Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: 50 Euro Virus

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 22.03.2012, 14:46   #1
Superheld7
 
50 Euro Virus - Standard

50 Euro Virus



Auch meine Mutter hat sich mit ihrem Laptop den 50 Euro Virus eingefangen.
Ich hab bereits von anderen Hilfe Threads den ersten Schritt gemacht und dabei kam folgendes raus: (Extras.txt im Anhang da Text sonst zu lang)

OTL.text:

Zitat:
OTL logfile created on: 20.03.2012 16:42:57 - Run 1
OTL by OldTimer - Version 3.2.39.1 Folder = C:\Users\Sabine\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,68 Gb Total Physical Memory | 3,15 Gb Available Physical Memory | 85,66% Memory free
7,35 Gb Paging File | 6,84 Gb Available in Paging File | 93,05% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 449,55 Gb Total Space | 393,88 Gb Free Space | 87,62% Space Free | Partition Type: NTFS

Computer Name: SABINES-PC | User Name: Sabine | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.03.20 16:28:37 | 000,594,432 | ---- | M] (OldTimer Tools) -- C:\Users\Sabine\Downloads\OTL.exe


========== Modules (No Company Name) ==========


========== Win32 Services (SafeList) ==========

SRV - [2011.12.05 08:12:41 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011.09.23 18:08:19 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.09.23 18:01:09 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.03.01 20:23:36 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.02.25 09:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2011.01.31 21:55:14 | 000,244,624 | ---- | M] (Acer Incorporated) [Auto | Stopped] -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe -- (Live Updater Service)
SRV - [2011.01.05 14:23:58 | 000,867,712 | ---- | M] (Acer Incorporated) [Auto | Stopped] -- C:\Programme\Packard Bell\Packard Bell Power Management\ePowerSvc.exe -- (ePowerSvc)
SRV - [2010.10.12 18:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010.09.30 02:06:46 | 000,169,408 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor9.0)
SRV - [2010.09.23 02:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.09.21 22:49:00 | 002,286,976 | ---- | M] (Microsoft Corp.) [Auto | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.08.11 02:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010.06.28 23:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2010.05.04 20:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Stopped] -- c:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate) @c:\Program Files (x86)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.03 13:42:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2010.03.03 13:41:58 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.08 14:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe -- (GREGService)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012.02.15 21:34:10 | 000,132,320 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.11.30 17:11:53 | 000,279,616 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.10.01 08:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011.10.01 08:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011.10.01 08:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011.10.01 08:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011.09.15 23:55:03 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.09.15 23:55:03 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.08.01 15:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2011.07.28 18:37:10 | 000,052,584 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (USB)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.07.28 23:10:40 | 010,610,400 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010.06.21 11:45:54 | 000,287,232 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010.06.08 03:36:18 | 000,406,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM)
DRV:64bit: - [2010.05.12 03:11:38 | 002,229,608 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2010.03.19 02:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.03.04 03:51:40 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.02.27 01:32:12 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2009.09.18 05:12:06 | 000,292,912 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.09.17 11:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.20 03:09:57 | 000,054,272 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\L1E62x64.sys -- (L1E) NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.06 00:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2009.05.06 00:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.myplaycity.com/
IE - HKLM\..\URLSearchHook: {8e41e543-e069-4197-8608-e8b4c2f75747} - C:\Program Files (x86)\wellgames\tbwell.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1166249

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.gametop.com/?utm_source=fishdom&utm_medium=start
IE - HKCU\..\URLSearchHook: {8e41e543-e069-4197-8608-e8b4c2f75747} - C:\Program Files (x86)\wellgames\tbwell.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1166249
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "hxxp://home.myplaycity.com/"
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.12.23 02:11:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.19 21:51:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.02.07 19:35:35 | 000,000,000 | ---D | M]

[2011.11.30 22:35:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sabine\AppData\Roaming\mozilla\Extensions
[2012.03.06 20:31:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sabine\AppData\Roaming\mozilla\Firefox\Profiles\n7eg5clg.default\extensions
[2012.03.06 20:31:06 | 000,000,000 | ---D | M] (wellgames Community Toolbar) -- C:\Users\Sabine\AppData\Roaming\mozilla\Firefox\Profiles\n7eg5clg.default\extensions\{8e41e543-e069-4197-8608-e8b4c2f75747}
[2012.02.19 11:39:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
() (No name found) -- C:\USERS\SABINE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\N7EG5CLG.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.02.19 21:51:10 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.02.07 19:35:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.01.10 18:18:56 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.10 18:18:56 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.01.10 18:18:56 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.10 18:18:56 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.10 18:18:56 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.10 18:18:56 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (wellgames Toolbar) - {8e41e543-e069-4197-8608-e8b4c2f75747} - C:\Program Files (x86)\wellgames\tbwell.dll (Conduit Ltd.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (wellgames Toolbar) - {8e41e543-e069-4197-8608-e8b4c2f75747} - C:\Program Files (x86)\wellgames\tbwell.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Packard Bell\Packard Bell Power Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKCU..\Run: [MediaGet2] C:\Users\Sabine\AppData\Local\MediaGet2\mediaget.exe --minimized File not found
O4 - HKCU..\Run: [SkypePM] C:\Users\Sabine\AppData\Local\Skype\SkypePM.exe (Twain Working Group)
O4 - HKCU..\Run: [Spiele Post] C:\Program Files (x86)\OXXOGames\GPlayer\GameCenterNotifier.exe (Intenium)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{219D6159-1D1C-4B93-A9BA-A804EDB92342}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F90EAC65-8E9B-4323-B3FC-2570536AE517}: DhcpNameServer = 192.52.104.29
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{5ab91c61-1b98-11e1-b785-206a8a5c9710}\Shell - "" = AutoRun
O33 - MountPoints2\{5ab91c61-1b98-11e1-b785-206a8a5c9710}\Shell\AutoRun\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{5ab91c61-1b98-11e1-b785-206a8a5c9710}\Shell\configure\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{5ab91c61-1b98-11e1-b785-206a8a5c9710}\Shell\install\command - "" = F:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP



CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2012.03.18 13:35:38 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{A24A084F-7F36-4038-BC45-5359DE1D1906}
[2012.03.18 13:35:26 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{D8F0B8B0-0E86-4FEE-BA4F-4AB0E90F3B6E}
[2012.03.17 14:02:10 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{E93986BB-855D-46F6-A168-3CFE90FC5AB2}
[2012.03.17 14:01:59 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{F6394C7F-BF30-4B24-B671-2C865A51B9A5}
[2012.03.17 14:01:48 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{BC57B48D-C054-4553-9230-67FAAE278772}
[2012.03.16 11:31:38 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{0917A550-6A93-447A-A870-B59B77A61077}
[2012.03.16 11:31:27 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{E379E1FA-CF9E-44A6-BF86-4753AD37B95A}
[2012.03.16 08:06:16 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{A688A7D0-4549-415C-8C07-7CFCB91DF620}
[2012.03.16 08:06:04 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{5CC4FBFF-F824-4B1E-BA28-A7DF5E588A6E}
[2012.03.15 20:24:29 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{1C762587-748D-44A1-B429-A4E993F55902}
[2012.03.15 08:49:50 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{143F751A-116E-4572-AF06-79DC2773D10D}
[2012.03.15 08:49:26 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{9609F23A-1CB4-4D67-BF50-46BEFEF9ABCD}
[2012.03.14 19:02:33 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{553E8244-E096-4A42-B43C-39B13360AD17}
[2012.03.14 19:02:22 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{2D3ADB46-D59B-4280-B787-C5B60388017F}
[2012.03.14 16:57:39 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{FD85B5AB-43E9-464C-9D10-299D2E09C90E}
[2012.03.14 16:57:17 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{7F767065-00A8-4E4F-995E-C98F6DD14109}
[2012.03.14 06:57:09 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{A4415DB8-6A4B-4D43-B4CF-CE186C7DD565}
[2012.03.14 06:56:57 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{1B2BFF7A-8DAF-4980-9C94-DB09CA9B608F}
[2012.03.13 20:05:53 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{9C8CC26B-CA56-4727-B8C2-2B1B39B57254}
[2012.03.13 15:30:42 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{2D464311-945A-4560-B036-46DE2BC92CC4}
[2012.03.12 19:31:26 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{DE8CEFF6-4EF6-42F8-BF21-746E887D0C55}
[2012.03.12 19:31:15 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{6F45BBD0-A782-4A78-83D6-48EC3DB52175}
[2012.03.12 15:15:20 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{2CA14D8F-A274-4F04-BB79-6F411D1B0813}
[2012.03.12 15:15:09 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{3018A7CA-0173-4F55-8658-8A411CA24CA9}
[2012.03.12 14:53:14 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{F28BDFEB-C857-4D5B-AFA9-EF35F85A5842}
[2012.03.11 21:59:52 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{31617FD0-B829-492E-AFA3-D56A14B571BA}
[2012.03.11 21:59:40 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{92BB6859-8C15-4704-889B-30AA98E57876}
[2012.03.11 20:16:36 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{93A6582E-B216-41DD-A20B-CFF30168F306}
[2012.03.11 20:16:25 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{15631D26-B3EC-4498-9514-20FAEAAE6A07}
[2012.03.11 16:36:18 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{28113B01-BF86-4C7C-AB5F-BBE3BE3E2CB8}
[2012.03.11 15:43:14 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{C847C594-34FD-4EBF-B34F-C42C4A37177F}
[2012.03.11 15:43:04 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{92C55CB2-41A0-4B2E-8078-F17DF27D6260}
[2012.03.11 13:09:56 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{C4CD0359-84DA-486D-8AE4-52D24AE10647}
[2012.03.11 13:09:34 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{3B16297F-55FA-4AEF-9742-510D8FADD111}
[2012.03.10 14:23:20 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{42122E33-AAB0-442F-8F6A-F8D416C672D5}
[2012.03.10 14:23:08 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{8FB1B450-AC60-44BC-BAAD-10F5B2445584}
[2012.03.10 10:28:38 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{3A6E61FB-75C6-4CC3-99F5-D9B7E42F3DA1}
[2012.03.10 10:28:22 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{AB432319-BCA6-4CE4-8BEB-D33EC868B94E}
[2012.03.09 16:16:39 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{C603B0A8-4256-4937-AE09-EA3B7705C491}
[2012.03.09 16:16:28 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{824CE93F-4E05-41BD-B249-3896B33E476C}
[2012.03.08 19:13:49 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{F4F6A5D1-976B-4C21-9FFD-32FF6F7C7EB0}
[2012.03.08 19:13:27 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{31B0D8E1-B620-4CEF-9D9B-A36809B61D7B}
[2012.03.07 21:42:28 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{0F3BD3CE-FD06-4AA8-907C-81BB1297425F}
[2012.03.07 21:42:17 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{FE232830-2871-4836-93CD-2BDE5C506223}
[2012.03.07 21:35:50 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{7140B93A-A4D5-4606-8833-93F009372F9D}
[2012.03.07 21:35:38 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{AB2A1B12-710E-45DE-A78E-ADEA09ACF631}
[2012.03.07 15:44:52 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{4B54DD53-E790-46C2-BB07-3146BD41AAC2}
[2012.03.07 15:44:41 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{261ED810-9427-400E-9922-9942EBB05215}
[2012.03.06 20:22:24 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{4C7FFBA7-B46C-422A-8AA8-CCDDD2838113}
[2012.03.06 20:22:02 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{4E8B0126-75C1-4D11-97FB-BD80A1B8AF81}
[2012.03.06 12:09:25 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{3DFBA7F5-6531-408C-ABD8-736AA8671ECD}
[2012.03.06 12:09:03 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{A3FDFEB3-F86C-4F11-A38E-BB9547EBC5F2}
[2012.03.05 20:24:07 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{3A8703DF-FFC3-4A60-A919-D6F974888A6E}
[2012.03.05 20:23:45 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{851131B6-A984-4EBD-BFAC-E4DE6A40E50F}
[2012.03.05 17:24:41 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{9A91B6DE-7B44-4310-88DC-5D13143356E4}
[2012.03.05 17:24:29 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{976C1832-C017-4F92-B724-4BBF8AD02411}
[2012.03.05 12:03:28 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{43AB67D2-C77B-47E5-A104-6F5BF5CDE738}
[2012.03.05 12:03:05 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{28A78807-1D73-4426-8D55-FF31F0C37E6E}
[2012.03.04 21:55:26 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{7C1DC16F-88FC-42B0-B41A-EA19FA636C7A}
[2012.03.04 21:55:03 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{76B0C383-A857-4C0B-92A1-906B6C60D0FE}
[2012.03.04 17:05:30 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{C745660F-9061-4CD1-B6ED-B74591CCF21E}
[2012.03.04 17:05:19 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{D9DDDD85-7667-437E-995B-6D1575B4D7F9}
[2012.03.03 17:47:29 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{2964DFDE-FEF7-41E6-B2CA-DAC3B1C305D0}
[2012.03.03 17:47:17 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{FE1F21B5-84D5-4AB7-B16F-B418C5391EAC}
[2012.03.02 21:53:41 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{38BAE088-6AD1-433B-90BB-E9B80966E4DE}
[2012.03.02 21:53:30 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{BB08E832-A340-4924-ACC2-4A306831C4DF}
[2012.03.02 18:30:26 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Roaming\SmashFrenzy4
[2012.03.02 18:30:26 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Roaming\MB4
[2012.03.02 18:30:26 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Roaming\DreamDale
[2012.03.02 18:29:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPlayCity.com
[2012.03.02 18:29:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MyPlayCity.com
[2012.03.01 21:24:41 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{2A4C9549-EE1E-42A9-8052-447EF25C9D4D}
[2012.03.01 21:24:30 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{E05E2DCD-D314-4BCC-9BB0-4EDBDB36AA21}
[2012.03.01 10:50:34 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{B638FC33-3C44-401D-81E4-BC7E162714F1}
[2012.02.29 21:25:37 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{BB374174-E0BE-476D-962D-DB8680851FFA}
[2012.02.29 21:25:26 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{33AC204A-BC87-408B-B44C-783A8627CED5}
[2012.02.29 17:22:56 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{E3FE57F9-58BA-4C79-AB80-5F94D01AEAB5}
[2012.02.27 20:27:00 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{9B9C528B-27AD-444F-AA6B-E6FF193691EC}
[2012.02.27 20:26:49 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{D06B6E10-BF75-4B72-93C1-70E91806AEB5}
[2012.02.27 20:20:40 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{17FB4AB6-B777-4EEF-9153-963DF82DD315}
[2012.02.27 20:20:28 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{849845FC-2A6A-48B8-B7D6-8CC594FEB9BF}
[2012.02.27 14:20:21 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{0EC3E341-652D-4287-AB4C-6274FD0EDBB0}
[2012.02.27 14:20:10 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{F664F2EA-0742-4333-B202-0D46D4926A33}
[2012.02.26 14:29:53 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{1978C224-C6C6-4FF7-BD69-E6E1B14E709C}
[2012.02.26 14:29:41 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{CD465A9B-9BBC-4D39-9268-563711A67D4F}
[2012.02.25 18:54:06 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{E6A11BC7-BBCA-4091-83DB-01750F35F9CC}
[2012.02.25 18:53:55 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{B64929AE-6740-4E77-A65C-26C354C955B0}
[2012.02.25 16:00:18 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{35B93C9E-812A-4251-BAD2-77249EA5D84A}
[2012.02.25 16:00:07 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{97168718-8D18-4813-8C8A-93DD9B6A9C4B}
[2012.02.24 14:47:34 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{F75CE227-62BE-47FA-9EB9-8EADB72FF594}
[2012.02.24 14:47:12 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{011EB575-0211-47DD-86B5-6B6B2735EB17}
[2012.02.23 20:09:04 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{E61936FE-A34A-4FAD-A53F-0DABB4BB15A9}
[2012.02.23 20:08:53 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{77B9CC62-9528-4FE6-AB80-C7DA2604F890}
[2012.02.23 14:27:03 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{C581B792-25AF-4B1E-913D-93A10EFC849E}
[2012.02.22 15:02:52 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{F9D7A600-E88F-457E-B942-E1E3C5243CEF}
[2012.02.22 07:33:04 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{0884DC60-1DA4-43E7-91AB-C41E0F7E522E}
[2012.02.21 17:23:01 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{AB70DBA6-58BE-401C-A041-7857FF77F86A}
[2012.02.21 17:22:38 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{5DD7C5F5-62CE-4893-8BCD-D843B558B5B9}
[2012.02.21 09:40:11 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{E21D3EF5-E867-4456-A4AF-5CDBC801F132}
[2012.02.21 09:40:00 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{FDBD744E-3BC4-4DD7-9273-6EF99FFA39DB}
[2012.02.20 15:55:41 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{8ED16D76-7E3B-4E5D-BF5A-DB58C44E36B8}
[2012.02.20 08:38:41 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{F96C6A2B-E7CD-4BAB-8CE2-F62C81657A63}
[2012.02.20 08:38:30 | 000,000,000 | ---D | C] -- C:\Users\Sabine\AppData\Local\{515B5319-AE2D-4AD8-8E05-539228E10F70}

========== Files - Modified Within 30 Days ==========

[2012.03.20 16:26:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.20 16:26:07 | 2960,470,016 | -HS- | M] () -- C:\hiberfil.sys
[2012.03.20 16:11:31 | 000,024,432 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.20 16:11:31 | 000,024,432 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.20 09:02:39 | 000,003,408 | ---- | M] () -- C:\bootsqm.dat
[2012.03.17 14:04:32 | 001,500,018 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.03.17 14:04:32 | 000,654,610 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.03.17 14:04:32 | 000,616,452 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.03.17 14:04:32 | 000,130,192 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.03.17 14:04:32 | 000,106,574 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.03.15 08:47:48 | 000,420,560 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.03.12 21:00:44 | 000,001,161 | ---- | M] () -- C:\Users\Sabine\Desktop\Fishdom.lnk
[2012.03.04 17:08:26 | 000,002,194 | ---- | M] () -- C:\Users\Sabine\Desktop\Smash Frenzy 4.lnk
[2012.03.04 17:08:26 | 000,002,105 | ---- | M] () -- C:\Users\Sabine\Desktop\Play Online Games.lnk
[2012.03.04 17:08:26 | 000,002,070 | ---- | M] () -- C:\Users\Sabine\Desktop\MyPlayCity Games.lnk

========== Files Created - No Company Name ==========

[2012.03.20 09:02:39 | 000,003,408 | ---- | C] () -- C:\bootsqm.dat
[2012.03.12 21:00:44 | 000,001,161 | ---- | C] () -- C:\Users\Sabine\Desktop\Fishdom.lnk
[2012.03.02 18:29:38 | 000,002,194 | ---- | C] () -- C:\Users\Sabine\Desktop\Smash Frenzy 4.lnk
[2012.03.02 18:29:38 | 000,002,105 | ---- | C] () -- C:\Users\Sabine\Desktop\Play Online Games.lnk
[2012.03.02 18:29:38 | 000,002,070 | ---- | C] () -- C:\Users\Sabine\Desktop\MyPlayCity Games.lnk
[2011.12.29 12:15:33 | 000,000,080 | ---- | C] () -- C:\Windows\wiso.ini
[2011.12.25 13:40:19 | 000,000,010 | ---- | C] () -- C:\Windows\popcinfo.dat
[2011.12.02 08:05:41 | 000,000,076 | ---- | C] () -- C:\Windows\HCINST.INI
[2011.12.02 07:46:28 | 001,526,948 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.09.23 12:43:30 | 000,000,267 | ---- | C] () -- C:\Windows\LaunApp.ini
[2011.09.23 12:41:48 | 000,870,560 | ---- | C] () -- C:\Windows\SysWow64\igkrng575.bin
[2011.09.23 12:41:48 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll
[2011.09.23 12:41:48 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll
[2011.09.23 12:41:48 | 000,127,868 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng575.bin
[2011.09.23 12:41:48 | 000,104,796 | ---- | C] () -- C:\Windows\SysWow64\igfcg575m.bin
[2011.09.23 12:41:10 | 000,001,361 | ---- | C] () -- C:\Windows\WPatchProgress.ini
[2011.04.06 20:49:06 | 000,000,325 | ---- | C] () -- C:\Windows\Prelaunch.ini
[2011.04.06 20:49:06 | 000,000,271 | ---- | C] () -- C:\Windows\WisPriority.ini
[2011.04.06 20:49:06 | 000,000,168 | ---- | C] () -- C:\Windows\WisLangCode.ini

========== LOP Check ==========

[2011.11.30 17:12:59 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\DAEMON Tools Lite
[2012.03.04 17:12:50 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\DreamDale
[2011.12.02 07:54:27 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\EasternGraphics
[2012.03.02 18:31:03 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\MB4
[2011.12.31 15:51:46 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\Playrix Entertainment
[2012.03.02 18:30:26 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\SmashFrenzy4
[2012.01.24 14:55:32 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\SNS
[2011.12.27 19:18:53 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\SoftGrid Client
[2011.12.02 07:47:19 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\TP
[2011.12.02 10:07:06 | 000,000,000 | ---D | M] -- C:\Users\Sabine\AppData\Roaming\Windows Live Writer
[2012.02.16 09:08:40 | 000,032,612 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*. >
[2011.11.30 22:26:22 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.09.23 03:32:09 | 000,000,000 | ---D | M] -- C:\BOOK
[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.11.30 22:24:45 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.12.02 08:14:25 | 000,000,000 | ---D | M] -- C:\EasternGraphics
[2011.11.30 22:27:35 | 000,000,000 | ---D | M] -- C:\elements
[2011.09.23 02:57:04 | 000,000,000 | ---D | M] -- C:\Intel
[2011.11.30 17:13:37 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2011.11.30 22:25:49 | 000,000,000 | -H-D | M] -- C:\OEM
[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.02.07 19:32:03 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.03.02 18:29:26 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2012.02.07 19:35:50 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2011.11.30 22:24:45 | 000,000,000 | -HSD | M] -- C:\Programme
[2012.03.19 08:56:58 | 000,000,000 | -HSD | M] -- C:\Recovery
[2012.03.20 16:08:58 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.03.17 14:17:16 | 000,000,000 | R--D | M] -- C:\Users
[2012.03.19 09:44:20 | 000,000,000 | ---D | M] -- C:\Windows

< %PROGRAMFILES%\*.exe >

< %LOCALAPPDATA%\*.exe >

< %systemroot%\*. /mp /s >

< MD5 for: AGP440.SYS >
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

< MD5 for: EXPLORER.EXE >
[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010.11.21 04:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010.11.21 04:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

< MD5 for: IASTOR.SYS >
[2010.03.04 04:33:26 | 000,435,736 | ---- | M] (Intel Corporation) MD5=26541A068572F650A2FA490726FE81BE -- C:\OEM\Preload\Autorun\DRV\AHCI\F6\f6flpy-x86\iaStor.sys
[2010.03.04 04:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- C:\OEM\Preload\Autorun\DRV\AHCI\F6\f6flpy-x64\iaStor.sys
[2010.03.04 03:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- C:\Windows\SysNative\drivers\iaStor.sys
[2010.03.04 03:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_78ebae21a80aa2b4\iaStor.sys

< MD5 for: IASTORV.SYS >
[2010.11.21 04:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.21 04:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2010.11.21 04:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.21 04:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.21 04:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.21 04:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2011.03.11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.21 04:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.21 04:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

< MD5 for: SCECLI.DLL >
[2010.11.21 04:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.21 04:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.21 04:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.21 04:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

< MD5 for: USER32.DLL >
[2010.11.21 04:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.21 04:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010.11.21 04:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.21 04:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

< MD5 for: USERINIT.EXE >
[2010.11.21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010.11.21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010.11.21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

< MD5 for: WS2IFSL.SYS >
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >

< %systemroot%\system32\*.dll /lockedfiles >

< %USERPROFILE%\*.* >
[2011.12.01 15:21:33 | 000,000,335 | ---- | M] () -- C:\Users\Sabine\Benutzerdaten.txt
[2012.03.20 16:44:56 | 001,835,008 | -HS- | M] () -- C:\Users\Sabine\NTUSER.DAT
[2012.03.20 16:44:56 | 000,262,144 | -HS- | M] () -- C:\Users\Sabine\ntuser.dat.LOG1
[2011.11.30 22:25:05 | 000,000,000 | -HS- | M] () -- C:\Users\Sabine\ntuser.dat.LOG2
[2011.11.30 18:03:43 | 000,065,536 | -HS- | M] () -- C:\Users\Sabine\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2011.11.30 18:03:43 | 000,524,288 | -HS- | M] () -- C:\Users\Sabine\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2011.11.30 18:03:43 | 000,524,288 | -HS- | M] () -- C:\Users\Sabine\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2010.11.21 03:50:53 | 000,000,020 | -HS- | M] () -- C:\Users\Sabine\ntuser.ini

< %USERPROFILE%\Local Settings\Temp\*.exe >

< %USERPROFILE%\Local Settings\Temp\*.dll >

< %USERPROFILE%\Application Data\*.exe >

< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

< End of report >

Alt 22.03.2012, 14:53   #2
Chris4You
 
50 Euro Virus - Standard

50 Euro Virus



Hi,


Fix für OTL:
  • Doppelklick auf die OTL.exe, um das Programm auszuführen.
  • Vista/Win7-User bitte per Rechtsklick und "Ausführen als Administrator" starten.
  • Kopiere den Inhalt der folgenden Codebox komplett in die OTL-Box unter "Custom Scan/Fixes"

Code:
ATTFilter
:OTL
O4 - HKLM..\Run: [] File not found
O4 - HKCU..\Run: [MediaGet2] C:\Users\Sabine\AppData\Local\MediaGet2\mediaget.exe --minimized File not found
O4 - HKCU..\Run: [SkypePM] C:\Users\Sabine\AppData\Local\Skype\SkypePM.exe (Twain Working Group)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

:reg
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = dword:0x01

:Commands
[emptytemp]
[Reboot]
         
  • Den roten Run Fixes! Button anklicken.
  • Bitte alles aus dem Ergebnisfenster (Results) herauskopieren.
  • Eine Kopie eines OTL-Fix-Logs wird in einer Textdatei in folgendem Ordner gespeichert:
  • %systemroot%\_OTL

Malwarebytes Antimalware (MAM)
Anleitung&Download hier: http://www.trojaner-board.de/51187-m...i-malware.html
Falls der Download nicht klappt, bitte hierüber eine generische Version runterladen:
http://filepony.de/download-chameleon/
Danach bitte update der Signaturdateien (Reiter "Aktualisierungen" -> Suche nach Aktualisierungen")
Fullscan und alles bereinigen lassen! Log posten.

chris
__________________

__________________

Alt 22.03.2012, 20:28   #3
Superheld7
 
50 Euro Virus - Standard

50 Euro Virus



Leider hängt sich der PC auf, wenn ich das mache und %systemroot%/_otl gibt es leider auch nicht.
__________________

Alt 22.03.2012, 21:21   #4
Chris4You
 
50 Euro Virus - Standard

50 Euro Virus



Hi,
im abgesicherten Modus (F8 beim Booten) probieren...
Wo genau bleibt er haengen? Laueft dabei die Antivierenloesung (->abschalten!)
chris
__________________
Don't bring me down
Vor dem posten beachten!
Spenden
(Wer spenden will, kann sich gerne melden )

Antwort

Themen zu 50 Euro Virus
adobe, antivir, avira, bho, bingbar, conduit, desktop, euro, explorer, firefox, format, home, launch, logfile, nvidia, nvstor.sys, object, opera, packard bell, plug-in, programme, realtek, registry, required, rundll, scan, searchscopes, senden, usb, virus, wildtangent games, windows, winlogon.exe



Ähnliche Themen: 50 Euro Virus


  1. 100 Euro Virus / IDP.Trojan.4724C1BC / AVG Anti-Virus nicht aktivierbar
    Plagegeister aller Art und deren Bekämpfung - 22.10.2012 (18)
  2. AKM-Virus/50 Euro
    Plagegeister aller Art und deren Bekämpfung - 04.09.2012 (1)
  3. Virus blockiert PC! Gema Bundestrojaner Virus - 50 euro Ukash?
    Plagegeister aller Art und deren Bekämpfung - 06.05.2012 (4)
  4. 50 Euro Virus
    Log-Analyse und Auswertung - 03.04.2012 (10)
  5. GVU-50-Euro-Virus auf PC
    Log-Analyse und Auswertung - 28.03.2012 (15)
  6. AKM 50-Euro Virus
    Plagegeister aller Art und deren Bekämpfung - 17.03.2012 (5)
  7. 50-Euro-Virus
    Plagegeister aller Art und deren Bekämpfung - 19.02.2012 (17)
  8. 50 Euro Virus auf Win XP
    Log-Analyse und Auswertung - 15.02.2012 (21)
  9. 50 euro virus, Otl wurde angewendet! ist der Virus weg? -.-
    Log-Analyse und Auswertung - 15.02.2012 (33)
  10. 50 Euro Virus
    Log-Analyse und Auswertung - 14.02.2012 (14)
  11. 50 Euro Sperre, 50 Euro Virus
    Log-Analyse und Auswertung - 12.02.2012 (14)
  12. Der 50 Euro Virus
    Log-Analyse und Auswertung - 08.02.2012 (3)
  13. 50 euro virus
    Log-Analyse und Auswertung - 06.02.2012 (7)
  14. Windows Systemblock 50 Euro zahlen + BKA Virus 100 Euro zahlen
    Log-Analyse und Auswertung - 29.01.2012 (1)
  15. HARTNÄCKIGER 50 Euro Virus / GEMA Virus
    Log-Analyse und Auswertung - 10.01.2012 (10)
  16. 50 Euro Virus
    Plagegeister aller Art und deren Bekämpfung - 02.01.2012 (5)
  17. 50 euro Virus
    Plagegeister aller Art und deren Bekämpfung - 27.12.2011 (3)

Zum Thema 50 Euro Virus - Auch meine Mutter hat sich mit ihrem Laptop den 50 Euro Virus eingefangen. Ich hab bereits von anderen Hilfe Threads den ersten Schritt gemacht und dabei kam folgendes raus: (Extras.txt - 50 Euro Virus...
Archiv
Du betrachtest: 50 Euro Virus auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.