| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: GVU TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
30.08.2012, 01:13
| #1 |
 |  GVU Trojaner Hallo ICh hoffe ich habe da alles richtig gemacht bin zum ersten mal hier ^^ naja zurück zu meinen prob. nehmlich mein bruter hat den gvu trojaner und jetzt stadt alles neu installiren (das erst vor 3 wochen neu installirt wurde) und bei euch schon öffteres hilfreiche sachen gefunden habe habe jetzt das prob OTL.TXT Code:
ATTFilter OTL logfile created on: 30.08.2012 01:38:52 - Run 1 OTL by OldTimer - Version 3.2.59.1 Folder = C:\Users\DAVID\Desktop Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,25 Gb Total Physical Memory | 2,41 Gb Available Physical Memory | 74,12% Memory free 6,50 Gb Paging File | 5,52 Gb Available in Paging File | 85,03% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 114,40 Gb Total Space | 79,37 Gb Free Space | 69,38% Space Free | Partition Type: NTFS Drive D: | 37,25 Gb Total Space | 28,81 Gb Free Space | 77,35% Space Free | Partition Type: NTFS Computer Name: DAVID-PC | User Name: DAVID | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.08.30 01:22:15 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\DAVID\Desktop\OTL.exe PRC - [2012.07.29 11:23:14 | 000,188,760 | ---- | M] () -- C:\Programme\Web Assistant\ExtensionUpdaterService.exe PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.07.04 08:21:18 | 000,453,632 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe PRC - [2012.07.04 08:20:42 | 000,217,088 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe PRC - [2012.07.04 01:34:42 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.06.05 09:39:42 | 000,289,544 | ---- | M] () -- C:\Programme\PC Beschleunigen\PCSUService.exe PRC - [2012.05.29 15:50:04 | 000,115,032 | R--- | M] (SweetIM Technologies Ltd.) -- C:\Programme\SweetIM\Messenger\SweetIM.exe PRC - [2012.02.26 16:01:44 | 000,295,728 | ---- | M] (SweetIM Technologies Ltd.) -- C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe PRC - [2011.03.28 20:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE PRC - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE PRC - [2011.03.28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\BingBar\SeaPort.EXE PRC - [2010.05.20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft LifeCam\MSCamS32.exe PRC - [2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe ========== Modules (No Company Name) ========== MOD - [2012.08.01 19:37:35 | 000,240,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\961b28b18dc304d4434ca9938abd1d60\WindowsFormsIntegration.ni.dll MOD - [2012.08.01 17:51:04 | 002,295,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\c366ebd7f33816762268154efc68176d\System.Core.ni.dll MOD - [2012.08.01 01:14:04 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\fc626095c194be137bceb219934b06a7\PresentationFramework.Aero.ni.dll MOD - [2012.08.01 01:13:59 | 014,325,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\517358eb2fd962a942dd1ea6afc5b93e\PresentationFramework.ni.dll MOD - [2012.08.01 01:13:46 | 012,218,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\e9d0ba41128f363f2390c7e630129c2b\PresentationCore.ni.dll MOD - [2012.08.01 01:13:46 | 000,060,928 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\68b5806af0df6ce86027bacb7dc37233\UIAutomationProvider.ni.dll MOD - [2012.08.01 01:13:36 | 003,325,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\b68fdf2c95b93fc5006a092c11eed07c\WindowsBase.ni.dll MOD - [2012.08.01 01:13:29 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll MOD - [2012.08.01 01:13:09 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll MOD - [2012.08.01 01:13:02 | 011,824,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\84fbf353f91385690a3e4e982aa6930e\System.Web.ni.dll MOD - [2012.08.01 01:12:54 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll MOD - [2012.08.01 01:12:51 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll MOD - [2012.08.01 01:12:47 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll MOD - [2012.08.01 01:12:42 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll MOD - [2012.08.01 01:12:33 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll MOD - [2012.07.20 14:42:02 | 000,652,800 | ---- | M] () -- C:\Programme\IZArc\IZArcCM.dll MOD - [2012.07.04 01:34:48 | 000,095,232 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll MOD - [2012.07.04 01:16:08 | 000,369,152 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll MOD - [2009.07.14 10:47:20 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll MOD - [2009.07.14 10:47:12 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2009.07.14 10:47:12 | 000,208,896 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll ========== Services (SafeList) ========== SRV - [2012.08.23 18:52:58 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.08.01 01:43:59 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.07.29 11:23:14 | 000,188,760 | ---- | M] () [Auto | Running] -- C:\Programme\Web Assistant\ExtensionUpdaterService.exe -- (Web Assistant Updater) SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.07.14 02:13:54 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.07.04 08:20:42 | 000,217,088 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility) SRV - [2012.07.04 01:34:42 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service) SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.06.05 09:39:42 | 000,289,544 | ---- | M] () [Auto | Running] -- C:\Programme\PC Beschleunigen\PCSUService.exe -- (PCSUService) SRV - [2012.03.08 18:32:24 | 001,492,840 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc) SRV - [2011.04.01 11:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Programme\Microsoft\BingBar\BBSvc.EXE -- (BBSvc) SRV - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2011.03.28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft\BingBar\SeaPort.EXE -- (SeaPort) SRV - [2010.09.22 16:33:04 | 000,051,040 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV - [2010.05.20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) ========== Driver Services (SafeList) ========== DRV - [2012.07.04 08:58:12 | 010,070,016 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2012.07.04 08:58:12 | 010,070,016 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag) DRV - [2012.07.04 07:10:30 | 000,290,304 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap) DRV - [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2012.02.23 14:31:58 | 000,086,544 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService) DRV - [2010.05.20 15:27:24 | 000,030,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nx6000.sys -- (MSHUSBVideo) DRV - [2010.02.18 09:18:22 | 000,037,944 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\amdiox86.sys -- (amdiox86) DRV - [2009.07.14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2009.07.14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2009.07.14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2009.07.14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2009.07.14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6} IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&crg=3.16010003&st=12&q={searchTerms}&barid={02010704-9E70-4432-A75F-0CAEB55238B6} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://mystart.incredibar.com/mb178?a=6OyM8En1pg&i=26 IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 55 73 BC AC 68 6F CD 01 [binary data] IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.) IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=112555&tt=010812_nich_3112_7&babsrc=SP_ss&mntrId=60755749000000000000001d9284e761 IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb178/?search={searchTerms}&loc=IB_DS&a=6OyM8En1pg&i=26 IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&crg=3.16010003&st=12&q={searchTerms}&barid={02010704-9E70-4432-A75F-0CAEB55238B6} IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "MyStart Search" FF - prefs.js..browser.search.defaulturl: "" FF - prefs.js..browser.search.order.1: "Search the web (Babylon)" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://www.hlportal.de/" FF - prefs.js..keyword.URL: "hxxp://mystart.incredibar.com/mb178/?loc=IB_DS&a=6OyM8En1pg&&i=26&search=" FF - prefs.js..network.proxy.type: 0 FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Search the web (Babylon)" FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://www.hlportal.de/" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\DAVID\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\DAVID\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\DAVID\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\DAVID\AppData\Local\Facebook\Messenger\2.1.4590.0\npFbDesktopPlugin.dll (Facebook, Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012.08.25 23:35:09 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.08.01 01:25:37 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.08.01 01:25:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DAVID\AppData\Roaming\mozilla\Extensions [2012.08.25 23:44:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions [2012.08.01 22:42:36 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.08.04 15:35:56 | 000,000,000 | ---D | M] (Default Manager) -- C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\DefaultManager@Microsoft [2012.08.05 14:07:33 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com [2012.08.25 23:35:07 | 000,002,203 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\searchplugins\MyStart Search.xml [2012.08.13 12:21:26 | 000,004,003 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\searchplugins\sweetim.xml [2012.08.01 01:25:37 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.08.25 23:35:09 | 000,000,000 | ---D | M] (Web Assistant) -- C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX [2012.08.02 16:10:28 | 000,330,316 | ---- | M] () (No name found) -- C:\USERS\DAVID\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2ST5ITBF.DEFAULT\EXTENSIONS\PERSONAS@CHRISTOPHER.BEARD.XPI [2012.07.14 02:15:45 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.07.14 02:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.08.04 18:20:45 | 000,002,361 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml [2012.07.14 02:45:08 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.07.14 02:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.07.14 02:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.07.14 02:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.07.14 02:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6} CHR - default_search_provider: MyStart Search (Enabled) CHR - default_search_provider: search_url = hxxp://mystart.incredibar.com/mb178/?loc=IB_DS&search={searchTerms}&a=6OyM8En1pg&i=26 CHR - default_search_provider: suggest_url = CHR - homepage: hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6} CHR - plugin: Shockwave Flash (Enabled) = C:\Users\DAVID\AppData\Local\Google\Chrome\Application\21.0.1180.75\PepperFlash\pepflashplayer.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Users\DAVID\AppData\Local\Google\Chrome\Application\21.0.1180.83\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\DAVID\AppData\Local\Google\Chrome\Application\21.0.1180.83\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\DAVID\AppData\Local\Google\Chrome\Application\21.0.1180.83\pdf.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Java(TM) Platform SE 7 U5 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll CHR - plugin: Java Deployment Toolkit 7.0.50.6 (Enabled) = C:\Windows\system32\npDeployJava1.dll CHR - plugin: Windows Live\\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: Facebook Desktop (Enabled) = C:\Users\DAVID\AppData\Local\Facebook\Messenger\2.1.4590.0\npFbDesktopPlugin.dll CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\DAVID\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll CHR - plugin: Google Update (Enabled) = C:\Users\DAVID\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw_1165635.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll CHR - Extension: Blue Mist = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\chgkbmdcobedhknnajfbimomnhndjfaa\1_0\ CHR - Extension: Web Assistant = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.474_0\ CHR - Extension: SweetIM for Facebook = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\Copy of CHR - Extension: SweetIM for Facebook = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\ CHR - Extension: New tab for Chrome\u2122 = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg\1.0.0_0\ CHR - Extension: Blue Mist = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\chgkbmdcobedhknnajfbimomnhndjfaa\1_0\ CHR - Extension: Web Assistant = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.474_0\ CHR - Extension: SweetIM for Facebook = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\Copy of CHR - Extension: SweetIM for Facebook = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\ CHR - Extension: New tab for Chrome\u2122 = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg\1.0.0_0\ O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\bh\BabylonToolbar.dll (Babylon BHO) O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Programme\Web Assistant\Extension32.dll () O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Programme\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (Montera Technologeis LTD) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarTlbr.dll (Babylon Ltd.) O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Programme\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD) O3 - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O4 - HKLM..\Run: [AMD AVT] C:\Windows\System32\cmd.exe (Microsoft Corporation) O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.) O4 - HKLM..\Run: [Sweetpacks Communicator] C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.) O4 - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000..\Run: [Facebook Update] C:\Users\DAVID\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.) O4 - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000..\Run: [PCSpeedUp] C:\Programme\PC Beschleunigen\PCSUNotifier.exe () O4 - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000..\Run: [Speech Recognition] C:\Windows\Speech\Common\sapisvr.exe (Microsoft Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - Startup: C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\DAVID\AppData\Local\Facebook\Messenger\2.1.4590.0\FacebookMessenger.exe (Facebook) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\DAVID\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation) O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A4F21A1A-2DCA-4472-8E3E-8C886204D1F9}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353) ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {23A20C3C-2ADD-4A80-AFB4-C146F8847D79} - .NET Framework ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906) ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.08.30 01:30:29 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Malwarebytes [2012.08.30 01:30:19 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.08.30 01:30:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.08.30 01:30:19 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.08.30 01:30:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.08.30 01:24:40 | 010,652,120 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\DAVID\Desktop\mbam-setup-1.62.0.1300.exe [2012.08.30 01:22:13 | 000,598,528 | ---- | C] (OldTimer Tools) -- C:\Users\DAVID\Desktop\OTL.exe [2012.08.29 19:36:28 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0 [2012.08.29 16:43:49 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{FDEFC916-94F8-402F-BF07-85166C54D94D} [2012.08.28 14:59:18 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\test [2012.08.28 14:57:48 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Kaiba Corporation [2012.08.28 13:53:23 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2012.08.28 13:47:34 | 000,445,016 | ---- | C] (Creative Labs) -- C:\Windows\System32\wrap_oal.dll [2012.08.28 13:47:34 | 000,265,216 | ---- | C] (The OpenSSL Project, hxxp://www.openssl.org/) -- C:\Windows\System32\ssleay32.dll [2012.08.28 13:47:33 | 000,265,216 | ---- | C] (The OpenSSL Project, hxxp://www.openssl.org/) -- C:\Windows\System32\libssl32.dll [2012.08.28 13:47:33 | 000,103,424 | ---- | C] (GNU <www.gnu.org>) -- C:\Windows\System32\libintl3.dll [2012.08.28 13:47:32 | 002,288,181 | ---- | C] (Red Hat) -- C:\Windows\System32\cygwin1.dll [2012.08.28 13:47:32 | 001,178,112 | ---- | C] (The OpenSSL Project, hxxp://www.openssl.org/) -- C:\Windows\System32\libeay32.dll [2012.08.28 13:47:32 | 001,008,128 | ---- | C] (GnuWin32 <hxxp://gnuwin32.sourceforge.net>) -- C:\Windows\System32\libiconv2.dll [2012.08.28 13:47:32 | 000,325,376 | ---- | C] (AutoIt Team) -- C:\Windows\System32\AutoItX3.dll [2012.08.28 13:47:32 | 000,131,072 | ---- | C] (Sereby Corporation) -- C:\Windows\System32\AiORuntimes.dll [2012.08.28 13:45:52 | 000,000,000 | ---D | C] -- C:\Windows\System32\URTTEMP [2012.08.28 13:27:38 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{AA70E4C7-3EA6-4479-AAFD-4B32DC075A42} [2012.08.27 16:14:31 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{3DE389B4-21C6-4EF5-8BF2-2125B738FB7E} [2012.08.26 16:04:19 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{74C5C7E0-7B28-40F1-B457-603587B130DD} [2012.08.25 23:36:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IZArc [2012.08.25 23:36:55 | 000,000,000 | ---D | C] -- C:\Program Files\IZArc [2012.08.25 23:35:17 | 000,000,000 | ---D | C] -- C:\Program Files\Perion [2012.08.25 23:35:12 | 000,000,000 | ---D | C] -- C:\Program Files\Incredibar.com [2012.08.25 23:35:09 | 000,000,000 | ---D | C] -- C:\Program Files\Web Assistant [2012.08.25 16:39:53 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1422C04D-9D74-4483-865B-52C45E21E570} [2012.08.24 15:53:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{A5C05416-0D11-4151-97E2-EC046BE23852} [2012.08.23 16:15:25 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{A3BDA7CD-7DC8-4F42-B547-D0FE664CC038} [2012.08.23 01:00:11 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{81CC2B07-26AC-448A-936F-B214C29D51AB} [2012.08.22 12:59:25 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{3B1172AC-8B45-4ED4-9572-266D3B87A182} [2012.08.22 00:58:49 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{D5D78E76-B6C4-43ED-A7E9-4E0226747904} [2012.08.21 12:58:26 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{90C325E5-C120-49B6-B17F-51BC89180147} [2012.08.21 00:57:51 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{8D27366A-EF92-4DEA-A76E-40514405ADBE} [2012.08.20 12:57:16 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{B7698B4A-3A96-4D69-BBCE-612004A05FD7} [2012.08.19 14:07:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft LifeCam [2012.08.19 12:58:48 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1BCE4FB6-C611-48A9-ADB4-A4BE3F99FFB9} [2012.08.18 17:46:35 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\Neuer Ordner (2) [2012.08.18 09:27:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{F5FF8639-8AAA-4099-B3B3-3AE8D854DB48} [2012.08.18 09:27:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{5429EB52-19E3-43D6-BCC3-B199799BB7AD} [2012.08.15 13:12:56 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{0AC293C2-380F-4FC8-973B-D1DA57F894E3} [2012.08.15 13:12:34 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{69187003-FC8F-4047-A90E-97A4608E6069} [2012.08.15 01:12:09 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{5A3141BA-7C90-404A-BDCD-C519CC469776} [2012.08.15 01:11:47 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{5647895B-9C4B-409E-A38C-2772D698418F} [2012.08.14 13:11:04 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{B0C8A4DA-2EAB-4BB2-9709-E04AFFC4CE21} [2012.08.14 13:10:54 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{17BFBFA2-3B8A-4DCD-990B-5E34AB8589D3} [2012.08.14 00:09:17 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{FAD0800A-D4C8-472E-BCBE-AD056320F233} [2012.08.14 00:08:55 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{297A7543-3CE9-4971-9F13-1548882E53F0} [2012.08.13 12:21:07 | 000,000,000 | ---D | C] -- C:\ProgramData\SweetIM [2012.08.13 12:21:07 | 000,000,000 | ---D | C] -- C:\Program Files\SweetIM [2012.08.13 12:21:04 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Namco [2012.08.13 12:21:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Pacman [2012.08.13 12:07:57 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1C986E0F-39FE-404D-9C06-AFFF63788D27} [2012.08.13 12:07:40 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{235318B8-F279-4CA9-A52E-A5CC759CE37E} [2012.08.12 23:52:40 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1863F3F9-C4EE-4E4E-BE72-6B42E973A38A} [2012.08.12 23:52:19 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{840B3278-5D66-4516-ADD9-0AC97A23CB30} [2012.08.12 21:48:34 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome [2012.08.12 21:47:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Google [2012.08.12 12:52:05 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Facebook [2012.08.12 12:34:21 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\Neuer Ordner [2012.08.12 11:51:35 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{C1E37549-7EB1-4C8E-93A5-8FE0C663A06C} [2012.08.12 11:51:19 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1ED976BA-9880-4615-8287-38FE7E3D7F83} [2012.08.12 01:41:48 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{2AC7E57D-A98C-41F3-BFB1-4D4DB3863B53} [2012.08.12 01:41:26 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{A6B5B453-2E78-4CDB-8B52-B99E543F0188} [2012.08.11 13:40:56 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{269AA1F6-34B6-4809-BE3C-DC44F4FA75D4} [2012.08.11 13:40:43 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{310F73D9-E60F-483F-9B61-8BC8AF9494B2} [2012.08.11 01:28:36 | 000,000,000 | ---D | C] -- C:\Program Files\osu! [2012.08.11 01:27:32 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Downloaded Installations [2012.08.10 15:59:37 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{DDDEBA05-4446-4E17-9086-4A17F993C423} [2012.08.10 15:59:15 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{456EA81D-AF2B-416A-B8E4-331D321D94CD} [2012.08.10 03:58:49 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{B7EF1C98-97A8-4FAF-83EC-E773C8EB479C} [2012.08.09 15:57:49 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{C59EEA8A-D61E-4067-B523-B362207F253B} [2012.08.09 15:57:28 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{05D54603-FF7E-4972-A537-E4E99B176E79} [2012.08.09 15:50:01 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft LifeCam [2012.08.09 15:49:03 | 000,000,000 | ---D | C] -- C:\e51500d3262ef71cfa616f1fe023 [2012.08.09 15:02:04 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1912FD8E-4F8C-4DD2-9ABE-B6337B08A99F} [2012.08.08 15:22:32 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{3EA14EC2-49DA-4ABF-9973-41A45A6A36E4} [2012.08.08 15:22:08 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1F2267B3-DCE0-4DC8-B3A4-E0D9A0B5E061} [2012.08.08 03:21:43 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{4838BC28-92D9-4830-8577-0213983EC707} [2012.08.08 03:21:21 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{0C079B8E-8EC4-414A-8962-97BE5F46FC49} [2012.08.07 15:21:07 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{E02D56C4-A005-431F-9758-88F30D4BFD59} [2012.08.07 15:20:45 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{CBDA15B1-0953-4E03-9631-24B4ECF4DC67} [2012.08.07 03:20:17 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{9F2A31F6-DBF8-45BA-AE38-8DC41891BECB} [2012.08.07 03:19:56 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{2666C542-9294-44C6-989C-A3AA218411CB} [2012.08.06 15:19:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{A8A3BA5A-B6F5-47A7-A155-714F8EA8AC8D} [2012.08.06 15:19:30 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{408FFAD5-F2FA-4003-87C0-B5BE3EE339A7} [2012.08.05 19:50:29 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Facebook [2012.08.05 15:37:03 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{F5F71426-9B07-440E-8A74-893D43DB5AC5} [2012.08.05 15:36:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{660D6C36-EB57-4749-99B8-EC6A1731ECF9} [2012.08.05 03:36:17 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{199BBFA7-03AB-4B30-B7B2-0F36BB5F406E} [2012.08.05 03:36:07 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{49BB09EF-F59F-48F5-9CF2-C1A95C8E6203} [2012.08.04 18:20:54 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\BabylonToolbar [2012.08.04 18:20:49 | 000,000,000 | ---D | C] -- C:\Program Files\BabylonToolbar [2012.08.04 18:20:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon [2012.08.04 18:20:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Babylon [2012.08.04 18:20:33 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\YourFileDownloader [2012.08.04 18:20:33 | 000,000,000 | ---D | C] -- C:\Program Files\YourFileDownloader [2012.08.04 18:09:37 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET [2012.08.04 15:35:51 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{8C8178A6-3AF8-4CC6-BCE1-F66F1883CE6C} [2012.08.04 15:35:37 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{8FB349F9-71F5-4C01-8982-5A562376DAAF} [2012.08.04 15:35:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{B4EF47E7-3879-4F1C-91B6-F28AEAF05972} [2012.08.03 18:15:30 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\INVedit [2012.08.03 14:06:47 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{9CD59B95-DBD1-4F4B-821E-1643F6892142} [2012.08.03 14:06:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{C6697D36-273A-4462-A68B-BC4711B63CA9} [2012.08.02 16:18:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{7A4C2557-182F-48B5-9824-24BC1977C34B} [2012.08.02 16:18:01 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{FF041113-94D8-4843-B1B9-CD21598ADF43} [2012.08.01 22:44:30 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Documents\PCSpeedUp [2012.08.01 22:44:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Beschleunigen [2012.08.01 22:44:21 | 000,000,000 | ---D | C] -- C:\Program Files\PC Beschleunigen [2012.08.01 22:42:55 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\OpenCandy [2012.08.01 22:42:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoftIEHelpers [2012.08.01 22:42:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft [2012.08.01 22:42:30 | 000,405,144 | ---- | C] (Newtonsoft) -- C:\Windows\System32\Newtonsoft.Json.Net20.dll [2012.08.01 22:42:17 | 000,000,000 | ---D | C] -- C:\Program Files\DVDVideoSoft [2012.08.01 22:42:17 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DVDVideoSoft [2012.08.01 22:41:33 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoft [2012.08.01 21:33:11 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{44362EDA-AF1C-463A-803F-03AB0D7903B8} [2012.08.01 21:33:05 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Documents\Meine empfangenen Dateien [2012.08.01 21:33:01 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{BD0C36FC-4345-475D-8E00-7B2CB1546E34} [2012.08.01 21:32:47 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Tracing [2012.08.01 21:29:15 | 000,000,000 | ---D | C] -- C:\Windows\de [2012.08.01 21:28:31 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE [2012.08.01 21:28:08 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live [2012.08.01 21:27:36 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SQL Server Compact Edition [2012.08.01 21:25:26 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live [2012.08.01 21:24:31 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft [2012.08.01 21:23:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2012.08.01 21:23:14 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2012.08.01 21:19:57 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Windows Live [2012.08.01 21:19:55 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live [2012.08.01 20:48:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\rom & emulator [2012.08.01 20:46:18 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\musik meins [2012.08.01 20:46:16 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\deck [2012.08.01 20:45:24 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\mein bilder neue version ^_^ [2012.08.01 20:45:02 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\Love [2012.08.01 20:43:40 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\hg und so bilder [2012.08.01 20:42:34 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\Neuer Ordner (9) [2012.08.01 20:42:31 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\fotos und co [2012.08.01 20:42:30 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\Neuer Ordner (13) [2012.08.01 20:42:19 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\David sicherung [2012.08.01 20:22:50 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\ElevatedDiagnostics [2012.08.01 20:00:18 | 000,000,000 | ---D | C] -- C:\Windows\ja-JP [2012.08.01 20:00:17 | 000,000,000 | ---D | C] -- C:\Windows\en-US [2012.08.01 19:59:53 | 000,000,000 | ---D | C] -- C:\Windows\System32\ja [2012.08.01 19:59:53 | 000,000,000 | ---D | C] -- C:\Windows\System32\0411 [2012.08.01 19:59:49 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\ja-JP [2012.08.01 19:54:35 | 000,003,072 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\System32\drivers\ja-JP\pscr.sys.mui [2012.08.01 19:54:32 | 000,031,744 | ---- | C] (Marvell) -- C:\Windows\System32\drivers\ja-JP\yk62x86.sys.mui [2012.08.01 19:53:54 | 000,006,656 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\drivers\ja-JP\BrSerIb.sys.mui [2012.08.01 19:53:53 | 000,006,144 | ---- | C] (Agere Systems) -- C:\Windows\System32\drivers\ja-JP\ltmdmnt.sys.mui [2012.08.01 19:53:32 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\drivers\ja-JP\BrParwdm.sys.mui [2012.08.01 19:53:31 | 000,006,656 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\drivers\ja-JP\BrSerId.sys.mui [2012.08.01 17:49:51 | 000,000,000 | ---D | C] -- C:\Program Files\Paint.NET [2012.08.01 17:49:33 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Paint.NET [2012.08.01 17:48:39 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\PhotoScape [2012.08.01 17:48:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoScape [2012.08.01 17:48:18 | 000,000,000 | ---D | C] -- C:\Program Files\PhotoScape [2012.08.01 01:52:14 | 000,000,000 | ---D | C] -- C:\Program Files\Defraggler [2012.08.01 01:51:15 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Skype [2012.08.01 01:51:09 | 000,000,000 | R--D | C] -- C:\Program Files\Skype [2012.08.01 01:51:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2012.08.01 01:51:09 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2012.08.01 01:51:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2012.08.01 01:50:58 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2012.08.01 01:42:26 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Steam [2012.08.01 01:42:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam [2012.08.01 01:42:24 | 000,000,000 | ---D | C] -- C:\Program Files\Steam [2012.08.01 01:41:09 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\.minecraft [2012.08.01 01:33:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2012.08.01 01:33:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2012.08.01 01:31:43 | 000,000,000 | ---D | C] -- C:\Windows\System32\Adobe [2012.08.01 01:31:28 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Adobe [2012.08.01 01:30:40 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe [2012.08.01 01:30:40 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe [2012.08.01 01:29:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Macromedia [2012.08.01 01:29:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Macromedia [2012.08.01 01:29:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Adobe [2012.08.01 01:28:13 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed [2012.08.01 01:28:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe [2012.08.01 01:25:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Mozilla [2012.08.01 01:25:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Mozilla [2012.08.01 01:25:37 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service [2012.08.01 01:25:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla [2012.08.01 01:25:36 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2012.08.01 01:17:42 | 000,000,000 | -H-D | C] -- C:\Program Files\Temp [2012.08.01 01:15:56 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\AMD [2012.08.01 01:15:52 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\ATI [2012.08.01 01:15:52 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\ATI [2012.08.01 01:15:52 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2012.08.01 01:15:51 | 000,000,000 | ---D | C] -- C:\Program Files\AMD AVT [2012.08.01 01:15:48 | 000,000,000 | ---D | C] -- C:\Program Files\AMD APP [2012.08.01 01:15:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies [2012.08.01 01:15:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center [2012.08.01 01:14:58 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD [2012.08.01 01:14:11 | 000,000,000 | ---D | C] -- C:\Program Files\ATI [2012.08.01 01:13:49 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies [2012.08.01 01:12:59 | 000,000,000 | ---D | C] -- C:\AMD [2012.08.01 00:50:35 | 000,000,000 | ---D | C] -- C:\Windows\Panther [2012.08.01 00:34:49 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Microsoft Games [2012.08.01 00:13:48 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2012.08.01 00:13:45 | 000,000,000 | -HSD | C] -- C:\Windows\Installer [2012.08.01 00:02:30 | 000,000,000 | R--D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2012.08.01 00:02:30 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Searches [2012.08.01 00:02:30 | 000,000,000 | R--D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2012.08.01 00:02:20 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Identities [2012.08.01 00:02:18 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Contacts [2012.08.01 00:02:09 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\VirtualStore [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Vorlagen [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\AppData\Local\Verlauf [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\AppData\Local\Temporary Internet Files [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Startmenü [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\SendTo [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Recent [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Netzwerkumgebung [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Lokale Einstellungen [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Druckumgebung [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Cookies [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\AppData\Local\Anwendungsdaten [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Anwendungsdaten [2012.08.01 00:02:02 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Documents\Eigene Videos [2012.08.01 00:02:02 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Documents\Eigene Musik [2012.08.01 00:02:02 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Eigene Dateien [2012.08.01 00:02:02 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Documents\Eigene Bilder [2012.08.01 00:02:01 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Temp [2012.08.01 00:02:01 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Microsoft [2012.08.01 00:02:01 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Media Center Programs [2012.08.01 00:02:00 | 000,000,000 | --SD | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Videos [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Saved Games [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Pictures [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Music [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Links [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Favorites [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Downloads [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Documents [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Desktop [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2012.08.01 00:02:00 | 000,000,000 | -H-D | C] -- C:\Users\DAVID\AppData [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Recovery [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Programme [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2012.07.31 23:54:18 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2012.07.31 23:51:27 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch [2012.07.31 23:51:05 | 000,000,000 | -HSD | C] -- C:\System Volume Information ========== Files - Modified Within 30 Days ========== [2012.08.30 01:30:19 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.30 01:24:53 | 010,652,120 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\DAVID\Desktop\mbam-setup-1.62.0.1300.exe [2012.08.30 01:23:59 | 000,618,227 | ---- | M] () -- C:\Users\DAVID\Desktop\adwcleaner.exe [2012.08.30 01:23:15 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.08.30 01:23:15 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.08.30 01:22:15 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\DAVID\Desktop\OTL.exe [2012.08.30 01:18:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.08.30 01:18:09 | 2616,745,984 | -HS- | M] () -- C:\hiberfil.sys [2012.08.29 16:57:12 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000UA.job [2012.08.29 16:54:23 | 004,503,728 | ---- | M] () -- C:\ProgramData\nud0repor.pad [2012.08.29 16:54:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.29 00:56:00 | 000,000,928 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000UA.job [2012.08.28 21:57:00 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000Core.job [2012.08.28 17:46:19 | 000,001,887 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.08.28 14:42:34 | 000,265,640 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.08.28 14:17:59 | 000,707,062 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.08.28 14:17:59 | 000,660,658 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.08.28 14:17:59 | 000,411,572 | ---- | M] () -- C:\Windows\System32\perfh011.dat [2012.08.28 14:17:59 | 000,152,548 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.08.28 14:17:59 | 000,124,744 | ---- | M] () -- C:\Windows\System32\perfc011.dat [2012.08.28 14:17:59 | 000,124,744 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.08.28 13:56:46 | 000,007,958 | ---- | M] () -- C:\Windows\unins002.dat [2012.08.28 13:56:37 | 000,709,719 | ---- | M] () -- C:\Windows\unins002.exe [2012.08.28 13:52:49 | 000,011,299 | ---- | M] () -- C:\Windows\unins001.dat [2012.08.28 13:52:26 | 001,199,175 | ---- | M] () -- C:\Windows\unins001.exe [2012.08.28 13:47:37 | 000,010,922 | ---- | M] () -- C:\Windows\unins000.dat [2012.08.28 13:47:28 | 001,187,609 | ---- | M] () -- C:\Windows\unins000.exe [2012.08.28 01:08:58 | 000,011,264 | -H-- | M] () -- C:\Users\DAVID\Desktop\photothumb.db [2012.08.27 17:53:30 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\PC SpeedUp Service Deactivator.job [2012.08.25 23:35:13 | 000,000,764 | ---- | M] () -- C:\user.js [2012.08.22 12:56:01 | 000,000,906 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000Core.job [2012.08.22 12:01:11 | 000,002,453 | ---- | M] () -- C:\Users\DAVID\Desktop\Google Chrome.lnk [2012.08.19 14:07:41 | 000,002,011 | ---- | M] () -- C:\Users\Public\Desktop\Microsoft LifeCam.lnk [2012.08.13 12:21:03 | 000,000,000 | ---- | M] () -- C:\END [2012.08.12 12:52:06 | 000,001,320 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk [2012.08.03 21:35:43 | 000,077,728 | ---- | M] () -- C:\Users\DAVID\Desktop\SharinganPictures.jpg [2012.08.01 22:48:00 | 000,011,189 | -HS- | M] () -- C:\Users\DAVID\Desktop\Folder.jpg [2012.08.01 22:48:00 | 000,002,348 | -HS- | M] () -- C:\Users\DAVID\Desktop\AlbumArtSmall.jpg [2012.08.01 22:42:31 | 000,001,360 | ---- | M] () -- C:\Users\DAVID\Desktop\Free YouTube to MP3 Converter.lnk [2012.08.01 19:59:17 | 000,141,988 | ---- | M] () -- C:\Windows\System32\perfi011.dat [2012.08.01 19:59:17 | 000,031,548 | ---- | M] () -- C:\Windows\System32\perfd011.dat [2012.08.01 17:50:57 | 000,001,288 | ---- | M] () -- C:\Users\Public\Desktop\Paint.NET.lnk [2012.08.01 17:48:30 | 000,000,993 | ---- | M] () -- C:\Users\DAVID\Desktop\PhotoScape.lnk [2012.08.01 16:47:02 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf [2012.08.01 01:51:09 | 000,002,503 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2012.08.01 01:42:30 | 000,000,875 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk [2012.08.01 01:31:08 | 000,278,561 | ---- | M] () -- C:\Users\DAVID\Desktop\Minecraft.exe [2012.08.01 01:25:38 | 000,001,092 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.07.31 23:55:20 | 000,057,050 | ---- | M] () -- C:\Windows\System32\license.rtf [2012.07.31 23:53:46 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin ========== Files Created - No Company Name ========== [2012.08.30 01:30:19 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.30 01:23:52 | 000,618,227 | ---- | C] () -- C:\Users\DAVID\Desktop\adwcleaner.exe [2012.08.28 17:46:19 | 004,503,728 | ---- | C] () -- C:\ProgramData\nud0repor.pad [2012.08.28 17:46:19 | 000,001,887 | ---- | C] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.08.28 13:56:37 | 000,709,719 | ---- | C] () -- C:\Windows\unins002.exe [2012.08.28 13:56:37 | 000,007,958 | ---- | C] () -- C:\Windows\unins002.dat [2012.08.28 13:52:27 | 001,199,175 | ---- | C] () -- C:\Windows\unins001.exe [2012.08.28 13:52:27 | 000,011,299 | ---- | C] () -- C:\Windows\unins001.dat [2012.08.28 13:47:34 | 000,066,560 | ---- | C] () -- C:\Windows\System32\zlib1.dll [2012.08.28 13:47:33 | 000,162,304 | ---- | C] () -- C:\Windows\System32\libpng13.dll [2012.08.28 13:47:33 | 000,138,752 | ---- | C] () -- C:\Windows\System32\libpng15.dll [2012.08.28 13:47:32 | 001,187,609 | ---- | C] () -- C:\Windows\unins000.exe [2012.08.28 13:47:32 | 000,271,264 | ---- | C] () -- C:\Windows\System\vbrun100.dll [2012.08.28 13:47:32 | 000,210,944 | ---- | C] () -- C:\Windows\System\msvcrt10.dll [2012.08.28 13:47:32 | 000,010,922 | ---- | C] () -- C:\Windows\unins000.dat [2012.08.22 20:23:50 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.19 14:07:41 | 000,002,011 | ---- | C] () -- C:\Users\Public\Desktop\Microsoft LifeCam.lnk [2012.08.13 12:21:03 | 000,000,000 | ---- | C] () -- C:\END [2012.08.12 21:48:36 | 000,002,453 | ---- | C] () -- C:\Users\DAVID\Desktop\Google Chrome.lnk [2012.08.12 21:47:42 | 000,001,120 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000UA.job [2012.08.12 21:47:41 | 000,001,068 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000Core.job [2012.08.12 12:52:06 | 000,001,320 | ---- | C] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk [2012.08.05 19:50:36 | 000,000,928 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000UA.job [2012.08.05 19:50:34 | 000,000,906 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000Core.job [2012.08.04 18:20:49 | 000,000,764 | ---- | C] () -- C:\user.js [2012.08.04 00:41:31 | 000,011,264 | -H-- | C] () -- C:\Users\DAVID\Desktop\photothumb.db [2012.08.03 21:35:42 | 000,077,728 | ---- | C] () -- C:\Users\DAVID\Desktop\SharinganPictures.jpg [2012.08.01 22:48:00 | 000,011,189 | -HS- | C] () -- C:\Users\DAVID\Desktop\Folder.jpg [2012.08.01 22:48:00 | 000,002,348 | -HS- | C] () -- C:\Users\DAVID\Desktop\AlbumArtSmall.jpg [2012.08.01 22:44:22 | 000,000,336 | ---- | C] () -- C:\Windows\tasks\PC SpeedUp Service Deactivator.job [2012.08.01 22:42:31 | 000,001,360 | ---- | C] () -- C:\Users\DAVID\Desktop\Free YouTube to MP3 Converter.lnk [2012.08.01 21:27:58 | 000,001,251 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk [2012.08.01 21:27:43 | 000,001,320 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk [2012.08.01 21:27:17 | 000,001,404 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk [2012.08.01 21:26:54 | 000,002,432 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk [2012.08.01 20:02:35 | 000,411,572 | ---- | C] () -- C:\Windows\System32\perfh011.dat [2012.08.01 20:02:35 | 000,141,988 | ---- | C] () -- C:\Windows\System32\perfi011.dat [2012.08.01 20:02:35 | 000,124,744 | ---- | C] () -- C:\Windows\System32\perfc011.dat [2012.08.01 20:02:35 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd011.dat [2012.08.01 17:50:57 | 000,001,300 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paint.NET.lnk [2012.08.01 17:50:57 | 000,001,288 | ---- | C] () -- C:\Users\Public\Desktop\Paint.NET.lnk [2012.08.01 17:48:30 | 000,000,993 | ---- | C] () -- C:\Users\DAVID\Desktop\PhotoScape.lnk [2012.08.01 16:47:02 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf [2012.08.01 16:43:31 | 000,265,640 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2012.08.01 01:51:09 | 000,002,503 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2012.08.01 01:42:30 | 000,000,875 | ---- | C] () -- C:\Users\Public\Desktop\Steam.lnk [2012.08.01 01:31:05 | 000,278,561 | ---- | C] () -- C:\Users\DAVID\Desktop\Minecraft.exe [2012.08.01 01:30:50 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk [2012.08.01 01:25:38 | 000,001,104 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.08.01 01:25:38 | 000,001,092 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.08.01 00:02:32 | 000,001,413 | ---- | C] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2012.07.31 23:55:09 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk [2012.07.31 23:55:01 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk [2012.07.31 23:53:46 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.07.31 23:51:05 | 2616,745,984 | -HS- | C] () -- C:\hiberfil.sys [2012.07.04 07:27:30 | 000,204,952 | ---- | C] () -- C:\Windows\System32\ativvsvl.dat [2012.07.04 07:27:30 | 000,157,144 | ---- | C] () -- C:\Windows\System32\ativvsva.dat [2012.07.04 02:32:18 | 000,159,232 | ---- | C] () -- C:\Windows\System32\clinfo.exe [2012.04.18 19:39:06 | 000,028,672 | ---- | C] () -- C:\Windows\System32\kdbsdk32.dll [2012.03.06 19:59:32 | 000,618,823 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\System32\atipblag.dat [2011.06.10 06:34:52 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll ========== LOP Check ========== [2012.08.05 23:51:04 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\.minecraft [2012.08.04 18:20:36 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Babylon [2012.08.04 18:20:55 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\BabylonToolbar [2012.08.11 01:27:32 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Downloaded Installations [2012.08.01 22:43:16 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoft [2012.08.01 22:42:36 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoftIEHelpers [2012.08.28 14:57:48 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Kaiba Corporation [2012.08.22 19:54:16 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Namco [2012.08.01 22:42:55 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\OpenCandy [2012.08.12 12:49:09 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\PhotoScape [2012.08.04 18:20:33 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\YourFileDownloader [2012.08.22 12:56:01 | 000,000,906 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000Core.job [2012.08.29 00:56:00 | 000,000,928 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000UA.job [2012.08.27 17:53:30 | 000,000,336 | ---- | M] () -- C:\Windows\Tasks\PC SpeedUp Service Deactivator.job [2009.07.14 06:53:46 | 000,011,464 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2012.08.05 23:51:04 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\.minecraft [2012.08.01 01:31:29 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Adobe [2012.08.01 01:15:52 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\ATI [2012.08.04 18:20:36 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Babylon [2012.08.04 18:20:55 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\BabylonToolbar [2012.08.11 01:27:32 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Downloaded Installations [2012.08.01 22:43:16 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoft [2012.08.01 22:42:36 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoftIEHelpers [2012.08.01 00:02:20 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Identities [2012.08.28 14:57:48 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Kaiba Corporation [2012.08.01 01:29:23 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Macromedia [2012.08.30 01:30:29 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Malwarebytes [2009.07.14 10:56:41 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Media Center Programs [2012.08.23 18:33:48 | 000,000,000 | --SD | M] -- C:\Users\DAVID\AppData\Roaming\Microsoft [2012.08.01 01:25:51 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Mozilla [2012.08.22 19:54:16 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Namco [2012.08.01 22:42:55 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\OpenCandy [2012.08.12 12:49:09 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\PhotoScape [2012.08.29 16:55:21 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Skype [2012.08.04 18:20:33 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\YourFileDownloader < %APPDATA%\*.exe /s > [2012.07.18 00:53:12 | 002,682,336 | ---- | M] (Speedchecker Limited ) -- C:\Users\DAVID\AppData\Roaming\OpenCandy\FBDF2727D10F4AF39BF632C179D7C436\PCSU_SL_3.1.2.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys [2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys [2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys [2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys [2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll < MD5 for: IASTORV.SYS > [2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys [2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys [2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys [2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys [2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll < MD5 for: USER32.DLL > [2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll [2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll < MD5 for: USERINIT.EXE > [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe [2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe [2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe [2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys [2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2012.07.04 08:21:46 | 000,442,368 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\Windows\system32\ATIDEMGX.dll < %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.* > [2012.08.28 17:46:19 | 000,001,887 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.08.01 01:12:03 | 000,000,174 | -HS- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini [2012.08.12 12:52:06 | 000,001,320 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk < %APPDATA%\*AcroIEH*.* > < %APPDATA%\*.exe > < %APPDATA%\*.tmp > < End of report > habe bis jetzt mit KIS rescure disk so weit gereinigt das bis jetzt dises GVU nachricht nicht kommt aber möchte da noch sicher gehen das es 100 % weg ist Code:
ATTFilter OTL Extras logfile created on: 30.08.2012 01:38:52 - Run 1
OTL by OldTimer - Version 3.2.59.1 Folder = C:\Users\DAVID\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,25 Gb Total Physical Memory | 2,41 Gb Available Physical Memory | 74,12% Memory free
6,50 Gb Paging File | 5,52 Gb Available in Paging File | 85,03% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 114,40 Gb Total Space | 79,37 Gb Free Space | 69,38% Space Free | Partition Type: NTFS
Drive D: | 37,25 Gb Total Space | 28,81 Gb Free Space | 77,35% Space Free | Partition Type: NTFS
Computer Name: DAVID-PC | User Name: DAVID | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0E71EA2A-8B7F-44D8-8BF6-E786EEFF3CB0}" = rport=139 | protocol=6 | dir=out | app=system |
"{149F047B-0182-4C8A-8AD9-8D53AD19BCA5}" = lport=2869 | protocol=6 | dir=in | app=system |
"{1E4A8126-21E7-4A66-844B-CE091F092A9C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{20BB8D70-1BA9-4493-9AE4-394DEEA109C0}" = lport=137 | protocol=17 | dir=in | app=system |
"{23CBCA6E-FFA4-4542-A31A-E7DA8A0B5E57}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3EB90466-94D7-4C84-9E67-E2B543FC1746}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4CC42362-AEF2-48ED-96EA-AED493B2A646}" = lport=139 | protocol=6 | dir=in | app=system |
"{5C2EE4E7-237B-442C-B98B-5B350589E4A4}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{5C910D09-A4CD-4035-9970-F50D1A2DB00E}" = rport=10243 | protocol=6 | dir=out | app=system |
"{5CE22336-A521-4DF3-91C8-A818F791129E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5F284DA7-2A5F-4E39-9A91-BF95C2BF2C1F}" = lport=445 | protocol=6 | dir=in | app=system |
"{66F5CA14-2F22-4B1D-8672-0D42F7C2631D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{708934F4-548F-4E86-81A8-0C073AFE2CF5}" = lport=138 | protocol=17 | dir=in | app=system |
"{8AE8E505-853A-4082-AE47-C4C9ABDC1C59}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8C856EDD-D0D7-4D5E-98E8-D8ABBAB31B92}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{965A7ECA-0D43-4506-8A81-82D99525FB2F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9F83B979-5581-49DB-9DAD-03D943C2FC1A}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{9FBE7D16-EC83-4288-82BA-60C4C3835CD2}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AA09E96F-766D-406B-B1B7-F39C328043B8}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AAD03F40-4B74-43C0-BE08-6B8DDD4216B2}" = lport=10243 | protocol=6 | dir=in | app=system |
"{BB3B8D84-E8EA-4E89-B688-E45737E7443D}" = rport=138 | protocol=17 | dir=out | app=system |
"{BC8DCB34-5D31-4E42-B404-D0AB2ADE3754}" = rport=137 | protocol=17 | dir=out | app=system |
"{E8DF50FD-C309-4330-9145-54B5146CCF17}" = rport=445 | protocol=6 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{083C5FAC-DAD1-4283-BEE4-01B85546D629}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{09334953-6130-4C33-BEF4-37522D5EC0AA}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{0D0C353A-9B05-430F-9839-68B61A895E73}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{140DB08D-7B93-4B98-8588-C4A330D7FAAB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{16E1E30C-F47B-46F4-A8C2-2FF7EABDCD8E}" = protocol=17 | dir=in | app=c:\program files\yourfiledownloader\downloader.exe |
"{19CBCAF1-1303-4DA5-A7C5-4A2015FC722A}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{23FDA6C0-70F4-4D3B-B740-9AC834057F68}" = dir=in | app=c:\users\david\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{31815D79-6899-428A-A694-DC9B66FEDC93}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{31A28E47-7B53-4FCB-8B58-033642C70CAF}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe |
"{33FE17F3-B1C8-4E55-BFC8-406300D27146}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{35A514BB-8BCA-4306-8D37-EC1DFBDCF23E}" = protocol=17 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe |
"{40EC194A-03CC-4688-889A-A1D6E452C5D6}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{4E8C3A26-EB18-447F-8E75-D167E70695A7}" = protocol=17 | dir=in | app=c:\program files\yourfiledownloader\yourfile.exe |
"{50DA0AAD-A5B6-48A0-B21C-9F29D42D965B}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{6327EC05-F6A5-4025-89D6-34297766AE9E}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{67D6085B-CFF6-4313-B33F-8B650203E900}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{69056FC6-1269-4418-8261-F2C8E8408145}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{70E63EE3-766E-49CE-B22A-8D6923621658}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{873194FD-056E-4D04-90E6-3526CA2825EC}" = protocol=6 | dir=in | app=c:\program files\yourfiledownloader\yourfile.exe |
"{8E048679-6F15-4AF9-A88B-06CE7ED86931}" = protocol=17 | dir=in | app=c:\windows\system32\msiexec.exe |
"{91F9AFE5-D8C4-473F-912A-21010047A646}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{9522901E-051E-4E00-BFB7-39CE84A7B37D}" = protocol=6 | dir=in | app=c:\windows\system32\msiexec.exe |
"{96005A78-1D72-4607-8466-FCA88320F194}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{AD9A553A-12A4-48B1-B56D-098970CA379C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AF3D6BFD-86FF-4C93-8236-8D6AE06D789A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C2EEB483-43E2-47A9-B084-A534E041A589}" = protocol=6 | dir=out | app=system |
"{CC3E5C06-8655-4886-8466-3612A3A220FC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CC601D8A-1A0C-4883-9823-A690D441A357}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{D98AEB9C-BF75-4BA7-ADAF-2588CD60B15F}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{DE746130-D62E-4762-A012-49ED6CA3A2BA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E456DD15-2764-4CFB-877B-4AEF6B91F53A}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{E48F1566-C455-46C0-B827-E992826E9B30}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{E57D9A92-18EC-41A7-9D08-5DE119F0F85D}" = protocol=6 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe |
"{E6DFA811-810B-45D8-AFE4-971AE03D699D}" = protocol=6 | dir=in | app=c:\program files\yourfiledownloader\downloader.exe |
"{E6FAD79D-C4E2-44E6-8874-7913F9D1847B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{E7F5E5F2-9055-4284-AB73-992AA1797264}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{ECB4EFF2-712D-498D-AFE9-7B4E1FFE1030}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe |
"{EE3B9250-94C2-43F7-B239-08C5F41BB1C4}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{F7430B27-4364-4527-B1A5-F31948E277B9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{6CF77EF7-EE43-4464-B337-86A4B54A8AE2}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{CAF25443-1149-46B9-A884-33C56C953AEB}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02602409-9189-4567-BC07-562605243B69}" = Windows Live Remote Client Resources
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{054C5EBD-1803-9B06-A201-63A1A8A5C365}" = CCC Help Danish
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0FB8CBBF-CFBA-B7C5-6433-4F5132783C31}" = CCC Help Portuguese
"{143412FA-840C-6158-599F-2B32D0861F80}" = Catalyst Control Center Graphics Previews Common
"{16FED766-CFB4-87B1-9591-4A394E4AE673}" = ccc-utility
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1D33871D-8470-7658-9AC6-27F8C77AA3AB}" = AMD Accelerated Video Transcoding
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1F6D1DB5-82B5-41A4-85A2-0A382C142A35}_is1" = Allgemeine Runtime Files (x86)
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20EA5B84-7055-65D9-7378-59750A15C6B5}" = CCC Help Russian
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{2680C5AE-EDC8-7A73-3D41-FCE9A2F22390}" = CCC Help German
"{26A24AE4-039D-4CA4-87B4-2F83217006FF}" = Java 7 Update 6
"{2D6E3D97-1FDF-4993-AC75-72F59EC445C5}" = Windows Live Family Safety
"{2D7F5276-5B18-A31A-3C39-3F537C12D310}" = AMD Drag and Drop Transcoding
"{32E879B3-F89C-5385-78C8-4DE7730C5FA0}" = AMD VISION Engine Control Center
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{336D0C35-8A85-403a-B9D2-65C292C39087}_is1" = Web Assistant 2.0.0.474
"{33D64034-5BC0-FF4F-6176-62ED61555CA8}" = CCC Help Thai
"{3406AF2D-25A4-F348-76C1-F2164AF6131F}" = AMD Fuel
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3A65A74A-5B6E-451A-92D8-50F1182BBE9A}" = Windows Live Remote Service Resources
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3CFAAB58-35C8-84C9-1391-8D4373714AFE}" = CCC Help Spanish
"{449CE12D-E2C7-4B97-B19E-55D163EA9435}" = Bing Bar
"{453FDDF1-BA65-8D13-2E6F-1740190BB5C4}" = CCC Help Greek
"{4728A95D-FD9B-CEE9-9609-BB01B5F82A0B}" = CCC Help Turkish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AFC194C-FEAD-B844-92C2-D0273872ECCF}" = CCC Help Dutch
"{529125EF-E3AC-4B74-97E6-F688A7C0F1BF}" = Paint.NET v3.5.10
"{5308F6BF-4660-926A-B611-0CBB32F44DD0}" = CCC Help Swedish
"{56E56B8C-6B2E-F4FD-2C82-BDC128BDC894}" = AMD Catalyst Install Manager
"{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}" = Microsoft LifeCam
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{69425AB7-75BF-25FC-EB4F-D2EAE9D82AA5}" = CCC Help Hungarian
"{6B00CD97-EADD-3AFC-A844-89EB4DA73461}" = Catalyst Control Center InstallProxy
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7683B745-6060-41FD-AA75-0BBB383FEAD4}" = SweetIM for Messenger 3.7
"{774C0434-9948-4DEE-A14E-69CDD316E36C}" = Internet Explorer Toolbar 4.6 by SweetPacks
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{79839E2D-82B1-6DF1-97A6-6737E4404407}" = CCC Help Japanese
"{7BB5E925-A3DD-48C2-9A82-017AF5982FFE}" = Facebook Messenger 2.1.4590.0
"{7C2D9B2C-D78C-EC0A-2337-612FD4799750}" = CCC Help Czech
"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159
"{7D9C2CBE-5941-0250-2922-804D0A506ED0}" = CCC Help Polish
"{83AA2913-C123-4146-85BD-AD8F93971D39}" = BabylonObjectInstaller
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{8729E65B-8C12-4A42-B1FE-E4DA7ED52855}_is1" = DirectX 9.0c Extra Files (x86)
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B57458E-1BB4-F08F-C534-8B3E3D541229}" = AMD Media Foundation Decoders
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{9057D097-0563-6FFB-CDC6-DB2B2C5D1014}" = CCC Help Italian
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{941A1864-A0D5-4EC0-933C-968F83A7D9E5}" = Dawn Of A New Era
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1.7
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA387C7F-7413-9C5A-DB71-70E406A8A92E}" = CCC Help French
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B00F5097-1F34-D3EA-4FB9-8DD2FAFF66F4}" = CCC Help Finnish
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B42129AB-E528-9CB4-7C8B-3BFE648F5CD8}" = CCC Help Norwegian
"{C1A27149-1897-8509-CBFC-2C96866C8AD6}" = CCC Help Korean
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DE54DD68-6E24-9B72-467A-DFEE00E6E9A8}" = CCC Help Chinese Traditional
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E9FDD18A-206A-9A43-AAE3-AB72EFFCD333}" = CCC Help Chinese Standard
"{ED524538-828E-1AD8-D0E1-E2E72C926EE0}" = CCC Help English
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F5A4F780-DF0C-444F-BA82-637CCF5C8052}" = Windows Live Family Safety
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FB697452-8CA4-46B4-98B1-165C922A2EF3}" = Update Manager for SweetPacks 1.0
"{FCFE800F-8F42-1AC9-895C-10389CB90D86}" = Catalyst Control Center Localization All
"{FDF7187F-3960-4BEC-916D-98C9A83E3A68}_is1" = DirectX for Managed Code
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"BabylonToolbar" = Babylon toolbar on IE
"CCleaner" = CCleaner
"Defraggler" = Defraggler
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.26.706
"incredibar" = Incredibar Toolbar on IE
"M928366" =
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"PCSU-SL_is1" = PC Beschleunigen - Vollständige Deinstallation
"PhotoScape" = PhotoScape
"WinLiveSuite" = Windows Live Essentials
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"YourFileDownloader" = YourFileDownloader
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 24.08.2012 16:50:49 | Computer Name = DAVID-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_4_402_265.exe,
Version: 11.4.402.265, Zeitstempel: 0x502bf384 Name des fehlerhaften Moduls: NPSWF32_11_4_402_265.dll,
Version: 11.4.402.265, Zeitstempel: 0x502bf58e Ausnahmecode: 0xc0000005 Fehleroffset:
0x004caf42 ID des fehlerhaften Prozesses: 0x303c Startzeit der fehlerhaften Anwendung:
0x01cd823a230d3c84 Pfad der fehlerhaften Anwendung: C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
Pfad
des fehlerhaften Moduls: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll
Berichtskennung:
628f035a-ee2d-11e1-93ee-001d9284e761
Error - 24.08.2012 16:51:39 | Computer Name = DAVID-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_4_402_265.exe,
Version: 11.4.402.265, Zeitstempel: 0x502bf384 Name des fehlerhaften Moduls: NPSWF32_11_4_402_265.dll,
Version: 11.4.402.265, Zeitstempel: 0x502bf58e Ausnahmecode: 0xc0000005 Fehleroffset:
0x001107f3 ID des fehlerhaften Prozesses: 0x2ac4 Startzeit der fehlerhaften Anwendung:
0x01cd823a34dcfde1 Pfad der fehlerhaften Anwendung: C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
Pfad
des fehlerhaften Moduls: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll
Berichtskennung:
7fe6d839-ee2d-11e1-93ee-001d9284e761
Error - 24.08.2012 16:51:53 | Computer Name = DAVID-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_4_402_265.exe,
Version: 11.4.402.265, Zeitstempel: 0x502bf384 Name des fehlerhaften Moduls: NPSWF32_11_4_402_265.dll,
Version: 11.4.402.265, Zeitstempel: 0x502bf58e Ausnahmecode: 0xc0000005 Fehleroffset:
0x0005d8eb ID des fehlerhaften Prozesses: 0x2e04 Startzeit der fehlerhaften Anwendung:
0x01cd823a49b708e1 Pfad der fehlerhaften Anwendung: C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
Pfad
des fehlerhaften Moduls: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll
Berichtskennung:
8882e018-ee2d-11e1-93ee-001d9284e761
Error - 28.08.2012 07:45:22 | Computer Name = DAVID-PC | Source = MsiInstaller | ID = 1013
Description =
Error - 28.08.2012 07:49:33 | Computer Name = DAVID-PC | Source = MsiInstaller | ID = 1013
Description =
Error - 28.08.2012 07:52:24 | Computer Name = DAVID-PC | Source = MsiInstaller | ID = 1013
Description =
Error - 28.08.2012 07:56:30 | Computer Name = DAVID-PC | Source = MsiInstaller | ID = 1013
Description =
Error - 29.08.2012 10:51:06 | Computer Name = DAVID-PC | Source = Windows Search Service | ID = 7040
Description =
Error - 29.08.2012 10:51:06 | Computer Name = DAVID-PC | Source = Windows Search Service | ID = 7042
Description =
Error - 29.08.2012 19:28:35 | Computer Name = DAVID-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.59.1 kann nicht mehr unter Windows ausgeführt
werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 2c4 Startzeit:
01cd863d2dffbe71 Endzeit: 16 Anwendungspfad: C:\Users\DAVID\Desktop\OTL.exe Berichts-ID:
32a28b9c-f231-11e1-b658-001d9284e761
[ System Events ]
Error - 29.08.2012 19:38:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "\Device\HarddiskVolume3" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:38:42 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "\Device\HarddiskVolume3" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:39:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "\Device\HarddiskVolume3" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:40:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "D:" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:41:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "\Device\HarddiskVolume3" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:42:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "\Device\HarddiskVolume3" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:43:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "D:" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:44:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "D:" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:45:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "D:" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:46:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "D:" den Befehl "chkdsk" aus.
< End of report >
malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.08.29.10 Windows 7 x86 NTFS Internet Explorer 8.0.7600.16385 DAVID :: DAVID-PC [Administrator] Schutz: Aktiviert 30.08.2012 02:15:32 mbam-log-2012-08-30 (02-15-32).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 182237 Laufzeit: 3 Minute(n), 13 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) |
|
30.08.2012, 10:44
| #2 |
| | GVU Trojaner könnt ihr da weiter helfen (ich hoffe ich habe das so gut geschiltert mein problem mit den gvu trojaner ansondsten sry bin keiner dern jeden tag in chat oder in forum sind )
__________________habe ich bis jetzt alles gepostet was man braucht oder fehlt da noch was ? |
|
31.08.2012, 19:59
| #3 |
| /// Helfer-Team  | GVU Trojaner Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL
SRV - [2012.07.29 11:23:14 | 000,188,760 | ---- | M] () [Auto | Running] -- C:\Programme\Web Assistant\ExtensionUpdaterService.exe -- (Web Assistant Updater)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6}
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&crg=3.16010003&st=12&q={searchTerms}&barid={02010704-9E70-4432-A75F-0CAEB55238B6}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredibar.com/mb178?a=6OyM8En1pg&i=26
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A}
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=112555&tt=010812_nich_3112_7&babsrc=SP_ss&mntrId=60755749000000000000001d9284e761
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredibar.com/mb178/?search={searchTerms}&loc=IB_DS&a=6OyM8En1pg&i=26
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&crg=3.16010003&st=12&q={searchTerms}&barid={02010704-9E70-4432-A75F-0CAEB55238B6}
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.hlportal.de/"
FF - prefs.js..keyword.URL: "http://mystart.incredibar.com/mb178/?loc=IB_DS&a=6OyM8En1pg&&i=26&search="
FF - prefs.js..network.proxy.type: 0
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Google"
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012.08.25 23:35:09 | 000,000,000 | ---D | M]
CHR - homepage: http://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6}
CHR - default_search_provider: MyStart Search (Enabled)
CHR - default_search_provider: search_url = http://mystart.incredibar.com/mb178/?loc=IB_DS&search={searchTerms}&a=6OyM8En1pg&i=26
CHR - Extension: Web Assistant = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.474_0\
CHR - Extension: SweetIM for Facebook = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\Copy of
CHR - Extension: SweetIM for Facebook = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\
CHR - Extension: New tab for Chrome\u2122 = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg\1.0.0_0\
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Programme\Web Assistant\Extension32.dll ()
O2 - BHO: (incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Programme\incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (Montera Technologeis LTD)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Programme\incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD)
O3 - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [Sweetpacks Communicator] C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.)
O4 - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000..\Run: [PCSpeedUp] C:\Programme\PC Beschleunigen\PCSUNotifier.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\DAVID\AppData\Local\Facebook\Messenger\2.1.4590.0\FacebookMessenger.exe (Facebook)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
[2012.08.13 12:21:07 | 000,000,000 | ---D | C] -- C:\ProgramData\SweetIM
[2012.08.04 18:20:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012.08.01 22:44:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Beschleunigen
[2012.08.01 22:42:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2012.08.29 16:54:23 | 004,503,728 | ---- | M] () -- C:\ProgramData\nud0repor.pad
[2012.08.28 17:46:19 | 000,001,887 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.07.18 00:53:12 | 002,682,336 | ---- | M] (Speedchecker Limited ) -- C:\Users\DAVID\AppData\Roaming\OpenCandy\FBDF2727D10F4AF39BF632C179D7C436\PCSU_SL_3.1.2.exe
[2012.08.05 14:07:33 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com
[2012.08.25 23:35:07 | 000,002,203 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\searchplugins\MyStart Search.xml
[2012.08.25 23:35:09 | 000,000,000 | ---D | M] (Web Assistant) -- C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX
[2012.08.25 23:35:17 | 000,000,000 | ---D | C] -- C:\Program Files\Perion
[2012.08.25 23:35:12 | 000,000,000 | ---D | C] -- C:\Program Files\incredibar.com
[2012.08.25 23:35:09 | 000,000,000 | ---D | C] -- C:\Program Files\Web Assistant
[2012.08.25 23:35:13 | 000,000,764 | ---- | M] () -- C:\user.js
[2012.08.13 12:21:03 | 000,000,000 | ---- | M] () -- C:\END
[2012.08.04 18:20:54 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\BabylonToolbar
[2012.08.04 18:20:49 | 000,000,000 | ---D | C] -- C:\Program Files\BabylonToolbar
[2012.08.04 18:20:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Babylon
[2012.08.04 18:20:33 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\YourFileDownloader
[2012.08.04 18:20:33 | 000,000,000 | ---D | C] -- C:\Program Files\YourFileDownloader
[2012.08.28 13:45:52 | 000,000,000 | ---D | C] -- C:\Windows\System32\URTTEMP
:Files
C:\Users\DAVID\AppData\Local\{*}
C:\ProgramData\*.exe
C:\ProgramData\TEMP
C:\Users\DAVID\AppData\Local\Temp\*.exe
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
%SystemRoot%\System32\*.tmp
%SystemRoot%\SysWOW64\*.tmp
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________ |
|
02.09.2012, 12:22
| #4 |
| | GVU Trojaner so sry aber wahr gestern total müde das ich jetzt erst das gemacht habe hier den text datei von OTL Code:
ATTFilter All processes killed
========== OTL ==========
Service Web Assistant Updater stopped successfully!
Service Web Assistant Updater deleted successfully!
C:\Programme\Web Assistant\ExtensionUpdaterService.exe moved successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C360-6118-11DC-9C72-001320C79847}\ not found.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}\ deleted successfully.
C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll moved successfully.
HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}\ not found.
Registry key HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C360-6118-11DC-9C72-001320C79847}\ not found.
HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: "MyStart Search" removed from browser.search.defaultenginename
Prefs.js: "" removed from browser.search.defaulturl
Prefs.js: "Search the web (Babylon)" removed from browser.search.order.1
Prefs.js: "Google" removed from browser.search.selectedEngine
Prefs.js: "hxxp://www.hlportal.de/" removed from browser.startup.homepage
Prefs.js: "hxxp://mystart.incredibar.com/mb178/?loc=IB_DS&a=6OyM8En1pg&&i=26&search=" removed from keyword.URL
Prefs.js: 0 removed from network.proxy.type
Prefs.js: "Search the web (Babylon)" removed from sweetim.toolbar.previous.browser.search.defaultenginename
Prefs.js: "Google" removed from sweetim.toolbar.previous.browser.search.selectedEngine
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}\ deleted successfully.
C:\Program Files\Web Assistant\Firefox\defaults\preferences folder moved successfully.
C:\Program Files\Web Assistant\Firefox\defaults folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\skin folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\locale\en-US folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\locale folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\content\resources folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\content\libraries folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\content folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome folder moved successfully.
C:\Program Files\Web Assistant\Firefox folder moved successfully.
Use Chrome's Settings page to change the HomePage.
Use Chrome's Settings page to remove the default_search_provider items.
Use Chrome's Settings page to remove the default_search_provider items.
C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.474_0\resources folder moved successfully.
C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.474_0\libraries folder moved successfully.
C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.474_0 folder moved successfully.
File C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\Copy of not found.
C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0 folder moved successfully.
C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg\1.0.0_0\Plugins folder moved successfully.
C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg\1.0.0_0 folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\bh\BabylonToolbar.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}\ not found.
C:\Programme\Web Assistant\Extension32.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}\ deleted successfully.
C:\Programme\incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}\ deleted successfully.
C:\Programme\Windows Live\Companion\companioncore.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}\ deleted successfully.
C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ deleted successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarTlbr.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ deleted successfully.
File C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{F9639E4A-801B-4843-AEE3-03D9DA199E77} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F9639E4A-801B-4843-AEE3-03D9DA199E77}\ deleted successfully.
C:\Programme\incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll moved successfully.
Registry value HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
File C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SweetIM deleted successfully.
C:\Programme\SweetIM\Messenger\SweetIM.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Sweetpacks Communicator deleted successfully.
C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Windows\CurrentVersion\Run\\PCSpeedUp deleted successfully.
C:\Programme\PC Beschleunigen\PCSUNotifier.exe moved successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
File move failed. C:\Windows\System32\mctadmin.exe scheduled to be moved on reboot.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
File move failed. C:\Windows\System32\mctadmin.exe scheduled to be moved on reboot.
C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk moved successfully.
C:\Users\DAVID\AppData\Local\Facebook\Messenger\2.1.4590.0\FacebookMessenger.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{0000036B-C524-4050-81A0-243669A86B9F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0000036B-C524-4050-81A0-243669A86B9F}\ not found.
File C:\Programme\Windows Live\Companion\companioncore.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
C:\ProgramData\SweetIM\Messenger\update folder moved successfully.
C:\ProgramData\SweetIM\Messenger\logs folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\packages\FailDialog folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\packages folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\contentdb folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\Default\400 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\Default\200 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\Default\100 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\Default folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\100\default folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\100\bar0168 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\100\bar0104 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\100 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data folder moved successfully.
C:\ProgramData\SweetIM\Messenger\conf\users\wandererdavidssj8_90@live.de folder moved successfully.
C:\ProgramData\SweetIM\Messenger\conf\users folder moved successfully.
C:\ProgramData\SweetIM\Messenger\conf folder moved successfully.
C:\ProgramData\SweetIM\Messenger folder moved successfully.
C:\ProgramData\SweetIM\Communicator\Logs folder moved successfully.
C:\ProgramData\SweetIM\Communicator\conf folder moved successfully.
C:\ProgramData\SweetIM\Communicator folder moved successfully.
C:\ProgramData\SweetIM folder moved successfully.
C:\ProgramData\Babylon folder moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Beschleunigen folder moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft\Tools folder moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft\Programs folder moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft folder moved successfully.
C:\ProgramData\nud0repor.pad moved successfully.
C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk moved successfully.
C:\Users\DAVID\AppData\Roaming\OpenCandy\FBDF2727D10F4AF39BF632C179D7C436\PCSU_SL_3.1.2.exe moved successfully.
C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio folder moved successfully.
C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs folder moved successfully.
C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com\content\imgs folder moved successfully.
C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com\content folder moved successfully.
C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com\components folder moved successfully.
C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com folder moved successfully.
C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\searchplugins\MyStart Search.xml moved successfully.
Folder C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX\ not found.
C:\Program Files\Perion\NewTab folder moved successfully.
C:\Program Files\Perion folder moved successfully.
C:\Program Files\incredibar.com\incredibar\1.5.11.14\bh folder moved successfully.
C:\Program Files\incredibar.com\incredibar\1.5.11.14 folder moved successfully.
C:\Program Files\incredibar.com\incredibar folder moved successfully.
C:\Program Files\incredibar.com folder moved successfully.
C:\Program Files\Web Assistant\resources folder moved successfully.
C:\Program Files\Web Assistant\libraries folder moved successfully.
C:\Program Files\Web Assistant folder moved successfully.
C:\user.js moved successfully.
C:\END moved successfully.
C:\Users\DAVID\AppData\Roaming\BabylonToolbar\Shared folder moved successfully.
C:\Users\DAVID\AppData\Roaming\BabylonToolbar\IE folder moved successfully.
C:\Users\DAVID\AppData\Roaming\BabylonToolbar\FF folder moved successfully.
C:\Users\DAVID\AppData\Roaming\BabylonToolbar\CR folder moved successfully.
C:\Users\DAVID\AppData\Roaming\BabylonToolbar folder moved successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\bh folder moved successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1 folder moved successfully.
C:\Programme\BabylonToolbar\BabylonToolbar folder moved successfully.
C:\Users\DAVID\AppData\Roaming\Babylon folder moved successfully.
C:\Users\DAVID\AppData\Roaming\YourFileDownloader folder moved successfully.
C:\Program Files\YourFileDownloader folder moved successfully.
C:\Windows\System32\URTTEMP folder moved successfully.
========== FILES ==========
C:\Users\DAVID\AppData\Local\{02139779-AC82-4FD4-BEC4-1E7CE7D291F8} folder moved successfully.
C:\Users\DAVID\AppData\Local\{05D54603-FF7E-4972-A537-E4E99B176E79} folder moved successfully.
C:\Users\DAVID\AppData\Local\{0AC293C2-380F-4FC8-973B-D1DA57F894E3} folder moved successfully.
C:\Users\DAVID\AppData\Local\{0C079B8E-8EC4-414A-8962-97BE5F46FC49} folder moved successfully.
C:\Users\DAVID\AppData\Local\{1422C04D-9D74-4483-865B-52C45E21E570} folder moved successfully.
C:\Users\DAVID\AppData\Local\{14ED5BCA-91C1-465B-B5A0-C136A6C95416} folder moved successfully.
C:\Users\DAVID\AppData\Local\{17BFBFA2-3B8A-4DCD-990B-5E34AB8589D3} folder moved successfully.
C:\Users\DAVID\AppData\Local\{1863F3F9-C4EE-4E4E-BE72-6B42E973A38A} folder moved successfully.
C:\Users\DAVID\AppData\Local\{1912FD8E-4F8C-4DD2-9ABE-B6337B08A99F} folder moved successfully.
C:\Users\DAVID\AppData\Local\{199BBFA7-03AB-4B30-B7B2-0F36BB5F406E} folder moved successfully.
C:\Users\DAVID\AppData\Local\{1BCE4FB6-C611-48A9-ADB4-A4BE3F99FFB9} folder moved successfully.
C:\Users\DAVID\AppData\Local\{1C986E0F-39FE-404D-9C06-AFFF63788D27} folder moved successfully.
C:\Users\DAVID\AppData\Local\{1ED976BA-9880-4615-8287-38FE7E3D7F83} folder moved successfully.
C:\Users\DAVID\AppData\Local\{1F2267B3-DCE0-4DC8-B3A4-E0D9A0B5E061} folder moved successfully.
C:\Users\DAVID\AppData\Local\{235318B8-F279-4CA9-A52E-A5CC759CE37E} folder moved successfully.
C:\Users\DAVID\AppData\Local\{2666C542-9294-44C6-989C-A3AA218411CB} folder moved successfully.
C:\Users\DAVID\AppData\Local\{269AA1F6-34B6-4809-BE3C-DC44F4FA75D4} folder moved successfully.
C:\Users\DAVID\AppData\Local\{297A7543-3CE9-4971-9F13-1548882E53F0} folder moved successfully.
C:\Users\DAVID\AppData\Local\{2AC7E57D-A98C-41F3-BFB1-4D4DB3863B53} folder moved successfully.
C:\Users\DAVID\AppData\Local\{2B2E21DA-51F9-4B37-9117-063A6EF4E3CE} folder moved successfully.
C:\Users\DAVID\AppData\Local\{310F73D9-E60F-483F-9B61-8BC8AF9494B2} folder moved successfully.
C:\Users\DAVID\AppData\Local\{3B1172AC-8B45-4ED4-9572-266D3B87A182} folder moved successfully.
C:\Users\DAVID\AppData\Local\{3DE389B4-21C6-4EF5-8BF2-2125B738FB7E} folder moved successfully.
C:\Users\DAVID\AppData\Local\{3EA14EC2-49DA-4ABF-9973-41A45A6A36E4} folder moved successfully.
C:\Users\DAVID\AppData\Local\{408FFAD5-F2FA-4003-87C0-B5BE3EE339A7} folder moved successfully.
C:\Users\DAVID\AppData\Local\{44362EDA-AF1C-463A-803F-03AB0D7903B8} folder moved successfully.
C:\Users\DAVID\AppData\Local\{456EA81D-AF2B-416A-B8E4-331D321D94CD} folder moved successfully.
C:\Users\DAVID\AppData\Local\{4838BC28-92D9-4830-8577-0213983EC707} folder moved successfully.
C:\Users\DAVID\AppData\Local\{49BB09EF-F59F-48F5-9CF2-C1A95C8E6203} folder moved successfully.
C:\Users\DAVID\AppData\Local\{52C7D846-D01A-4CAB-804B-471650C994F3} folder moved successfully.
C:\Users\DAVID\AppData\Local\{5429EB52-19E3-43D6-BCC3-B199799BB7AD} folder moved successfully.
C:\Users\DAVID\AppData\Local\{5647895B-9C4B-409E-A38C-2772D698418F} folder moved successfully.
C:\Users\DAVID\AppData\Local\{5A3141BA-7C90-404A-BDCD-C519CC469776} folder moved successfully.
C:\Users\DAVID\AppData\Local\{660D6C36-EB57-4749-99B8-EC6A1731ECF9} folder moved successfully.
C:\Users\DAVID\AppData\Local\{69187003-FC8F-4047-A90E-97A4608E6069} folder moved successfully.
C:\Users\DAVID\AppData\Local\{74C5C7E0-7B28-40F1-B457-603587B130DD} folder moved successfully.
C:\Users\DAVID\AppData\Local\{7A4C2557-182F-48B5-9824-24BC1977C34B} folder moved successfully.
C:\Users\DAVID\AppData\Local\{81CC2B07-26AC-448A-936F-B214C29D51AB} folder moved successfully.
C:\Users\DAVID\AppData\Local\{840B3278-5D66-4516-ADD9-0AC97A23CB30} folder moved successfully.
C:\Users\DAVID\AppData\Local\{8C8178A6-3AF8-4CC6-BCE1-F66F1883CE6C} folder moved successfully.
C:\Users\DAVID\AppData\Local\{8D27366A-EF92-4DEA-A76E-40514405ADBE} folder moved successfully.
C:\Users\DAVID\AppData\Local\{8E243A93-5D51-411F-A2A3-5B43441F3E19} folder moved successfully.
C:\Users\DAVID\AppData\Local\{8FB349F9-71F5-4C01-8982-5A562376DAAF} folder moved successfully.
C:\Users\DAVID\AppData\Local\{90C325E5-C120-49B6-B17F-51BC89180147} folder moved successfully.
C:\Users\DAVID\AppData\Local\{9CD59B95-DBD1-4F4B-821E-1643F6892142} folder moved successfully.
C:\Users\DAVID\AppData\Local\{9F2A31F6-DBF8-45BA-AE38-8DC41891BECB} folder moved successfully.
C:\Users\DAVID\AppData\Local\{A3BDA7CD-7DC8-4F42-B547-D0FE664CC038} folder moved successfully.
C:\Users\DAVID\AppData\Local\{A5C05416-0D11-4151-97E2-EC046BE23852} folder moved successfully.
C:\Users\DAVID\AppData\Local\{A6B5B453-2E78-4CDB-8B52-B99E543F0188} folder moved successfully.
C:\Users\DAVID\AppData\Local\{A8A3BA5A-B6F5-47A7-A155-714F8EA8AC8D} folder moved successfully.
C:\Users\DAVID\AppData\Local\{AA70E4C7-3EA6-4479-AAFD-4B32DC075A42} folder moved successfully.
C:\Users\DAVID\AppData\Local\{B0C8A4DA-2EAB-4BB2-9709-E04AFFC4CE21} folder moved successfully.
C:\Users\DAVID\AppData\Local\{B4EF47E7-3879-4F1C-91B6-F28AEAF05972} folder moved successfully.
C:\Users\DAVID\AppData\Local\{B7698B4A-3A96-4D69-BBCE-612004A05FD7} folder moved successfully.
C:\Users\DAVID\AppData\Local\{B7EF1C98-97A8-4FAF-83EC-E773C8EB479C} folder moved successfully.
C:\Users\DAVID\AppData\Local\{BD0C36FC-4345-475D-8E00-7B2CB1546E34} folder moved successfully.
C:\Users\DAVID\AppData\Local\{C1E37549-7EB1-4C8E-93A5-8FE0C663A06C} folder moved successfully.
C:\Users\DAVID\AppData\Local\{C59EEA8A-D61E-4067-B523-B362207F253B} folder moved successfully.
C:\Users\DAVID\AppData\Local\{C6697D36-273A-4462-A68B-BC4711B63CA9} folder moved successfully.
C:\Users\DAVID\AppData\Local\{C7B2F9FE-30DF-4F25-8D34-DF7D1876D825} folder moved successfully.
C:\Users\DAVID\AppData\Local\{CBDA15B1-0953-4E03-9631-24B4ECF4DC67} folder moved successfully.
C:\Users\DAVID\AppData\Local\{D5D78E76-B6C4-43ED-A7E9-4E0226747904} folder moved successfully.
C:\Users\DAVID\AppData\Local\{DDDEBA05-4446-4E17-9086-4A17F993C423} folder moved successfully.
C:\Users\DAVID\AppData\Local\{E02D56C4-A005-431F-9758-88F30D4BFD59} folder moved successfully.
C:\Users\DAVID\AppData\Local\{F5F71426-9B07-440E-8A74-893D43DB5AC5} folder moved successfully.
C:\Users\DAVID\AppData\Local\{F5FF8639-8AAA-4099-B3B3-3AE8D854DB48} folder moved successfully.
C:\Users\DAVID\AppData\Local\{FAD0800A-D4C8-472E-BCBE-AD056320F233} folder moved successfully.
C:\Users\DAVID\AppData\Local\{FDEFC916-94F8-402F-BF07-85166C54D94D} folder moved successfully.
C:\Users\DAVID\AppData\Local\{FF041113-94D8-4843-B1B9-CD21598ADF43} folder moved successfully.
File\Folder C:\ProgramData\*.exe not found.
File\Folder C:\ProgramData\TEMP not found.
C:\Users\DAVID\AppData\Local\Temp\GoogleUpdateSetup.exe2282d5c moved successfully.
C:\Users\DAVID\AppData\Local\Temp\ICReinstall_Pokemon_Chaos_Black_downloader.exe moved successfully.
C:\Users\DAVID\AppData\Local\Temp\IminentSetup.exe moved successfully.
C:\Users\DAVID\AppData\Local\Temp\incredibar_installer.exe moved successfully.
C:\Users\DAVID\AppData\Local\Temp\install_flashplayer11x32_mssd_aih.exe moved successfully.
C:\Users\DAVID\AppData\Local\Temp\IZArcSetup.exe moved successfully.
C:\Users\DAVID\AppData\Local\Temp\PacmanSDM.exe moved successfully.
C:\Users\DAVID\AppData\Local\Temp\SIMEEIInstaller.exe moved successfully.
C:\Users\DAVID\AppData\Local\Temp\toolbar9954531.exe moved successfully.
C:\Users\DAVID\AppData\Local\Temp\UpdateCheckerSetup.exe moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
File/Folder C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
File/Folder C:\Windows\System32\*.tmp not found.
File/Folder C:\Windows\SysWOW64\*.tmp not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\DAVID\Desktop\die datai\cmd.bat deleted successfully.
C:\Users\DAVID\Desktop\die datai\cmd.txt deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: DAVID
->Temp folder emptied: 255660006 bytes
->Temporary Internet Files folder emptied: 10055328 bytes
->FireFox cache emptied: 572717017 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 11063 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 68910 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 800,00 mb
OTL by OldTimer - Version 3.2.59.1 log created on 09022012_131700
Files\Folders moved on Reboot...
File move failed. C:\Windows\System32\mctadmin.exe scheduled to be moved on reboot.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
|
|
03.09.2012, 18:35
| #5 |
| /// Helfer-Team | GVU Trojaner Sehr gut!  Wie laeuft der Rechner? 1. Schritt Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.danach: 2. Schritt Downloade Dir bitte AdwCleaner auf deinen Desktop.
|
|
05.09.2012, 14:43
| #6 |
| | GVU Trojaner So das erste ist malwarebytes txt: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.09.05.06 Windows 7 x86 NTFS Internet Explorer 8.0.7600.16385 DAVID :: DAVID-PC [Administrator] Schutz: Deaktiviert 05.09.2012 14:47:11 mbam-log-2012-09-05 (14-47-11).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 349696 Laufzeit: 45 Minute(n), 53 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) AdwCleaner.txt: Code:
ATTFilter # AdwCleaner v2.000 - Datei am 09/05/2012 um 15:41:47 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Ultimate (32 bits)
# Benutzer : DAVID - DAVID-PC
# Normaler Modus : Normal
# Ausgeführt unter : C:\Users\DAVID\Desktop\adwcleaner.exe
# Option [Suche]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gefunden : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
Datei Gefunden : C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
Datei Gefunden : C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\searchplugins\SweetIm.xml
Ordner Gefunden : C:\Program Files\BabylonToolbar
Ordner Gefunden : C:\Program Files\SweetIM
Ordner Gefunden : C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Ordner Gefunden : C:\Users\DAVID\AppData\LocalLow\BabylonToolbar
Ordner Gefunden : C:\Users\DAVID\AppData\LocalLow\SweetIM
Ordner Gefunden : C:\Users\DAVID\AppData\Roaming\OpenCandy
Ordner Gefunden : C:\Windows\Installer\{FB697452-8CA4-46B4-98B1-165C922A2EF3}
***** [Registrierungsdatenbank] *****
Schlüssel Gefunden : HKCU\Software\BabylonToolbar
Schlüssel Gefunden : HKCU\Software\IM
Schlüssel Gefunden : HKCU\Software\ImInstaller
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403a-B9D2-65C292C39087}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403a-B9D2-65C292C39087}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Schlüssel Gefunden : HKCU\Software\SweetIm
Schlüssel Gefunden : HKLM\Software\Babylon
Schlüssel Gefunden : HKLM\Software\BabylonToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\b
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\bbylnApp.appCore
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{291BCCC1-6890-484A-89D3-318C928DAC1B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{C01315C7-B4E2-4864-B43D-5FAFC414D179}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{C1545464-C77C-4130-A572-1C619E2895FE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{ED0E67AD-926C-4008-87E5-03CF72AA2A7E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{EF7FEC6D-451B-4452-9D26-7E10C6B5DB6E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\I
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Incredibar.dskBnd
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Incredibar.dskBnd.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IncredibarApp.appCore
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IncredibarApp.appCore.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\sim-packages
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.sweetie
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{48C9C8B0-A546-46C1-A81F-47A31E623E9D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{74C36554-31F0-49DD-8857-ED6A64DF45BE}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{83AA2913-C123-4146-85BD-AD8F93971D39}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FB697452-8CA4-46B4-98B1-165C922A2EF3}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BabylonToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\incredibar
Schlüssel Gefunden : HKLM\Software\SweetIm
Schlüssel Gefunden : HKLM\Software\Web Assistant
***** [Internet Browser] *****
-\\ Internet Explorer v8.0.7600.16385
[HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.babylon.com/?affID=112555&tt=010812_nich_3112_7&babsrc=NT_ss&mntrId=60755749000000000000001d9284e761
-\\ Mozilla Firefox v14.0.1 (de)
Profilname : default
Datei : C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\prefs.js
Gefunden : user_pref("browser.newtab.url", "hxxp://mystart.incredibar.com/mb178?a=6OyM8En1pg&loc=FF_NT");
Gefunden : user_pref("extensions.BabylonToolbar.admin", false);
Gefunden : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Gefunden : user_pref("extensions.BabylonToolbar.babExt", "");
Gefunden : user_pref("extensions.BabylonToolbar.babTrack", "affID=112555&tt=010812_nich_3112_7");
Gefunden : user_pref("extensions.BabylonToolbar.cntry", "DE");
Gefunden : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Gefunden : user_pref("extensions.BabylonToolbar.envrmnt", "production");
Gefunden : user_pref("extensions.BabylonToolbar.excTlbr", false);
Gefunden : user_pref("extensions.BabylonToolbar.hdrMd5", "4A3191D57F4FBBFE86C7B05893D431CE");
Gefunden : user_pref("extensions.BabylonToolbar.hmpg", false);
Gefunden : user_pref("extensions.BabylonToolbar.id", "60755749000000000000001d9284e761");
Gefunden : user_pref("extensions.BabylonToolbar.instlDay", "15556");
Gefunden : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Gefunden : user_pref("extensions.BabylonToolbar.isdcmntcmplt", true);
Gefunden : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.29.118:20:49");
Gefunden : user_pref("extensions.BabylonToolbar.mntrvrsn", "1.3.0");
Gefunden : user_pref("extensions.BabylonToolbar.newTab", true);
Gefunden : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Gefunden : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Gefunden : user_pref("extensions.BabylonToolbar.sg", "none");
Gefunden : user_pref("extensions.BabylonToolbar.smplGrp", "none");
Gefunden : user_pref("extensions.BabylonToolbar.srcExt", "ss");
Gefunden : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Gefunden : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://www.google.com/search?babsrc=TB_ggl&q=");
Gefunden : user_pref("extensions.BabylonToolbar.vrsn", "1.5.29.1");
Gefunden : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.29.118:20:49");
Gefunden : user_pref("extensions.BabylonToolbar.vrsni", "1.5.29.1");
Gefunden : user_pref("extensions.BabylonToolbar_i.babExt", "");
Gefunden : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112555&tt=010812_nich_3112_7");
Gefunden : user_pref("extensions.BabylonToolbar_i.newTab", true);
Gefunden : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=112555&tt=01081[...]
Gefunden : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Gefunden : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Gefunden : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.29.118:20:49");
Gefunden : user_pref("extensions.incredibar.admin", false);
Gefunden : user_pref("extensions.incredibar.aflt", "orgnl");
Gefunden : user_pref("extensions.incredibar.cntry", "DE");
Gefunden : user_pref("extensions.incredibar.dfltLng", "");
Gefunden : user_pref("extensions.incredibar.dfltSrch", false);
Gefunden : user_pref("extensions.incredibar.did", "10643");
Gefunden : user_pref("extensions.incredibar.envrmnt", "production");
Gefunden : user_pref("extensions.incredibar.excTlbr", false);
Gefunden : user_pref("extensions.incredibar.hdrMd5", "164F659628301C9E9D3BA03A1C6C3542");
Gefunden : user_pref("extensions.incredibar.hmpg", false);
Gefunden : user_pref("extensions.incredibar.id", "60755749000000000000001d9284e761");
Gefunden : user_pref("extensions.incredibar.installerproductid", "26");
Gefunden : user_pref("extensions.incredibar.instlDay", "15577");
Gefunden : user_pref("extensions.incredibar.instlRef", "");
Gefunden : user_pref("extensions.incredibar.isDcmntCmplt", true);
Gefunden : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1423:35:13");
Gefunden : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Gefunden : user_pref("extensions.incredibar.newTab", false);
Gefunden : user_pref("extensions.incredibar.noFFXTlbr", false);
Gefunden : user_pref("extensions.incredibar.ppd", "1");
Gefunden : user_pref("extensions.incredibar.prdct", "incredibar");
Gefunden : user_pref("extensions.incredibar.productid", "26");
Gefunden : user_pref("extensions.incredibar.prtnrId", "Incredibar");
Gefunden : user_pref("extensions.incredibar.sg", "none");
Gefunden : user_pref("extensions.incredibar.smplGrp", "none");
Gefunden : user_pref("extensions.incredibar.tlbrId", "base");
Gefunden : user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6OyM8En1pg&loc=IB_T[...]
Gefunden : user_pref("extensions.incredibar.upn2", "6OyM8En1pg");
Gefunden : user_pref("extensions.incredibar.upn2n", "92261993790348266");
Gefunden : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Gefunden : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1423:35:13");
Gefunden : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Gefunden : user_pref("extensions.incredibar_i.aflt", "orgnl");
Gefunden : user_pref("extensions.incredibar_i.dfltLng", "");
Gefunden : user_pref("extensions.incredibar_i.did", "10643");
Gefunden : user_pref("extensions.incredibar_i.excTlbr", false);
Gefunden : user_pref("extensions.incredibar_i.id", "60755749000000000000001d9284e761");
Gefunden : user_pref("extensions.incredibar_i.installerproductid", "26");
Gefunden : user_pref("extensions.incredibar_i.instlDay", "15577");
Gefunden : user_pref("extensions.incredibar_i.instlRef", "");
Gefunden : user_pref("extensions.incredibar_i.ms_url_id", "");
Gefunden : user_pref("extensions.incredibar_i.newTab", false);
Gefunden : user_pref("extensions.incredibar_i.ppd", "1");
Gefunden : user_pref("extensions.incredibar_i.prdct", "incredibar");
Gefunden : user_pref("extensions.incredibar_i.productid", "26");
Gefunden : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Gefunden : user_pref("extensions.incredibar_i.smplGrp", "none");
Gefunden : user_pref("extensions.incredibar_i.tlbrId", "base");
Gefunden : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6OyM8En1pg&loc=IB[...]
Gefunden : user_pref("extensions.incredibar_i.upn2", "6OyM8En1pg");
Gefunden : user_pref("extensions.incredibar_i.upn2n", "92261993790348266");
Gefunden : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Gefunden : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1423:35:13");
Gefunden : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Gefunden : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www.hlportal.de/");
Gefunden : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={020[...]
Gefunden : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_referrer", "hxxp://us.yhs4.search.y[...]
Gefunden : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_temp_referer", "hxxp://us.yhs4.sear[...]
Gefunden : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]
-\\ Google Chrome v21.0.1180.89
Datei : C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Preferences
Gefunden [l.8] : homepage = "hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6}",
Gefunden [l.12] : urls_to_restore_on_startup = [ "hxxp://mystart.incredibar.com/mb178?a=6OyM8En1pg&i=26" ]
Gefunden [l.41] : icon_url = "hxxp://mystart.incredibar.com/mb178/favicon.ico",
Gefunden [l.44] : keyword = "mystart.incredibar.com/mb178",
Gefunden [l.47] : search_url = "hxxp://mystart.incredibar.com/mb178/?loc=IB_DS&search={searchTerms}&a=6OyM8En1pg&i=26",
Gefunden [l.1200] : homepage = "hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6}",
Gefunden [l.1548] : urls_to_restore_on_startup = [ "hxxp://mystart.incredibar.com/mb178?a=6OyM8En1pg&i=26" ]
*************************
AdwCleaner[R1].txt - [24060 octets] - [30/08/2012 01:29:21]
AdwCleaner[R4].txt - [21237 octets] - [05/09/2012 15:41:47]
########## EOF - C:\AdwCleaner[R4].txt - [21298 octets] ##########
|
|
06.09.2012, 02:34
| #7 |
| /// Helfer-Team | GVU Trojaner Sehr gut!
danach: Malware-Scan mit Emsisoft Anti-Malware Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm. Lade über Jetzt Updaten die aktuellen Signaturen herunter. Wähle den Freeware-Modus aus. Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers. Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten. Anleitung: http://www.trojaner-board.de/103809-...i-malware.html |
|
06.09.2012, 07:04
| #8 |
| | GVU Trojaner SO hier die 2 logs 1adwcleaner: Code:
ATTFilter # AdwCleaner v2.000 - Datei am 09/06/2012 um 07:14:51 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Ultimate (32 bits)
# Benutzer : DAVID - DAVID-PC
# Normaler Modus : Normal
# Ausgeführt unter : C:\Users\DAVID\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
Datei Gelöscht : C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
Datei Gelöscht : C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\searchplugins\SweetIm.xml
Ordner Gelöscht : C:\Program Files\BabylonToolbar
Ordner Gelöscht : C:\Program Files\SweetIM
Ordner Gelöscht : C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Ordner Gelöscht : C:\Users\DAVID\AppData\LocalLow\BabylonToolbar
Ordner Gelöscht : C:\Users\DAVID\AppData\LocalLow\SweetIM
Ordner Gelöscht : C:\Users\DAVID\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Windows\Installer\{FB697452-8CA4-46B4-98B1-165C922A2EF3}
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\BabylonToolbar
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403a-B9D2-65C292C39087}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403a-B9D2-65C292C39087}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Schlüssel Gelöscht : HKCU\Software\SweetIm
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\BabylonToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\b
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylnApp.appCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{291BCCC1-6890-484A-89D3-318C928DAC1B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C01315C7-B4E2-4864-B43D-5FAFC414D179}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C1545464-C77C-4130-A572-1C619E2895FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ED0E67AD-926C-4008-87E5-03CF72AA2A7E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EF7FEC6D-451B-4452-9D26-7E10C6B5DB6E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\I
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Incredibar.dskBnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Incredibar.dskBnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IncredibarApp.appCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IncredibarApp.appCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\sim-packages
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.sweetie
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{48C9C8B0-A546-46C1-A81F-47A31E623E9D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{74C36554-31F0-49DD-8857-ED6A64DF45BE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{83AA2913-C123-4146-85BD-AD8F93971D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FB697452-8CA4-46B4-98B1-165C922A2EF3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BabylonToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\incredibar
Schlüssel Gelöscht : HKLM\Software\SweetIm
Schlüssel Gelöscht : HKLM\Software\Web Assistant
***** [Internet Browser] *****
-\\ Internet Explorer v8.0.7600.16385
Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.babylon.com/?affID=112555&tt=010812_nich_3112_7&babsrc=NT_ss&mntrId=60755749000000000000001d9284e761 --> hxxp://www.google.com
-\\ Mozilla Firefox v14.0.1 (de)
Profilname : default
Datei : C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\prefs.js
C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\user.js ... Gelöscht !
Gelöscht : user_pref("browser.newtab.url", "hxxp://mystart.incredibar.com/mb178?a=6OyM8En1pg&loc=FF_NT");
Gelöscht : user_pref("extensions.BabylonToolbar.admin", false);
Gelöscht : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Gelöscht : user_pref("extensions.BabylonToolbar.babExt", "");
Gelöscht : user_pref("extensions.BabylonToolbar.babTrack", "affID=112555&tt=010812_nich_3112_7");
Gelöscht : user_pref("extensions.BabylonToolbar.cntry", "DE");
Gelöscht : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Gelöscht : user_pref("extensions.BabylonToolbar.envrmnt", "production");
Gelöscht : user_pref("extensions.BabylonToolbar.excTlbr", false);
Gelöscht : user_pref("extensions.BabylonToolbar.hdrMd5", "4A3191D57F4FBBFE86C7B05893D431CE");
Gelöscht : user_pref("extensions.BabylonToolbar.hmpg", false);
Gelöscht : user_pref("extensions.BabylonToolbar.id", "60755749000000000000001d9284e761");
Gelöscht : user_pref("extensions.BabylonToolbar.instlDay", "15556");
Gelöscht : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Gelöscht : user_pref("extensions.BabylonToolbar.isdcmntcmplt", true);
Gelöscht : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.29.118:20:49");
Gelöscht : user_pref("extensions.BabylonToolbar.mntrvrsn", "1.3.0");
Gelöscht : user_pref("extensions.BabylonToolbar.newTab", true);
Gelöscht : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Gelöscht : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Gelöscht : user_pref("extensions.BabylonToolbar.sg", "none");
Gelöscht : user_pref("extensions.BabylonToolbar.smplGrp", "none");
Gelöscht : user_pref("extensions.BabylonToolbar.srcExt", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://www.google.com/search?babsrc=TB_ggl&q=");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsn", "1.5.29.1");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.29.118:20:49");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsni", "1.5.29.1");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babExt", "");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112555&tt=010812_nich_3112_7");
Gelöscht : user_pref("extensions.BabylonToolbar_i.newTab", true);
Gelöscht : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=112555&tt=01081[...]
Gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Gelöscht : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.29.118:20:49");
Gelöscht : user_pref("extensions.incredibar.admin", false);
Gelöscht : user_pref("extensions.incredibar.aflt", "orgnl");
Gelöscht : user_pref("extensions.incredibar.cntry", "DE");
Gelöscht : user_pref("extensions.incredibar.dfltLng", "");
Gelöscht : user_pref("extensions.incredibar.dfltSrch", false);
Gelöscht : user_pref("extensions.incredibar.did", "10643");
Gelöscht : user_pref("extensions.incredibar.envrmnt", "production");
Gelöscht : user_pref("extensions.incredibar.excTlbr", false);
Gelöscht : user_pref("extensions.incredibar.hdrMd5", "164F659628301C9E9D3BA03A1C6C3542");
Gelöscht : user_pref("extensions.incredibar.hmpg", false);
Gelöscht : user_pref("extensions.incredibar.id", "60755749000000000000001d9284e761");
Gelöscht : user_pref("extensions.incredibar.installerproductid", "26");
Gelöscht : user_pref("extensions.incredibar.instlDay", "15577");
Gelöscht : user_pref("extensions.incredibar.instlRef", "");
Gelöscht : user_pref("extensions.incredibar.isDcmntCmplt", true);
Gelöscht : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1423:35:13");
Gelöscht : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Gelöscht : user_pref("extensions.incredibar.newTab", false);
Gelöscht : user_pref("extensions.incredibar.noFFXTlbr", false);
Gelöscht : user_pref("extensions.incredibar.ppd", "1");
Gelöscht : user_pref("extensions.incredibar.prdct", "incredibar");
Gelöscht : user_pref("extensions.incredibar.productid", "26");
Gelöscht : user_pref("extensions.incredibar.prtnrId", "Incredibar");
Gelöscht : user_pref("extensions.incredibar.sg", "none");
Gelöscht : user_pref("extensions.incredibar.smplGrp", "none");
Gelöscht : user_pref("extensions.incredibar.tlbrId", "base");
Gelöscht : user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6OyM8En1pg&loc=IB_T[...]
Gelöscht : user_pref("extensions.incredibar.upn2", "6OyM8En1pg");
Gelöscht : user_pref("extensions.incredibar.upn2n", "92261993790348266");
Gelöscht : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Gelöscht : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1423:35:13");
Gelöscht : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Gelöscht : user_pref("extensions.incredibar_i.aflt", "orgnl");
Gelöscht : user_pref("extensions.incredibar_i.dfltLng", "");
Gelöscht : user_pref("extensions.incredibar_i.did", "10643");
Gelöscht : user_pref("extensions.incredibar_i.excTlbr", false);
Gelöscht : user_pref("extensions.incredibar_i.id", "60755749000000000000001d9284e761");
Gelöscht : user_pref("extensions.incredibar_i.installerproductid", "26");
Gelöscht : user_pref("extensions.incredibar_i.instlDay", "15577");
Gelöscht : user_pref("extensions.incredibar_i.instlRef", "");
Gelöscht : user_pref("extensions.incredibar_i.ms_url_id", "");
Gelöscht : user_pref("extensions.incredibar_i.newTab", false);
Gelöscht : user_pref("extensions.incredibar_i.ppd", "1");
Gelöscht : user_pref("extensions.incredibar_i.prdct", "incredibar");
Gelöscht : user_pref("extensions.incredibar_i.productid", "26");
Gelöscht : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Gelöscht : user_pref("extensions.incredibar_i.smplGrp", "none");
Gelöscht : user_pref("extensions.incredibar_i.tlbrId", "base");
Gelöscht : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6OyM8En1pg&loc=IB[...]
Gelöscht : user_pref("extensions.incredibar_i.upn2", "6OyM8En1pg");
Gelöscht : user_pref("extensions.incredibar_i.upn2n", "92261993790348266");
Gelöscht : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Gelöscht : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1423:35:13");
Gelöscht : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Gelöscht : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Gelöscht : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Gelöscht : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www.hlportal.de/");
Gelöscht : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={020[...]
Gelöscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_referrer", "hxxp://us.yhs4.search.y[...]
Gelöscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_temp_referer", "hxxp://us.yhs4.sear[...]
Gelöscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]
-\\ Google Chrome v21.0.1180.89
Datei : C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Preferences
Gelöscht [l.8] : homepage = "hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6}",
Gelöscht [l.12] : urls_to_restore_on_startup = [ "hxxp://mystart.incredibar.com/mb178?a=6OyM8En1pg&i=26" ]
Gelöscht [l.41] : icon_url = "hxxp://mystart.incredibar.com/mb178/favicon.ico",
Gelöscht [l.44] : keyword = "mystart.incredibar.com/mb178",
Gelöscht [l.47] : search_url = "hxxp://mystart.incredibar.com/mb178/?loc=IB_DS&search={searchTerms}&a=6OyM8En1pg&i=26",
Gelöscht [l.1227] : homepage = "hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6}",
Gelöscht [l.1575] : urls_to_restore_on_startup = [ "hxxp://mystart.incredibar.com/mb178?a=6OyM8En1pg&i=26" ]
*************************
AdwCleaner[R1].txt - [24060 octets] - [30/08/2012 01:29:21]
AdwCleaner[R4].txt - [21368 octets] - [05/09/2012 15:41:47]
AdwCleaner[R5].txt - [21429 octets] - [06/09/2012 07:11:02]
AdwCleaner[S1].txt - [21985 octets] - [06/09/2012 07:14:51]
########## EOF - C:\AdwCleaner[S1].txt - [22046 octets] ##########
2Emsisoft Anti-Malware: Code:
ATTFilter Emsisoft Anti-Malware - Version 6.0
Letztes Update: 06.09.2012 07:33:49
Scan Einstellungen:
Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\
Archiv Scan: An
ADS Scan: An
Scan Beginn: 06.09.2012 07:34:14
C:\_OTL\MovedFiles\09022012_131700\C_Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarApp.dll gefunden: Riskware.Win32.Toolbar.Babylon.AMN!E1
C:\_OTL\MovedFiles\09022012_131700\C_Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarsrv.exe gefunden: Riskware.Win32.Toolbar.Babylon.AMN!E1
Gescannt 596268
Gefunden 2
Scan Ende: 06.09.2012 08:02:31
Scan Zeit: 0:28:17
|
|
06.09.2012, 18:09
| #9 |
| /// Helfer-Team | GVU Trojaner Sehr gut! Deinstalliere: Emsisoft Anti-Malware ESET Online Scanner Vorbereitung
|
|
06.09.2012, 21:00
| #10 |
| | GVU Trojaner habe grade gesehen das der virus wieder da ist es kommt wieder den gvu bild wass soll ich jetzt tuhen ? wieder alles neu machen oder wie ??? |
|
07.09.2012, 14:39
| #11 |
| /// Helfer-Team | GVU Trojaner Nicht mit dem Rechner rumsurfen! Er ist noch garnicht abgesichert! 1. Schritt Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten. |
|
08.09.2012, 10:19
| #12 |
| | GVU Trojaner so hier die log werde mein bruter noch mal sagen müssen danke noch mals ^^ [/CODE] Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.09.08.02 Windows 7 x86 NTFS Internet Explorer 8.0.7600.16385 DAVID :: DAVID-PC [Administrator] Schutz: Deaktiviert 08.09.2012 10:40:30 mbam-log-2012-09-08 (10-40-30).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 325949 Laufzeit: 36 Minute(n), 44 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) [/CODE] Geändert von NinjaB (08.09.2012 um 10:24 Uhr) |
|
09.09.2012, 02:09
| #13 |
| /// Helfer-Team | GVU Trojaner |
|
09.09.2012, 15:25
| #14 |
| | GVU Trojaner hier die log von eset Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=9ce524c8a2d9c04ca1d80d280770e642
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-09 01:39:08
# local_time=2012-09-09 03:39:08 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=5893 16776573 100 94 81702 98824688 0 0
# compatibility_mode=8192 67108863 100 0 106 106 0 0
# scanned=151648
# found=5
# cleaned=5
# scan_time=4450
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\6b64a084-36e89541 a variant of Win32/Kryptik.ALNU trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\33c1867f-451266d8 a variant of Java/Exploit.CVE-2012-4681.O trojan (deleted - quarantined) 00000000000000000000000000000000 C
C:\Users\DAVID\Desktop\Neuer Ordner (2)\IZArcInstall.exe a variant of Win32/Somoto.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTL\MovedFiles\09022012_131700\C_Users\DAVID\AppData\Local\Temp\ICReinstall_Pokemon_Chaos_Black_downloader.exe a variant of Win32/InstallCore.AF application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
D:\Neuer Ordner (3)\Neuer Ordner (2)\IZArcInstall.exe a variant of Win32/Somoto.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
|
|
09.09.2012, 22:30
| #15 |
| /// Helfer-Team | GVU Trojaner Kaputt? Was heisst das? |
|
