna Software\Messenger Plus!\PlusService.exe
PRC - [2011.06.15 14:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe
PRC - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.05.13 15:03:34 | 004,283,256 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Messenger\msnmsgr.exe
PRC - [2011.05.13 13:49:42 | 000,025,456 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Contacts\wlcomm.exe
PRC - [2011.04.27 14:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe
PRC - [2011.04.27 14:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2011.03.28 19:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2011.03.28 19:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2009.10.14 12:36:56 | 002,793,304 | ---- | M] () -- C:\Programme\Logitech\Logitech WebCam Software\LWS.exe
PRC - [2009.10.14 12:34:18 | 000,560,472 | ---- | M] () -- C:\Programme\Common Files\logishrd\LQCVFX\COCIManager.exe
PRC - [2009.10.07 00:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
PRC - [2009.07.16 14:35:42 | 005,458,704 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\Logitech Vid\Vid.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.04.11 07:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.19 08:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.11.11 07:52:36 | 001,989,592 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2011.08.21 07:35:59 | 006,277,280 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll
MOD - [2011.08.07 14:54:16 | 000,004,096 | ---- | M] () -- C:\Programme\Yuna Software\Messenger Plus!\Detour32.dll
MOD - [2009.10.14 12:36:56 | 002,793,304 | ---- | M] () -- C:\Programme\Logitech\Logitech WebCam Software\LWS.exe
MOD - [2009.10.14 12:36:34 | 000,181,592 | ---- | M] () -- C:\Programme\Common Files\logishrd\LvApi11\LvApi11.dll
MOD - [2009.10.14 12:34:18 | 000,560,472 | ---- | M] () -- C:\Programme\Common Files\logishrd\LQCVFX\COCIManager.exe
MOD - [2009.07.16 14:36:20 | 000,138,000 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\plugins\imageformats\qjpeg4.dll
MOD - [2009.07.16 14:36:16 | 000,035,088 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\plugins\imageformats\qico4.dll
MOD - [2009.07.16 14:36:16 | 000,028,944 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\plugins\imageformats\qgif4.dll
MOD - [2009.07.16 14:35:30 | 000,027,408 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\SDL.dll
MOD - [2009.07.16 14:35:20 | 000,363,792 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\qtxml4.dll
MOD - [2009.07.16 14:35:08 | 011,311,888 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\QtWebKit4.dll
MOD - [2009.07.16 14:34:56 | 000,199,952 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\qtsql4.dll
MOD - [2009.07.16 14:34:46 | 000,475,408 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\QtOpenGL4.dll
MOD - [2009.07.16 14:34:34 | 000,968,976 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\QtNetwork4.dll
MOD - [2009.07.16 14:34:22 | 007,704,336 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\QtGui4.dll
MOD - [2009.07.16 14:34:22 | 002,140,944 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\QtCore4.dll
MOD - [2009.07.16 14:34:12 | 000,291,600 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\phonon4.dll
MOD - [2007.01.18 23:54:48 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.04.27 14:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV - [2011.04.27 14:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2009.10.07 00:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.11.28 16:48:17 | 000,028,752 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{91485451-74BD-4B21-9C2B-1B14F7395BA0}\MpKsl7073bea5.sys -- (MpKsl7073bea5)
DRV - [2011.04.27 14:25:24 | 000,065,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2011.04.18 12:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
DRV - [2010.08.12 12:07:50 | 000,292,712 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVNET)
DRV - [2009.10.07 00:46:36 | 000,025,752 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009.04.30 21:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2007.08.09 18:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\nvstor32.sys -- (nvstor32)
DRV - [2007.01.19 00:03:24 | 002,314,752 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006.11.02 08:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {3d684ca7-5d30-4a7e-9768-e17df98df80f} - C:\Programme\Messenger_Plus_DE\prxtbMess.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Hotmail und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 24 37 BA 3E B3 D6 CB 01  [binary data]
IE - HKCU\..\URLSearchHook: {3d684ca7-5d30-4a7e-9768-e17df98df80f} - C:\Programme\Messenger_Plus_DE\prxtbMess.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: {3d684ca7-5d30-4a7e-9768-e17df98df80f}:3.3.3.2
FF - prefs.js..extensions.enabledItems: infofrimonde@83d.de:0.91
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "chrome://browser-region/locale/region.properties"
FF - prefs.js..network.proxy.type: 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.11.11 07:52:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.27 07:26:47 | 000,000,000 | ---D | M]
 
[2011.02.28 18:55:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pizzaro\AppData\Roaming\mozilla\Extensions
[2011.11.19 01:07:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pizzaro\AppData\Roaming\mozilla\Firefox\Profiles\vj33xm3l.default\extensions
[2011.07.31 09:56:19 | 000,002,399 | ---- | M] () -- C:\Users\Pizzaro\AppData\Roaming\Mozilla\Firefox\Profiles\vj33xm3l.default\searchplugins\askcom.xml
[2011.03.19 13:19:33 | 000,000,873 | ---- | M] () -- C:\Users\Pizzaro\AppData\Roaming\Mozilla\Firefox\Profiles\vj33xm3l.default\searchplugins\conduit.xml
[2011.10.09 09:38:11 | 000,002,770 | ---- | M] () -- C:\Users\Pizzaro\AppData\Roaming\Mozilla\Firefox\Profiles\vj33xm3l.default\searchplugins\Plusnetwork.xml
[2011.11.09 10:58:17 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.11.09 10:58:18 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
() (No name found) -- C:\USERS\PIZZARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\VJ33XM3L.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
() (No name found) -- C:\USERS\PIZZARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\VJ33XM3L.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.11.11 07:52:37 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.03 09:23:23 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.03 09:23:23 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.10.03 09:23:23 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.03 09:23:23 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.03 09:23:23 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.03 09:23:23 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - Extension: Skype Extension = C:\Users\Pizzaro\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.3.0.7550_0\
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Messenger Plus DE Toolbar) - {3d684ca7-5d30-4a7e-9768-e17df98df80f} - C:\Programme\Messenger_Plus_DE\prxtbMess.dll (Conduit Ltd.)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Messenger Plus DE Toolbar) - {3d684ca7-5d30-4a7e-9768-e17df98df80f} - C:\Programme\Messenger_Plus_DE\prxtbMess.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKCU\..\Toolbar\WebBrowser: (Messenger Plus DE Toolbar) - {3D684CA7-5D30-4A7E-9768-E17DF98DF80F} - C:\Programme\Messenger_Plus_DE\prxtbMess.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PlusService] C:\Programme\Yuna Software\Messenger Plus!\PlusService.exe (Yuna Software)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent File not found
O4 - HKCU..\Run: [EPSON SX100 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIEDE.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [Logitech Vid] C:\Program Files\Logitech\Logitech Vid\vid.exe (Logitech Inc.)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\Pizzaro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\Pizzaro\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B5C4F12B-F75C-44A9-A4C1-3DB7BBD83FAB}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Pizzaro\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Fotogalerie-Hintergrundbild.jpg
O24 - Desktop BackupWallPaper: C:\Users\Pizzaro\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Fotogalerie-Hintergrundbild.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{e7a9bf8e-41eb-11e0-b108-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{e7a9bf8e-41eb-11e0-b108-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: Sidebar - hkey= - key= - C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
MsConfig - StartUpReg: WMPNSCFG - hkey= - key= - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
MsConfig - State: "startup" - 2
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: MsMpSvc - C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: MsMpSvc - C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.11.28 14:22:25 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Roaming\Malwarebytes
[2011.11.28 14:22:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.11.28 14:22:05 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.11.28 14:22:04 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.11.28 14:21:17 | 009,852,544 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Pizzaro\Desktop\mbam-setup-1.51.2.1300.exe
[2011.11.28 14:14:30 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Pizzaro\Desktop\esetsmartinstaller_enu.exe
[2011.11.28 11:45:03 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{CA0753A8-41AE-47BF-ABF3-576E3C534BFB}
[2011.11.28 11:45:00 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{149ACC53-759F-414D-ABC9-028F49F3497D}
[2011.11.28 10:08:24 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Pizzaro\Desktop\OTL.exe
[2011.11.27 22:46:46 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{D29F183C-F058-4B9D-BBAD-7C03259A2B40}
[2011.11.27 22:46:42 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{7F5AFA83-0F3B-4C7E-90E8-2165FAF6F8E9}
[2011.11.27 10:46:16 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{EF3454A7-BFE8-4A38-BAFB-5AD0CD56B59D}
[2011.11.27 10:46:06 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{D98D780E-D420-4E66-9F89-129200DE32EA}
[2011.11.26 22:39:36 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{D76CC415-6B0B-4657-8122-E8D25F35F564}
[2011.11.26 22:39:32 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{D9D6EA1C-D536-4749-84EC-7E2BE69214C5}
[2011.11.26 10:39:08 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{F0DE4794-E5A8-4BE3-A1B0-7F6A17C3BD95}
[2011.11.26 10:38:59 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{05BCA5C2-27A7-4D24-8638-0F238DFF3C4B}
[2011.11.25 10:27:37 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{C9D7CC17-6F9B-4DD2-B5F1-3235B278F659}
[2011.11.25 10:27:26 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{1BB86D78-B1ED-419C-B195-B0132600A2E6}
[2011.11.24 13:18:42 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{B700263C-18AF-4667-B323-6124CEF74387}
[2011.11.24 13:18:31 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{88F4610A-8C69-463F-8026-3220EF62405E}
[2011.11.23 12:15:20 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{92C08D3E-AF0D-45A5-B92D-1DDC7EB86B5A}
[2011.11.23 12:15:12 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{8A7B118F-43B3-41CC-92FA-57DF8B0C585D}
[2011.11.22 16:51:21 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security Scan
[2011.11.22 16:51:21 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\NSS
[2011.11.22 16:51:21 | 000,000,000 | ---D | C] -- C:\Program Files\Norton Security Scan
[2011.11.22 16:51:21 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\NSS\0305010.008
[2011.11.22 10:43:16 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{8751E8D7-A6D9-4E77-BE96-0FE26EB05B4C}
[2011.11.22 10:43:08 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{A0B35B89-EC70-49AA-97CF-39CB8E28F744}
[2011.11.21 09:59:00 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{E7B56B18-5088-4A62-B3AD-DE6A105D3E65}
[2011.11.21 09:58:52 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{A8E70826-D5B1-4975-8540-6F1D6576AF1F}
[2011.11.20 11:57:30 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{A53155A2-D93E-4529-9CAA-64709DDA995A}
[2011.11.20 11:57:21 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{647D67DC-A184-4C9F-9570-283670DF03C1}
[2011.11.19 20:33:09 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{D4AB4EDB-B507-40D6-B2AC-3429161039FD}
[2011.11.19 20:33:00 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{856175AC-887A-4327-98CE-35C67FAE8352}
[2011.11.19 01:07:30 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{F8473D43-1A20-453F-B7E1-8F1255B908D3}
[2011.11.19 01:07:22 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{424BF33D-3860-4A26-A6D9-F2392F219A15}
[2011.11.18 09:20:00 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{55B74A35-5561-45F7-9441-D2CB7D0CFDC4}
[2011.11.18 09:19:49 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{F1B96442-A43C-4915-A5E9-4C9F7F074ACF}
[2011.11.17 13:19:22 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{3C9106BD-26D8-4195-AFEF-327357A3BAE2}
[2011.11.17 13:19:12 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{AE41B320-45DF-494F-BE6A-99B96F8BE18A}
[2011.11.16 10:29:15 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{57EA2522-B63A-4BE3-8320-BE2EF18B3337}
[2011.11.16 10:29:06 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{5A66A524-0A68-4D3E-B995-9AA69F4CA01C}
[2011.11.15 12:19:15 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{D36CD698-84CF-4AC3-9373-024C4CD971F2}
[2011.11.15 12:19:06 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{843A0C4C-2C5C-47DA-A001-70A4CD061EB7}
[2011.11.14 19:57:12 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{7F5BDB99-4A27-4C50-ABC8-2D4F7706283C}
[2011.11.14 19:57:07 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{90DC7CA3-CE8D-4212-9448-813BD4E7BFF2}
[2011.11.14 07:56:29 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{2A539F61-FB5D-4C78-AEB8-9B1C26DBD269}
[2011.11.14 07:56:20 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{7A2D8C26-248A-4B24-B2FC-A0996DDC39EF}
[2011.11.13 10:11:45 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{B2441FB4-D06E-4CFD-ACD9-EC03B350A696}
[2011.11.13 10:11:42 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{ADB53CF8-6229-4613-91CB-B7038192B233}
[2011.11.12 22:11:25 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{7772D4D2-A63C-41B3-91FB-A6C6052BF8DE}
[2011.11.12 22:11:21 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{8A4807EF-5DA9-4D5B-B03A-A1252700CF4A}
[2011.11.12 10:10:58 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{8247DD13-1A02-4300-AEC2-553DA3FEFD99}
[2011.11.12 10:10:50 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{9F16CB59-3322-46D5-92D3-1CF8386A0C1E}
[2011.11.11 09:02:33 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{9B20A466-0803-4EF3-A148-681B74ABAD52}
[2011.11.11 09:02:25 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{669FE899-3E76-4F95-9014-761E24020C67}
[2011.11.11 07:50:48 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{1CEE3589-C63E-4B43-85AB-E694E69D0F83}
[2011.11.10 11:51:01 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{4D7EEF31-4924-4CF1-8554-3C77B7D78CB8}
[2011.11.10 11:50:54 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{BEFD93DB-34A5-42CD-89DF-46EB54265B77}
[2011.11.09 10:58:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.11.09 09:35:59 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{051EA58D-8AF2-4D08-A9E5-A8088FC3D05D}
[2011.11.09 09:35:55 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{48B33551-A966-4D4D-84EE-E4A47806120D}
[2011.11.08 21:35:38 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{30EFF5E2-98FD-479D-89EC-70A451515511}
[2011.11.08 21:35:34 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{0D29CC57-F20F-4920-AD73-4B8CE6ADFDAF}
[2011.11.08 09:35:17 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{4628727E-659E-46AA-84C1-F867C108F73B}
[2011.11.08 09:35:13 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{BD44C70D-1604-4ED2-83DA-2C4E1660628F}
[2011.11.07 21:34:57 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{6EC32B06-510F-4A39-BA07-564DA069A00C}
[2011.11.07 21:34:53 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{85348CE2-4339-447B-8740-6BEADD30C78B}
[2011.11.07 09:34:23 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{CF3CFE52-17A9-41AD-8FA4-CA3B804E5B8F}
[2011.11.07 09:34:10 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{070E213E-42A7-4BBD-B0FA-4A5F212FB077}
[2011.11.06 10:20:00 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{86614248-4FB4-4078-B3A2-D9372CA59790}
[2011.11.06 10:19:49 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{099D50B5-FE37-4CF9-A332-9D30B3B3F6DE}
[2011.11.05 17:16:44 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{E86EF673-AAF2-44C6-9475-2921CFEA0521}
[2011.11.05 17:16:37 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{69BE9C85-A09F-4EA5-8287-0529048E278B}
[2011.11.05 10:21:24 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{C3609234-5D41-4F2D-9071-09BB0C517019}
[2011.11.04 08:57:30 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{24F15DEB-83A1-422D-B290-F7302571611E}
[2011.11.04 08:57:22 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{CA6CFFF8-B4D4-4D85-B145-C6F500F6BFA9}
[2011.11.03 13:33:01 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{73D8FC93-68AE-445A-8D66-5ECDE2E47F05}
[2011.11.03 13:32:48 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{9C25737D-DC68-40C8-9852-CE9C278DEFC7}
[2011.11.02 09:37:35 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{B249640F-E181-4D88-BFFC-5C901F3AB5DE}
[2011.11.02 09:37:23 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{50BC6FBC-FB11-4956-A8B3-0BB323B5F2EE}
[2011.11.01 15:47:50 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{349B9A7F-FE6E-4897-992C-CAD789BE2ECD}
[2011.11.01 15:47:38 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{6C1769CF-B1EE-4A9F-85E7-F1D4603D8503}
[2011.10.31 19:41:05 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{EEEDBDE4-393D-4C9C-8976-5BF6C1C704BD}
[2011.10.31 19:41:04 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{1E7D61AC-B4CA-40B9-A1C5-A90164B1395A}
[2011.10.31 19:22:01 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{F725BA34-9357-42F4-AAC8-42610EDC1C11}
[2011.10.30 10:13:19 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{3A0361C3-D767-4409-903E-73857899378A}
[2011.10.30 10:13:08 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{F2F96A10-4C47-4372-A038-6C344A1D5C2E}
[2011.10.29 20:26:34 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{896C953D-3180-4CFD-80DB-CB584DD64CDA}
[2011.10.29 20:26:31 | 000,000,000 | ---D | C] -- C:\Users\Pizzaro\AppData\Local\{51748274-5C16-4EF0-BCBE-21EBE155D540}
 
========== Files - Modified Within 30 Days ==========
 
[2011.11.28 18:05:33 | 000,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.11.28 18:05:33 | 000,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.11.28 14:22:13 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.11.28 14:21:23 | 009,852,544 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Pizzaro\Desktop\mbam-setup-1.51.2.1300.exe
[2011.11.28 14:14:33 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Pizzaro\Desktop\esetsmartinstaller_enu.exe
[2011.11.28 10:23:48 | 000,302,592 | ---- | M] () -- C:\Users\Pizzaro\Desktop\pfq22tqk.exe
[2011.11.28 10:11:24 | 000,673,312 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.11.28 10:11:24 | 000,634,042 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.11.28 10:11:24 | 000,145,186 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.11.28 10:11:24 | 000,119,568 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.11.28 10:08:35 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Pizzaro\Desktop\OTL.exe
[2011.11.28 10:07:19 | 000,000,000 | ---- | M] () -- C:\Users\Pizzaro\defogger_reenable
[2011.11.28 10:05:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.11.28 10:05:20 | 2145,849,344 | -HS- | M] () -- C:\hiberfil.sys
[2011.11.28 10:00:22 | 000,050,477 | ---- | M] () -- C:\Users\Pizzaro\Desktop\Defogger.exe
[2011.11.24 21:43:54 | 000,081,427 | ---- | M] () -- C:\Users\Pizzaro\Desktop\10_905036b4fc9bf2a9cb2ea6283abd6ec0.jpg
[2011.11.24 15:42:56 | 000,000,440 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Pizzaro.job
[2011.11.24 14:22:55 | 000,164,818 | ---- | M] () -- C:\Users\Pizzaro\Desktop\pflanzen3.pdf
[2011.11.22 16:51:25 | 000,001,128 | ---- | M] () -- C:\Users\Public\Desktop\Norton Security Scan.lnk
[2011.11.22 15:13:50 | 000,388,154 | ---- | M] () -- C:\Users\Pizzaro\Desktop\Probeliegen-erlaubt-Auslegungssache-a22825816.jpg
[2011.11.22 15:11:09 | 000,357,214 | ---- | M] () -- C:\Users\Pizzaro\Desktop\Vielleicht-machen-die-Umdrehungen-in-der-Wachmaschine-tatsaechlich-wach-a22974431.jpg
[2011.11.22 15:01:03 | 000,380,093 | ---- | M] () -- C:\Users\Pizzaro\Desktop\Eindeutig-zweideutig-a22750862.jpg
[2011.11.22 14:53:48 | 000,034,341 | ---- | M] () -- C:\Users\Pizzaro\Desktop\funny04720823071.jpg
[2011.11.21 11:21:40 | 000,023,049 | ---- | M] () -- C:\Users\Pizzaro\Desktop\18949446_401_ich_bin_nicht_da_H173442_L.jpg
[2011.11.19 14:28:20 | 002,395,077 | ---- | M] () -- C:\Users\Pizzaro\Desktop\DSC06574.JPG
[2011.11.19 14:26:48 | 002,478,386 | ---- | M] () -- C:\Users\Pizzaro\Desktop\DSC06573.JPG
[2011.11.19 14:26:40 | 000,326,763 | ---- | M] () -- C:\Users\Pizzaro\Desktop\DSC06572.JPG
[2011.11.19 14:26:30 | 002,206,247 | ---- | M] () -- C:\Users\Pizzaro\Desktop\DSC06571.JPG
[2011.11.13 09:39:50 | 002,234,975 | ---- | M] () -- C:\Users\Pizzaro\Desktop\DSC06563.JPG
[2011.11.13 09:39:36 | 002,252,303 | ---- | M] () -- C:\Users\Pizzaro\Desktop\DSC06562.JPG
[2011.11.12 12:34:27 | 000,006,061 | ---- | M] () -- C:\Users\Pizzaro\Desktop\Smiley_traurig.jpg
[2011.11.10 19:52:03 | 000,033,616 | ---- | M] () -- C:\Users\Pizzaro\Desktop\36271_192352800779622_100000147102749_773714_6972341_n.jpg
[2011.11.09 10:58:11 | 000,001,878 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011.11.02 15:00:13 | 000,093,994 | ---- | M] () -- C:\Users\Pizzaro\Desktop\391934_10150369415124528_69448024527_8066824_1134879033_n.jpg
 
========== Files Created - No Company Name ==========
 
[2011.11.28 14:22:13 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.11.28 10:23:40 | 000,302,592 | ---- | C] () -- C:\Users\Pizzaro\Desktop\pfq22tqk.exe
[2011.11.28 10:02:33 | 000,000,000 | ---- | C] () -- C:\Users\Pizzaro\defogger_reenable
[2011.11.28 10:00:21 | 000,050,477 | ---- | C] () -- C:\Users\Pizzaro\Desktop\Defogger.exe
[2011.11.24 21:43:53 | 000,081,427 | ---- | C] () -- C:\Users\Pizzaro\Desktop\10_905036b4fc9bf2a9cb2ea6283abd6ec0.jpg
[2011.11.24 14:22:55 | 000,164,818 | ---- | C] () -- C:\Users\Pizzaro\Desktop\pflanzen3.pdf
[2011.11.22 16:51:25 | 000,001,128 | ---- | C] () -- C:\Users\Public\Desktop\Norton Security Scan.lnk
[2011.11.22 16:51:21 | 000,000,172 | ---- | C] () -- C:\Windows\System32\drivers\NSS\0305010.008\isolate.ini
[2011.11.22 15:13:50 | 000,388,154 | ---- | C] () -- C:\Users\Pizzaro\Desktop\Probeliegen-erlaubt-Auslegungssache-a22825816.jpg
[2011.11.22 15:11:09 | 000,357,214 | ---- | C] () -- C:\Users\Pizzaro\Desktop\Vielleicht-machen-die-Umdrehungen-in-der-Wachmaschine-tatsaechlich-wach-a22974431.jpg
[2011.11.22 15:01:02 | 000,380,093 | ---- | C] () -- C:\Users\Pizzaro\Desktop\Eindeutig-zweideutig-a22750862.jpg
[2011.11.22 14:53:47 | 000,034,341 | ---- | C] () -- C:\Users\Pizzaro\Desktop\funny04720823071.jpg
[2011.11.21 11:21:39 | 000,023,049 | ---- | C] () -- C:\Users\Pizzaro\Desktop\18949446_401_ich_bin_nicht_da_H173442_L.jpg
[2011.11.19 21:00:14 | 002,478,386 | ---- | C] () -- C:\Users\Pizzaro\Desktop\DSC06573.JPG
[2011.11.19 21:00:14 | 002,395,077 | ---- | C] () -- C:\Users\Pizzaro\Desktop\DSC06574.JPG
[2011.11.19 21:00:14 | 002,206,247 | ---- | C] () -- C:\Users\Pizzaro\Desktop\DSC06571.JPG
[2011.11.19 21:00:14 | 000,326,763 | ---- | C] () -- C:\Users\Pizzaro\Desktop\DSC06572.JPG
[2011.11.14 15:36:15 | 002,252,303 | ---- | C] () -- C:\Users\Pizzaro\Desktop\DSC06562.JPG
[2011.11.14 15:36:15 | 002,234,975 | ---- | C] () -- C:\Users\Pizzaro\Desktop\DSC06563.JPG
[2011.11.12 12:34:24 | 000,006,061 | ---- | C] () -- C:\Users\Pizzaro\Desktop\Smiley_traurig.jpg
[2011.11.10 19:51:41 | 000,033,616 | ---- | C] () -- C:\Users\Pizzaro\Desktop\36271_192352800779622_100000147102749_773714_6972341_n.jpg
[2011.11.09 10:58:11 | 000,001,878 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2011.11.02 15:00:10 | 000,093,994 | ---- | C] () -- C:\Users\Pizzaro\Desktop\391934_10150369415124528_69448024527_8066824_1134879033_n.jpg
[2011.06.12 21:01:36 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.02.28 19:16:15 | 000,087,552 | ---- | C] () -- C:\Users\Pizzaro\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.02.28 19:11:21 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat
[2011.02.28 19:11:21 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat
[2011.02.28 19:11:21 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat
[2011.02.28 19:11:21 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat
[2011.02.28 19:11:21 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat
[2011.02.28 19:11:21 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat
[2011.02.28 19:11:21 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat
[2011.02.28 19:11:21 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat
[2011.02.28 19:11:21 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat
[2011.02.28 19:11:21 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat
[2011.02.28 19:11:21 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat
[2011.02.28 19:11:21 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat
[2011.02.28 19:11:21 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat
[2011.02.28 19:11:21 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat
[2011.02.28 19:11:21 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat
[2011.02.28 19:11:21 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat
[2011.02.28 19:11:21 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat
[2011.02.28 19:11:21 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat
[2011.02.28 19:11:21 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2011.02.28 19:03:51 | 000,000,025 | ---- | C] () -- C:\Windows\CDESX100DEFGIPS.ini
[2011.02.27 20:48:01 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
[2011.02.27 15:42:38 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011.02.27 15:21:17 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011.02.27 15:21:17 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011.02.26 22:00:20 | 000,011,164 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2009.10.07 00:46:36 | 000,025,752 | ---- | C] () -- C:\Windows\System32\drivers\LVPr2Mon.sys
[2009.10.07 00:23:08 | 000,013,584 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll
[2009.08.27 08:04:12 | 000,207,400 | R--- | C] () -- C:\Windows\GSetup.exe
[2009.04.30 21:39:36 | 000,082,289 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2006.12.11 05:06:31 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2006.11.02 16:33:31 | 000,673,312 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 16:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 16:33:31 | 000,145,186 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 16:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 000,256,800 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,634,042 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,119,568 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.02.28 17:18:34 | 000,000,000 | ---D | M] -- C:\Users\Pizzaro\AppData\Roaming\Adobe
[2011.07.30 19:06:21 | 000,000,000 | ---D | M] -- C:\Users\Pizzaro\AppData\Roaming\DVDVideoSoft
[2011.03.19 12:53:19 | 000,000,000 | ---D | M] -- C:\Users\Pizzaro\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.03.14 23:14:08 | 000,000,000 | ---D | M] -- C:\Users\Pizzaro\AppData\Roaming\gtk-2.0
[2011.02.26 15:45:38 | 000,000,000 | ---D | M] -- C:\Users\Pizzaro\AppData\Roaming\Identities
[2011.02.28 19:11:19 | 000,000,000 | ---D | M] -- C:\Users\Pizzaro\AppData\Roaming\InstallShield
[2011.07.27 12:01:42 | 000,000,000 | ---D | M] -- C:\Users\Pizzaro\AppData\Roaming\Kiddinx
[2011.06.12 21:37:57 | 000,000,000 | ---D | M] -- C:\Users\Pizzaro\AppData\Roaming\Leadertech
[2011.02.28 20:04:06 | 000,000,000 | ---D | M] -- C:\Users\Pizzaro\AppData\Roaming\Macromedia
[2011.11.28 14:22:25 | 000,000,000 | ---D | M] -- C:\Users\Pizzaro\AppData\Roaming\Malwarebytes
[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\Pizzaro\AppData\Roaming\Media Center Programs
[2011.04.04 19:23:34 | 000,000,000 | --SD | M] -- C:\Users\Pizzaro\AppData\Roaming\Microsoft
[2011.02.28 18:55:47 | 000,000,000 | ---D | M] -- C:\Users\Pizzaro\AppData\Roaming\Mozilla
[2011.02.28 23:10:26 | 000,000,000 | ---D | M] -- C:\Users\Pizzaro\AppData\Roaming\OpenOffice.org
[2011.10.26 09:18:13 | 000,000,000 | ---D | M] -- C:\Users\Pizzaro\AppData\Roaming\Origin
[2011.11.28 18:05:47 | 000,000,000 | ---D | M] -- C:\Users\Pizzaro\AppData\Roaming\Skype
[2011.11.09 10:00:10 | 000,000,000 | ---D | M] -- C:\Users\Pizzaro\AppData\Roaming\skypePM
 
< %APPDATA%\*.exe /s >
[2011.03.07 14:48:15 | 000,010,134 | R--- | M] () -- C:\Users\Pizzaro\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2007.04.17 09:30:38 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c2a1b5ae\atapi.sys
[2007.04.17 09:30:38 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20518_none_dbd8b4d73d81c9d0\atapi.sys
[2008.01.19 06:06:48 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008.01.19 06:06:48 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.01.19 05:33:23 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_64dfd8ea\atapi.sys
[2008.01.19 05:33:23 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 10:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2007.01.05 21:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\drivers\nvstor.sys
[2007.01.05 21:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_45f67928\nvstor.sys
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2007.08.09 18:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=DC5F166422BEEBF195E3E4BB8AB4EE22 -- C:\Windows\System32\drivers\nvstor32.sys
[2007.08.09 18:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=DC5F166422BEEBF195E3E4BB8AB4EE22 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_99d8b088\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 10:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2011.02.26 19:53:02 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2011.02.26 19:53:02 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2008.01.19 08:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2006.11.02 10:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 10:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 08:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 09:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2011.04.18 12:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\drivers\MpNWMon.sys
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 11:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >

--- --- ---

PinaColada · 28.11.2011, 18:50

ich find es einfach super das es so eine seite wie diese gibt

cosinus · 28.11.2011, 19:53

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

ATTFilter

:OTL
IE - HKLM\..\URLSearchHook: {3d684ca7-5d30-4a7e-9768-e17df98df80f} - C:\Programme\Messenger_Plus_DE\prxtbMess.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Hotmail und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 24 37 BA 3E B3 D6 CB 01  [binary data]
IE - HKCU\..\URLSearchHook: {3d684ca7-5d30-4a7e-9768-e17df98df80f} - C:\Programme\Messenger_Plus_DE\prxtbMess.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: infofrimonde@83d.de:0.91
FF - prefs.js..keyword.URL: "chrome://browser-region/locale/region.properties"
FF - prefs.js..network.proxy.type: 0
[2011.07.31 09:56:19 | 000,002,399 | ---- | M] () -- C:\Users\Pizzaro\AppData\Roaming\Mozilla\Firefox\Profiles\vj33xm3l.default\searchplugins\askcom.xml
[2011.03.19 13:19:33 | 000,000,873 | ---- | M] () -- C:\Users\Pizzaro\AppData\Roaming\Mozilla\Firefox\Profiles\vj33xm3l.default\searchplugins\conduit.xml
[2011.10.09 09:38:11 | 000,002,770 | ---- | M] () -- C:\Users\Pizzaro\AppData\Roaming\Mozilla\Firefox\Profiles\vj33xm3l.default\searchplugins\Plusnetwork.xml
O2 - BHO: (Messenger Plus DE Toolbar) - {3d684ca7-5d30-4a7e-9768-e17df98df80f} - C:\Programme\Messenger_Plus_DE\prxtbMess.dll (Conduit Ltd.)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Messenger Plus DE Toolbar) - {3d684ca7-5d30-4a7e-9768-e17df98df80f} - C:\Programme\Messenger_Plus_DE\prxtbMess.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{e7a9bf8e-41eb-11e0-b108-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{e7a9bf8e-41eb-11e0-b108-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Autorun.exe
:Commands
[emptytemp]
[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

PinaColada · 28.11.2011, 20:19

Ich hatte konnte nur OK an klicken für einen neustart und danach war gleich folgendes Fenster auf :

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{3d684ca7-5d30-4a7e-9768-e17df98df80f} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3d684ca7-5d30-4a7e-9768-e17df98df80f}\ deleted successfully.
C:\Programme\Messenger_Plus_DE\prxtbMess.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{872b5b88-9db5-4310-bdd0-ac189557e5f5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ deleted successfully.
C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll moved successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{3d684ca7-5d30-4a7e-9768-e17df98df80f} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3d684ca7-5d30-4a7e-9768-e17df98df80f}\ not found.
File C:\Programme\Messenger_Plus_DE\prxtbMess.dll not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{872b5b88-9db5-4310-bdd0-ac189557e5f5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ not found.
File C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "Ask.com" removed from browser.search.order.1
Prefs.js: engine@conduit.com:3.3.3.2 removed from extensions.enabledItems
Prefs.js: infofrimonde@83d.de:0.91 removed from extensions.enabledItems
Prefs.js: "chrome://browser-region/locale/region.properties" removed from keyword.URL
Prefs.js: 0 removed from network.proxy.type
C:\Users\Pizzaro\AppData\Roaming\Mozilla\Firefox\Profiles\vj33xm3l.default\searchplugins\askcom.xml moved successfully.
C:\Users\Pizzaro\AppData\Roaming\Mozilla\Firefox\Profiles\vj33xm3l.default\searchplugins\conduit.xml moved successfully.
C:\Users\Pizzaro\AppData\Roaming\Mozilla\Firefox\Profiles\vj33xm3l.default\searchplugins\Plusnetwork.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3d684ca7-5d30-4a7e-9768-e17df98df80f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3d684ca7-5d30-4a7e-9768-e17df98df80f}\ not found.
File C:\Programme\Messenger_Plus_DE\prxtbMess.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ not found.
File C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{3d684ca7-5d30-4a7e-9768-e17df98df80f} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3d684ca7-5d30-4a7e-9768-e17df98df80f}\ not found.
File C:\Programme\Messenger_Plus_DE\prxtbMess.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{872b5b88-9db5-4310-bdd0-ac189557e5f5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\ not found.
File C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e7a9bf8e-41eb-11e0-b108-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e7a9bf8e-41eb-11e0-b108-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e7a9bf8e-41eb-11e0-b108-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e7a9bf8e-41eb-11e0-b108-806e6f6e6963}\ not found.
File E:\Autorun.exe not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Pizzaro
->Temp folder emptied: 203084754 bytes
->Temporary Internet Files folder emptied: 174631834 bytes
->Java cache emptied: 5372309 bytes
->FireFox cache emptied: 1043158669 bytes
->Google Chrome cache emptied: 819568 bytes
->Flash cache emptied: 23773 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1083212 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1.362,00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.31.0 log created on 11282011_200200

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot.

Registry entries deleted on Reboot...

cosinus · 29.11.2011, 09:43

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )

Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen!

fremder zugriff auf mein MSN

Plagegeister aller Art und deren Bekämpfung: fremder zugriff auf mein MSN