Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: BOO/Shertwil.L in Bootsektor gefunden!

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 23.11.2011, 05:33   #1
trinova
 
BOO/Shertwil.L in Bootsektor gefunden! - Standard

BOO/Shertwil.L in Bootsektor gefunden!



Seit vorigen Freitag wird bei mir von AVIRA im Masterbootsektor und in Bootsektor HD folgendes gefunden: BOO/Shertwil.L

Entfernen wird angeboten. Nach Neustart ist er trotzdem wieder da.

Malwarebytes hat folgendes ergeben:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8218

Windows 6.1.7601 Service Pack 1
Internet Explorer X.X.X.XXXXX

22.11.2011 19:45:58
mbam-log-2011-11-22 (19-45-58).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 172389
Laufzeit: 2 Minute(n), 57 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



ESET

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=f1487f20cdea4d46bf5d576ba5aa20a0
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-11-22 10:07:40
# local_time=2011-11-22 11:07:40 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 3478719 3478719 0 0
# compatibility_mode=4096 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776573 100 94 7144366 73619139 0 0
# compatibility_mode=8192 67108863 100 0 4504 4504 0 0
# scanned=583184
# found=9
# cleaned=0
# scan_time=10371
C:\ProgramData\Spybot - Search & Destroy\Recovery\ToolbarFacemood50.zip Win32/Bagle.gen.zip worm (unable to clean) 00000000000000000000000000000000 I
C:\Users\All Users\Spybot - Search & Destroy\Recovery\ToolbarFacemood50.zip Win32/Bagle.gen.zip worm (unable to clean) 00000000000000000000000000000000 I
C:\Users\Nico\Downloads\SoftonicDownloader_fuer_7-zip.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Nico\Downloads\SoftonicDownloader_fuer_winzip.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I
E:\C backup\Lokaler Datenträger (D)\Programme\Spiel\Hentai 3D 2\XP_Only\Binaries\fcHentai3DRun.DE.exe a variant of Win32/Inject.NDT trojan (unable to clean) 00000000000000000000000000000000 I
E:\C backup\Lokaler Datenträger (D)\Programme\Spiel\Hentai 3D 2\XP_Only\Binaries\fcHentai3DRun.EN.exe a variant of Win32/Inject.NDT trojan (unable to clean) 00000000000000000000000000000000 I
E:\C backup\Lokaler Datenträger (D)\Programme\thriXXX\Hentai 3D 2 - Cry of Pleasure\Binaries\fcHentai3DRun.DE.exe a variant of Win32/Inject.NDT trojan (unable to clean) 00000000000000000000000000000000 I
E:\C backup\Lokaler Datenträger (D)\Programme\thriXXX\Hentai 3D 2 - Cry of Pleasure\Binaries\fcHentai3DRun.EN.exe a variant of Win32/Inject.NDT trojan (unable to clean) 00000000000000000000000000000000 I
E:\Datensicherung\Users\Nico\Downloads\SoftonicDownloader_fuer_izarc.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I







Hoffe mir kann jemand helfen!

Alt 23.11.2011, 14:53   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
BOO/Shertwil.L in Bootsektor gefunden! - Standard

BOO/Shertwil.L in Bootsektor gefunden!



Zitat:
C:\Users\Nico\Downloads\SoftonicDownloader_fuer_7-zip.exe
Bitte nicht falsch verstehen, aber irgendwie hab ich den Eindruck es ist ein Volkssport geworden sich sämtlichen Kram von Softonic zu laden. Da ist immer irgendein Müll wie Toolbars oder der sinnlose Softonic Downloader drin. Warum lädst du die Software nicht von der Seite des Herstellers oder notfalls bei chip.de?


Zitat:
Art des Suchlaufs: Quick-Scan
Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!
__________________

__________________

Alt 23.11.2011, 20:56   #3
trinova
 
BOO/Shertwil.L in Bootsektor gefunden! - Standard

BOO/Shertwil.L in Bootsektor gefunden!



Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8218

Windows 6.1.7601 Service Pack 1
Internet Explorer X.X.XXXX.XXXX

23.11.2011 20:48:17
mbam-log-2011-11-23 (20-47-56).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 724839
Laufzeit: 3 Stunde(n), 48 Minute(n), 35 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



Zitat:
Bitte nicht falsch verstehen, aber irgendwie hab ich den Eindruck es ist ein Volkssport geworden sich sämtlichen Kram von Softonic zu laden. Da ist immer irgendein Müll wie Toolbars oder der sinnlose Softonic Downloader drin. Warum lädst du die Software nicht von der Seite des Herstellers oder notfalls bei chip.de?

Versteh ich nicht falsch. Keine Sorge! Hab mir nichts dabei gedacht, wie bestimmt tausende "Normal-PC Benutzer"! Hoffe Ihr helft mir trotzdem!
__________________

Alt 23.11.2011, 21:08   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
BOO/Shertwil.L in Bootsektor gefunden! - Standard

BOO/Shertwil.L in Bootsektor gefunden!



Zitat:
Internet Explorer X.X.XXXX.XXXX
Was soll denn das Unkenntlichmachen von Versionsnummern bringen!
Wenn sollen in Logs nur private infos unkenntlich gemacht werden, NICHTS WEITER!
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 23.11.2011, 21:14   #5
trinova
 
BOO/Shertwil.L in Bootsektor gefunden! - Standard

BOO/Shertwil.L in Bootsektor gefunden!



Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514


Alt 23.11.2011, 21:25   #6
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
BOO/Shertwil.L in Bootsektor gefunden! - Standard

BOO/Shertwil.L in Bootsektor gefunden!



CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Starte bitte die OTL.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet
Code:
ATTFilter
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Klick auf .
  • Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread
__________________
--> BOO/Shertwil.L in Bootsektor gefunden!

Alt 27.11.2011, 12:48   #7
trinova
 
BOO/Shertwil.L in Bootsektor gefunden! - Standard

BOO/Shertwil.L in Bootsektor gefunden!



OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 27.11.2011 12:35:30 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Nico\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,93 Gb Available Physical Memory | 73,35% Memory free
8,00 Gb Paging File | 6,69 Gb Available in Paging File | 83,69% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 930,87 Gb Total Space | 728,14 Gb Free Space | 78,22% Space Free | Partition Type: NTFS
 
Computer Name: HAUPTRECHNER | User Name: Nico | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.11.24 18:52:17 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Nico\Downloads\OTL.exe
PRC - [2011.10.11 17:02:07 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2011.10.11 17:00:14 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
PRC - [2011.10.11 16:59:45 | 000,342,480 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
PRC - [2011.10.11 16:59:41 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.10.11 16:59:39 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.09.19 13:50:22 | 000,993,280 | ---- | M] (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) -- C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
PRC - [2011.01.05 11:51:15 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
PRC - [2010.10.16 11:46:40 | 000,369,256 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2010.07.14 04:00:00 | 000,032,240 | ---- | M] () -- C:\Program Files (x86)\Roxio\BackOnTrack\App\BService.exe
PRC - [2010.07.13 21:23:50 | 000,084,464 | ---- | M] () -- C:\Program Files (x86)\Roxio 2011\5.0\CPMonitor.exe
PRC - [2010.06.30 09:10:14 | 000,477,680 | ---- | M] () -- C:\Program Files (x86)\Roxio 2011\Roxio Burn\RoxioBurnLauncher.exe
PRC - [2009.12.07 13:49:24 | 000,040,960 | ---- | M] (Realtek) -- C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe
PRC - [2009.06.02 19:05:58 | 000,457,200 | ---- | M] () -- C:\Program Files (x86)\Roxio\BackOnTrack\App\SaibSVC.exe
PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2007.05.10 22:46:20 | 000,624,248 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\acrotray.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.08.31 15:44:40 | 000,315,392 | ---- | M] () -- C:\Program Files (x86)\Evernote\Evernote\libtidy.dll
MOD - [2011.08.31 15:44:38 | 000,433,664 | ---- | M] () -- C:\Program Files (x86)\Evernote\Evernote\libxml2.dll
MOD - [2010.07.13 21:23:50 | 000,084,464 | ---- | M] () -- C:\Program Files (x86)\Roxio 2011\5.0\CPMonitor.exe
MOD - [2010.06.30 09:10:14 | 000,477,680 | ---- | M] () -- C:\Program Files (x86)\Roxio 2011\Roxio Burn\RoxioBurnLauncher.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2011.10.11 17:02:07 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.10.11 17:00:14 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2011.10.11 16:59:45 | 000,342,480 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2011.10.11 16:59:41 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.29 15:59:18 | 000,155,344 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe -- (Sony Ericsson PCCompanion)
SRV - [2011.01.05 11:51:15 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.10.16 11:46:40 | 000,369,256 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2010.07.16 06:48:26 | 000,354,288 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatch13.exe -- (RoxWatch12)
SRV - [2010.07.16 06:48:04 | 001,099,248 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxMediaDB13.exe -- (RoxMediaDB13)
SRV - [2010.07.14 04:00:00 | 000,032,240 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Roxio\BackOnTrack\App\BService.exe -- (BOT4Service)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.12.07 13:49:24 | 000,040,960 | ---- | M] (Realtek) [Auto | Running] -- C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe -- (Realtek11nSU)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.06.02 19:05:58 | 000,457,200 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Roxio\BackOnTrack\App\SaibSVC.exe -- (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269)
SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2007.05.31 16:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 16:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007.03.20 16:41:24 | 000,153,792 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe -- (Adobe Version Cue CS3)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011.10.11 17:03:33 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.10.11 17:03:32 | 000,130,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.10.11 17:03:30 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.01.06 11:07:26 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2011.01.06 11:07:25 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 12:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.09.07 21:08:55 | 000,155,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2010.03.19 03:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2009.11.11 09:54:46 | 000,676,864 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rtl8192su.sys -- (RTL8192su)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.02 01:00:00 | 000,027,632 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SaibVdAd64.sys -- (SaibVdAd64)
DRV:64bit: - [2009.06.02 01:00:00 | 000,027,120 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\Sahdad64.sys -- (Sahdad64)
DRV:64bit: - [2009.06.02 01:00:00 | 000,019,952 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\Saibad64.sys -- (Saibad64)
DRV:64bit: - [2008.05.16 10:33:06 | 000,158,760 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0016mdm.sys -- (s0016mdm)
DRV:64bit: - [2008.05.16 10:33:06 | 000,151,592 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0016unic.sys -- (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM)
DRV:64bit: - [2008.05.16 10:33:06 | 000,137,256 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0016mgmt.sys -- (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM)
DRV:64bit: - [2008.05.16 10:33:06 | 000,136,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0016obex.sys -- (s0016obex)
DRV:64bit: - [2008.05.16 10:33:06 | 000,034,344 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0016nd5.sys -- (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS)
DRV:64bit: - [2008.05.16 10:33:04 | 000,019,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0016mdfl.sys -- (s0016mdfl)
DRV:64bit: - [2008.05.16 10:32:56 | 000,115,240 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0016bus.sys -- (s0016bus) Sony Ericsson Device 0016 driver (WDM)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Hotmail und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 60 5E 69 90 AE 94 CB 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Facemoods Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/ig"
FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:21.1.10084.997
FF - prefs.js..extensions.enabledItems: {340c2bbc-ce74-4362-90b5-7c26312808ef}:1.7
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.6
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Program Files (x86)\TVUPlayer\npTVUAx.dll (TVU networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.09 19:42:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.11.01 10:03:26 | 000,000,000 | ---D | M]
 
[2010.12.05 20:02:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nico\AppData\Roaming\mozilla\Extensions
[2011.11.21 19:48:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\445zmwz0.default\extensions
[2011.05.09 17:37:07 | 000,000,000 | ---D | M] (PokHelper) -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\445zmwz0.default\extensions\{3189af69-c0a1-4318-b2b9-610e0ba6a775}
[2011.07.24 17:44:36 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\445zmwz0.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.11.12 20:22:34 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\445zmwz0.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.08.14 09:39:51 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\445zmwz0.default\extensions\firefox@tvunetworks.com
[2011.11.09 19:42:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2010.12.05 21:05:33 | 000,000,000 | ---D | M] (G Data WebFilter) -- C:\Program Files (x86)\mozilla firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE}
() (No name found) -- C:\USERS\NICO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\445ZMWZ0.DEFAULT\EXTENSIONS\EXTENSION@CIUVO.COM.XPI
() (No name found) -- C:\USERS\NICO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\445ZMWZ0.DEFAULT\EXTENSIONS\FINDER@MEINGUTSCHEINCODE.DE.XPI
[2011.11.09 19:41:59 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.06 20:08:46 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.06 20:08:46 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.10.06 20:08:46 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.06 20:08:46 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.06 20:08:46 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.06 20:08:46 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (no name) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe_ID0EYTHM] C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CPMonitor] C:\Program Files (x86)\Roxio 2011\5.0\CPMonitor.exe ()
O4 - HKLM..\Run: [Desktop Disc Tool] C:\Program Files (x86)\Roxio 2011\Roxio Burn\RoxioBurnLauncher.exe ()
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatchTray13.exe (Sonic Solutions)
O4 - HKCU..\Run: [Sony Ericsson PC Companion] C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10v_Plugin.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk = C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta ()
O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Nico\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta ()
O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Nico\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{55463C69-1F87-4397-9210-B40C42B51227}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{80D3CD33-5690-4F78-9569-7A403D5C00E9}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{2c267311-07e5-11e1-8f42-0030678c23af}\Shell - "" = AutoRun
O33 - MountPoints2\{2c267311-07e5-11e1-8f42-0030678c23af}\Shell\AutoRun\command - "" = N:\pushinst.exe
O33 - MountPoints2\{f9737440-f252-11e0-ac6c-0030678c23af}\Shell - "" = AutoRun
O33 - MountPoints2\{f9737440-f252-11e0-ac6c-0030678c23af}\Shell\AutoRun\command - "" = N:\Startme.exe
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\Setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.11.27 12:17:39 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{67FD8132-783B-4408-8FEE-EA838542DDB3}
[2011.11.27 12:17:28 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{B61DC993-2F9A-4FA5-9455-33DF002E0C1F}
[2011.11.24 19:49:33 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{BDA73C94-40FA-4560-A389-58DBEB0D7DA1}
[2011.11.24 19:49:11 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{EC295C47-7717-47BE-83EC-B149464E7385}
[2011.11.24 18:20:42 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{FFC83DEB-0F02-4E9E-AD46-9B9019D654C3}
[2011.11.24 18:20:31 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{0A2C2349-1C2D-41B0-B5A4-97847B81B746}
[2011.11.24 16:18:55 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{1E470FC1-BEA2-4D18-A2EE-1180BDE6DC45}
[2011.11.24 16:18:33 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{B29DA048-67FC-4F93-A151-3B02477E19F1}
[2011.11.23 22:18:07 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\Norman Malware Cleaner
[2011.11.23 21:38:32 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{16DF4132-FCBC-4AEB-88FD-5AFF91BF6B03}
[2011.11.23 20:52:49 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{AECC823D-E2F1-4121-A40A-2359B7488D65}
[2011.11.23 20:52:37 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{EF44BBEA-C6DA-4B1B-8BFE-CBB807FFD808}
[2011.11.22 19:59:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2011.11.22 19:49:53 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{2A32F83D-1EC3-425C-9120-B7CB7EE2E8BA}
[2011.11.22 19:49:32 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{9EF85C28-3258-4CCD-BAD7-E812DDD4F9C6}
[2011.11.22 19:41:13 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\Malwarebytes
[2011.11.22 19:41:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.11.22 19:41:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.11.22 19:41:03 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.11.22 19:41:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.11.22 19:10:53 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{0FE9DAE5-1772-4A87-92E4-D795EEE495AE}
[2011.11.22 19:10:27 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{1DE8E220-0C94-413C-80C2-F13CAD1958D2}
[2011.11.21 20:55:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011.11.21 20:55:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011.11.21 20:55:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2011.11.21 19:08:15 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{95F58DA1-C77A-4907-8938-89DE793B3CD3}
[2011.11.21 19:07:54 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{6C910F9C-B0D1-4824-AC4C-0B1E8D36777D}
[2011.11.21 19:07:12 | 000,000,000 | ---D | C] -- C:\Program Files\Flatout2
[2011.11.21 17:29:36 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{CC2DF0F8-F89D-4708-BEA9-46AE344ED85A}
[2011.11.21 17:29:24 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{1857CBE2-7F2C-40B3-B316-D500FDC7938B}
[2011.11.20 19:51:02 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{6B736FE0-A130-4D4E-91E7-7A3A8CC3A386}
[2011.11.20 19:50:39 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{6EBF32E0-FC24-4E02-AB82-49149E0F5FF8}
[2011.11.20 17:27:19 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{4A8E6780-1429-4F71-B29B-A13DC5FF05A7}
[2011.11.20 17:26:57 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{1D60CEEC-C7F4-4D0A-9F8C-32A35FBE4392}
[2011.11.20 11:02:31 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{303FFB94-23A7-4184-9090-441D8DA47275}
[2011.11.20 11:02:09 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{E2489FC0-DD4F-46E7-B34A-38C9716F790D}
[2011.11.20 10:32:41 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{7A3A2975-EFB9-4DA0-8F45-3AD6C17C402F}
[2011.11.20 10:32:30 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{42E08E2C-A8D2-42DD-AE73-AC23CE5B8E8D}
[2011.11.19 19:57:32 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{0E5861F6-16F4-4A96-B1A8-382549F21437}
[2011.11.19 19:57:22 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{79822E5A-7E20-49DD-94B0-7B39F16B2EA9}
[2011.11.19 19:12:23 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{6D1BA755-1AF2-4889-BF64-7395F2DEF65B}
[2011.11.19 19:11:58 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{49500172-5289-4FA7-8160-AC47DFEF7AE4}
[2011.11.19 09:43:14 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{03A455EC-067F-4E06-95AD-A5B57BA7B30B}
[2011.11.18 19:44:24 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{0EF56DED-4D4B-4A76-8DDD-B9FBFB768C3E}
[2011.11.18 19:44:12 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{AEA01728-46C9-40F6-8028-EE3B933B4C1F}
[2011.11.18 19:42:59 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{D6539889-9BD4-48C5-B938-01C65DAE6024}
[2011.11.18 19:42:37 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{068D7DB7-CB0A-4E2D-988E-A00E79CA3CAA}
[2011.11.17 21:53:33 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{8D4CDF12-8B91-4048-BA56-7E5207A9AC18}
[2011.11.17 21:53:22 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{64D45E0C-8B8A-4189-80EE-68C61F2545CB}
[2011.11.17 21:13:38 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{9107C332-5840-4FC9-9771-DF1725BB6313}
[2011.11.17 21:13:17 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{5BDFCF86-E93F-4D59-A3A3-9C789A48E468}
[2011.11.17 12:13:36 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{B8345280-BD83-46D6-B413-93B8323A451B}
[2011.11.17 12:13:25 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{3C2A3DC0-3D44-44D9-82AA-F7432492421C}
[2011.11.17 12:03:58 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{353567AC-88EA-453D-9926-B976BDAFCF43}
[2011.11.17 12:03:46 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{EA26CFA9-E5AA-4B95-A3B3-9BBFB1858EC2}
[2011.11.16 12:05:47 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{279A3BA1-1784-48A7-B90B-144464F7E064}
[2011.11.16 12:05:35 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{53DE42D3-FE2C-42A5-8734-F0C4CA4B07B5}
[2011.11.15 19:07:26 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{B743B015-D379-4F7C-9BD8-3BDD35028CCE}
[2011.11.15 19:07:04 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{DB68D2C0-E9AA-43B3-B871-F06249EAD444}
[2011.11.15 12:33:42 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{7EFF78CB-3726-47C6-9430-30773B4770CF}
[2011.11.15 12:33:31 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{F9B61699-5550-406D-84D0-FCC754855DB8}
[2011.11.15 11:57:38 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{278AE714-C593-47D8-BF95-E0E9B9DEFCBB}
[2011.11.15 11:57:16 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{AA146606-4C56-4695-9A8A-BA2EA9351838}
[2011.11.15 10:56:38 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{284D4E7E-2236-4C87-95B1-FF69E780C286}
[2011.11.15 10:56:16 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{7293AAFF-4118-44D7-B294-7019AED381D6}
[2011.11.14 17:42:30 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{0705085A-F468-4050-A93E-B6E74747CC3B}
[2011.11.14 17:42:07 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{B07DA6D5-79B2-4610-A5C8-CD2FD538DE26}
[2011.11.14 12:20:35 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{D323E509-41DE-49D3-86B7-98C5A7885511}
[2011.11.14 12:20:14 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{77D2CDBF-950B-4C63-9987-835DFC5ADF70}
[2011.11.14 11:58:01 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{6623EAFF-1366-4B8F-AEA5-3BD377D5E51E}
[2011.11.14 11:57:39 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{7A530A30-B8ED-4187-988E-2D8F9D4741E7}
[2011.11.13 14:00:50 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{C307BBCF-DE2B-4927-B726-F1A87E09BB48}
[2011.11.13 14:00:38 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{D921146E-3642-4F4C-B0E8-5DB55DC83780}
[2011.11.13 09:59:39 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{5AA5D019-8E0C-48DB-8EDD-432BE55FA7F9}
[2011.11.13 09:59:16 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{44DC6D7E-64A1-47B7-AD84-3FF6A1C4C6E4}
[2011.11.12 20:22:54 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{DD7408FF-3926-4C34-91AB-F3C5AC51755F}
[2011.11.12 20:22:32 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{ECED5719-58E3-4528-8CEF-31C6763A8592}
[2011.11.10 18:50:27 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{7AB9BE4A-B373-4AD9-A455-67FC4B38A833}
[2011.11.10 18:50:05 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{A49AD25A-B830-450B-9945-36ECEB691C98}
[2011.11.10 18:27:26 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{E597F6DF-CDF5-4000-8D55-515767C71715}
[2011.11.10 18:27:04 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{F96A9025-6E5E-479A-A0F1-243A7006438B}
[2011.11.09 21:15:29 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{8D71304B-DDDD-457C-837B-92C8E6E0C8C8}
[2011.11.09 21:15:18 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{0840D378-4E60-4C6B-B37D-D534DE42F931}
[2011.11.09 19:42:46 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{FBE8A36E-4636-44B3-8CB4-38541D58CEE2}
[2011.11.09 19:42:18 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{79B99273-F9E3-49F2-BCFA-F17FECA0542D}
[2011.11.08 20:03:30 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{26305F2B-CC5B-45D3-95C5-274D1DF6AE50}
[2011.11.08 20:03:08 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{059A81EE-418D-42D1-93FD-B39243D7FA18}
[2011.11.08 18:28:39 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{F872BB80-3132-481D-B497-8826FC9D1C43}
[2011.11.08 18:28:17 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{B16FEF7F-6314-4EC0-B243-6C73DAA673F6}
[2011.11.06 19:57:09 | 000,000,000 | ---D | C] -- C:\Users\Nico\Documents\Klasse Luis
[2011.11.06 18:56:19 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{C9B78DAD-E9A4-4009-AF65-5A851CE2B796}
[2011.11.06 15:19:23 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{1AC9B41A-6145-49D2-A684-180A1F17F98F}
[2011.11.06 15:19:01 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{60A368E7-C91B-49B4-9552-9F5FA5F6CC90}
[2011.11.06 15:02:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cisco
[2011.11.06 15:02:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\REALTEK 11n USB Wireless LAN Utility
[2011.11.06 15:01:20 | 000,380,928 | ---- | C] (Realtek) -- C:\Windows\SysNative\RtlUI2.exe
[2011.11.06 15:01:20 | 000,380,928 | ---- | C] (Realtek) -- C:\Windows\RtlUI2.exe
[2011.11.06 15:01:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\REALTEK
[2011.11.05 21:30:47 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{39C1D1C3-70D1-4049-9CF8-5E9F4E5B38E2}
[2011.11.05 21:30:24 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{73B87822-F4A1-493E-9ED3-CCF79AEEDCE1}
[2011.11.02 18:19:20 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{35D9EB5B-EB06-4353-AB5A-8C485605BAF5}
[2011.11.02 18:18:58 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{ADA828B0-D923-4F26-A1D2-3053D9F5D6B1}
[2011.11.02 11:53:15 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{1C5B74CB-9A9A-458C-899B-1FF41690A849}
[2011.11.02 11:11:39 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\Apple Computer
[2011.11.01 10:03:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011.11.01 10:03:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2011.11.01 09:58:43 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{E019A52F-44D2-4790-B7C9-0723F6A27669}
[2011.11.01 09:58:31 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{68C2DEEE-B3F8-4173-8E59-E74BD807B597}
[2011.11.01 09:44:32 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{35A6490E-2956-4B69-B091-218479EE86F7}
[2011.11.01 09:44:05 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{FABCF518-394C-4876-8CAC-5AE822BD6DDA}
[2011.10.28 19:03:38 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{71838F42-748B-43EA-9C73-02BEFF1CE2A7}
[2011.10.28 19:03:14 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{32C36884-F042-48E8-9316-9F369890AF1A}
[2011.10.28 18:41:48 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{AF790A58-40CD-4AA5-B76B-0E9FD5B9E62E}
[2011.10.28 18:41:25 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{77553A8F-4E70-416A-8C92-FA41208E6467}
[6 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.11.27 12:24:44 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.11.27 12:24:44 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.11.27 12:20:38 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.11.27 12:20:38 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.11.27 12:20:38 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.11.27 12:20:38 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.11.27 12:20:38 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.11.27 12:15:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.11.27 12:15:39 | 3220,725,760 | -HS- | M] () -- C:\hiberfil.sys
[2011.11.22 19:41:08 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.11.21 20:55:26 | 000,001,262 | ---- | M] () -- C:\Users\Nico\Desktop\Spybot - Search & Destroy.lnk
[2011.11.21 19:13:24 | 000,000,969 | ---- | M] () -- C:\Users\Nico\Desktop\FlatOut2 - Verknüpfung.lnk
[2011.11.09 19:45:20 | 000,002,268 | ---- | M] () -- C:\Users\Public\Desktop\Sony Ericsson PC Companion 2.0.lnk
[2011.11.06 15:02:28 | 000,002,286 | ---- | M] () -- C:\Users\Public\Desktop\REALTEK 11n USB Wireless LAN Utility.lnk
[2011.11.01 10:03:22 | 000,001,845 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[6 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.11.22 19:41:08 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.11.21 20:55:26 | 000,001,262 | ---- | C] () -- C:\Users\Nico\Desktop\Spybot - Search & Destroy.lnk
[2011.11.21 19:13:24 | 000,000,969 | ---- | C] () -- C:\Users\Nico\Desktop\FlatOut2 - Verknüpfung.lnk
[2011.11.09 19:45:20 | 000,002,268 | ---- | C] () -- C:\Users\Public\Desktop\Sony Ericsson PC Companion 2.0.lnk
[2011.11.06 15:02:28 | 000,002,286 | ---- | C] () -- C:\Users\Public\Desktop\REALTEK 11n USB Wireless LAN Utility.lnk
[2011.11.06 15:01:19 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe
[2011.11.01 10:03:22 | 000,001,845 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011.07.11 17:32:42 | 001,456,640 | ---- | C] () -- C:\Program Files (x86)\Common Files\Falk Navi-Manager.msi
[2011.06.30 10:10:07 | 000,390,588 | ---- | C] () -- C:\Windows\SysWow64\sig.bin
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.01.17 21:19:53 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll
[2011.01.05 11:58:40 | 002,463,976 | ---- | C] () -- C:\Windows\SysWow64\NPSWF32.dll
[2011.01.04 11:43:33 | 000,000,000 | ---- | C] () -- C:\Users\Nico\AppData\Local\rx_image32.Cache
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2011.11.20 20:09:43 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\BOM
[2011.07.24 17:44:41 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\DVDVideoSoft
[2011.07.24 17:30:48 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.01.25 10:41:52 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\FreeFLVConverter
[2011.08.17 21:25:42 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\GHISLER
[2010.12.13 20:39:46 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\gtk-2.0
[2010.12.08 16:50:23 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\InterTrust
[2011.09.09 19:30:10 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Jumping Bytes
[2010.12.05 20:54:14 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Leadertech
[2011.06.27 11:42:18 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\PeaZip
[2011.08.16 11:03:46 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Scooter Software
[2010.12.08 16:28:43 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Windows Live Writer
[2011.01.06 11:54:37 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Winter Sports 2011
[2011.02.03 17:13:30 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Z-Software
[2011.11.23 16:24:00 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
         
--- --- ---

Alt 27.11.2011, 12:52   #8
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
BOO/Shertwil.L in Bootsektor gefunden! - Standard

BOO/Shertwil.L in Bootsektor gefunden!



Sry aber die Anleitung musst du schon richtig umsetzen
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 27.11.2011, 13:08   #9
trinova
 
BOO/Shertwil.L in Bootsektor gefunden! - Standard

BOO/Shertwil.L in Bootsektor gefunden!



Ich weiß nicht was ich falsch mach. Wenn ich den Text reinkopiere kommt bei OTL nach einer kurzen Programmluiafzeit die Fehlermeldung: OUT OF TIME?

Woran kanns liegen?

Antwort

Themen zu BOO/Shertwil.L in Bootsektor gefunden!
anti-malware, avira, bootsektor, dateien, datensicherung, datenträger, downloader, escan, eset, explorer, folge, found, malwarebytes, mas, neustart, onlinescan, programme, recovery, search, service, spybot, trojan, variant, version, win32/inject.ndt, win32/softonicdownloader.a, worm



Ähnliche Themen: BOO/Shertwil.L in Bootsektor gefunden!


  1. Dank an Bootsektor
    Lob, Kritik und Wünsche - 27.10.2013 (1)
  2. Trojaner im Bootsektor
    Plagegeister aller Art und deren Bekämpfung - 21.10.2012 (32)
  3. BOO/Dosump.A im Bootsektor gefunden
    Log-Analyse und Auswertung - 05.04.2012 (1)
  4. BOO/Shertwil.L in (allen) Bootsektoren gefunden
    Plagegeister aller Art und deren Bekämpfung - 01.12.2011 (22)
  5. BOO/Shertwil.L in (allen) Bootsektoren gefunden
    Log-Analyse und Auswertung - 19.11.2011 (1)
  6. Bootsektor-Virus Boo/TDss.M gefunden, Rechner nur im abgesicherten Modus verwendbar
    Log-Analyse und Auswertung - 18.10.2011 (2)
  7. Bootsektor Virus?
    Log-Analyse und Auswertung - 22.07.2011 (18)
  8. BOO/Alureon.A Bootsektor Virus gefunden von Antivir
    Plagegeister aller Art und deren Bekämpfung - 18.10.2010 (11)
  9. Bootsektor war weg
    Log-Analyse und Auswertung - 26.04.2007 (1)
  10. Virus im Bootsektor
    Plagegeister aller Art und deren Bekämpfung - 08.12.2004 (9)

Zum Thema BOO/Shertwil.L in Bootsektor gefunden! - Seit vorigen Freitag wird bei mir von AVIRA im Masterbootsektor und in Bootsektor HD folgendes gefunden: BOO/Shertwil.L Entfernen wird angeboten. Nach Neustart ist er trotzdem wieder da. Malwarebytes hat folgendes - BOO/Shertwil.L in Bootsektor gefunden!...
Archiv
Du betrachtest: BOO/Shertwil.L in Bootsektor gefunden! auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.