Aus sicherheitsgründen wurde Ihr System blockiert

Geniu · 27.12.2011, 14:44

Guten Tag,

ich gehe chronologisch vor um ein gutes Gesamtbild zu liefern:
<<
Zuerst bemerkte ich vor ca 2 Wochen das die Internetverbindung unseres System (mehrere PCs an einem Homenetzwerk mit einer Internetverbindung) langsamer wurde und öfters die Verbindung zum Internet verlor.

Daraufhin bekamen wir einen Brief von unserem Internetanbieter mit dem Hinweis darauf, dass unser System mit einem Zlob.DNSChanger Trojaner infiziert ist. Ich konnte diesen jedoch nicht lokalisieren und habe nachdem das Problem vorerst nichtmehr auftrat darauf verzichtet weitere Schritte einzuleiten.

Gestern bekamen wir erneut eine EMail mit dem Hinweis "von ihrem System aus wird auf fremde Rechner zugegriffen" (sinngemäß)

Danach sufter ich gerade im Internet als plötzlich mein Bildschirm schwarz wurde und ich die in diesem Forum schon öfters genannte Meldung:
"Aus sicherheitsgründen wurde Ihr System blockiert... zahlen sie 50€ und die Viren/Trojaner werden sofort gelöscht" (Sinngemäßes Zitat)
erschien. Diese Meldung lässt sich nicht umgehen (ALT+F4, Esc, Task Manager (kommt nicht in den Vordergrund))
Diese Meldung tritt mit Internetvebindung nach dem Systemstart auf und deshalb kann man nichtmehr arbeiten. OHNE INTERNETVERBINDUNG tritt sie nicht auf und der Rechner läuft normal.

>>

Ich fürchte Leider das dies nicht alles in direktem Zusammenhang zueinander steht.
Ich konnte jedoch schon ausmachen, dass sich in meinem Startup ("msconfig" Systemstartprogramme) eine iexplorer.exe immer wieder aktiviert, auch dann, wenn ich sie kurz zuvor aus dem Autostart entfernt hatte.

Zitat:

Ich habe mich an die Diagnoseanweisungen gehalten:
Betriebssystem: Microsoft Windows Vista 64-bit
Internetverbindung habe ich getrennt (Kabel raus)

1.Defogger ausgeführt

2.OTL mit eurem Scan Code ausgeführt:
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 27.12.2011 14:08:20 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = H:\
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4.00 Gb Total Physical Memory | 2.48 Gb Available Physical Memory | 62.05% Memory free
8.20 Gb Paging File | 6.22 Gb Available in Paging File | 75.79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 339.17 Gb Total Space | 62.64 Gb Free Space | 18.47% Space Free | Partition Type: NTFS
Unable to calculate disk information.
Drive G: | 257.00 Gb Total Space | 6.74 Gb Free Space | 2.62% Space Free | Partition Type: NTFS
Drive H: | 7.45 Gb Total Space | 7.45 Gb Free Space | 99.99% Space Free | Partition Type: FAT32
 
Computer Name: PUPUTHEGREY | User Name: Shorschy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - File not found -- 
PRC - [2011.12.27 13:46:08 | 000,584,192 | ---- | M] (OldTimer Tools) -- H:\OTL.exe
PRC - [2011.08.01 09:28:16 | 000,124,480 | ---- | M] (ICQ, LLC.) -- G:\Programme\ICQ7.5\ICQ.exe
PRC - [2011.07.28 16:50:28 | 000,049,664 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MMLoadDrv.exe
PRC - [2011.07.06 16:46:06 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.04.27 14:20:03 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2010.12.16 16:24:53 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.12.11 14:12:51 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2009.04.11 08:10:17 | 000,067,584 | ---- | M] () -- C:\Users\Shorschy\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe
PRC - [2009.02.19 03:00:00 | 000,077,824 | ---- | M] () -- C:\Program Files (x86)\Logitech\SetPoint\x86\SetPoint32.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.09.27 06:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 06:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009.04.11 08:10:17 | 000,067,584 | ---- | M] () -- C:\Users\Shorschy\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe
MOD - [2009.02.19 03:00:00 | 000,077,824 | ---- | M] () -- C:\Program Files (x86)\Logitech\SetPoint\x86\SetPoint32.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011.07.28 22:35:34 | 000,204,288 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.10.30 08:43:28 | 000,073,728 | ---- | M] (Tablet Driver) [Auto | Running] -- C:\Windows\SysNative\Drivers\WTSRV.EXE -- (WinTabService)
SRV:64bit: - [2009.05.20 21:27:43 | 000,841,984 | ---- | M] (TuneUp Software) [Disabled | Stopped] -- C:\Windows\SysNative\TUProgSt.exe -- (TuneUp.ProgramStatisticsSvc)
SRV:64bit: - [2009.05.20 21:27:39 | 000,506,624 | ---- | M] (TuneUp Software) [Disabled | Stopped] -- C:\Windows\SysNative\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV:64bit: - [2009.04.27 13:21:36 | 000,035,072 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysNative\uxtuneup.dll -- (UxTuneUp)
SRV:64bit: - [2007.04.20 12:24:32 | 000,566,704 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxblcoms.exe -- (lxbl_device)
SRV - [2011.08.15 15:18:12 | 002,329,480 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2011.07.06 16:46:06 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.04.27 14:20:03 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.12.11 14:12:51 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009.04.27 13:21:36 | 000,028,928 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysWOW64\uxtuneup.dll -- (UxTuneUp)
SRV - [2009.03.30 05:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.02.18 23:39:26 | 000,160,784 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2007.04.20 12:24:20 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWow64\lxblcoms.exe -- (lxbl_device)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011.07.28 23:23:16 | 009,980,416 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2011.07.28 23:23:16 | 009,980,416 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011.07.28 21:54:10 | 000,309,248 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011.07.06 16:46:07 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.07.06 16:46:07 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\DRIVERS\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.06.06 23:06:48 | 000,090,128 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdLH6.sys -- (AtiHDAudioService)
DRV:64bit: - [2011.05.10 07:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.03.30 00:00:20 | 000,254,528 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2009.10.01 01:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2009.09.23 09:42:58 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\hamachi.sys -- (hamachi)
DRV:64bit: - [2009.07.27 17:03:21 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\atksgt.sys -- (atksgt)
DRV:64bit: - [2009.07.27 17:03:20 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2009.06.05 10:42:28 | 000,021,504 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\netaapl64.sys -- (Netaapl)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.03.18 15:51:30 | 000,868,848 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\Drivers\sptd.sys -- (sptd)
DRV:64bit: - [2009.01.19 19:32:22 | 000,334,344 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\acedrv11.sys -- (acedrv11)
DRV:64bit: - [2008.12.18 22:47:30 | 000,041,488 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\LUsbFilt.Sys -- (LUsbFilt)
DRV:64bit: - [2008.12.18 22:47:18 | 000,057,872 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2008.12.18 22:47:10 | 000,055,312 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2008.12.16 15:46:12 | 000,533,760 | ---- | M] (Digital Camera) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\Drivers\Ca1528av.sys -- (Ca1528av)
DRV:64bit: - [2008.09.17 15:14:00 | 000,012,744 | R--- | M] (EnTech Taiwan) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ENTECH64.sys -- (ENTECH64)
DRV:64bit: - [2008.09.08 13:36:26 | 000,020,992 | ---- | M] (Tablet Driver) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\UCTblHid.sys -- (UCTblHid)
DRV:64bit: - [2008.06.27 16:43:02 | 000,014,848 | ---- | M] (SunPlus) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\Bulk1528.sys -- (Bulk1528)
DRV:64bit: - [2008.02.14 07:56:14 | 000,160,768 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169)
DRV:64bit: - [2008.01.21 03:47:27 | 000,903,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\xnacc.sys -- (xnacc)
DRV:64bit: - [2007.06.07 16:15:36 | 000,028,672 | ---- | M] (PenTablet Driver) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\PTSimBus.sys -- (PTSimBus)
DRV:64bit: - [2007.04.23 14:28:40 | 000,014,336 | ---- | M] (PenTablet Driver) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\PTSimHid.sys -- (PTSimHid)
DRV:64bit: - [2007.04.16 13:14:42 | 000,028,160 | ---- | M] (Tablet Driver) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\TClass2k.sys -- (TClass2k)
DRV - [2008.04.23 10:42:20 | 000,075,096 | ---- | M] (Your Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\MSI\DualCoreCenter\RushTop64.sys -- (RushTopDevice2)
DRV - [2008.02.27 08:22:28 | 000,040,248 | ---- | M] (MICRO-STAR INT'L CO., LTD.) [Kernel | On_Demand | Stopped] -- C:\Programme\MSI\DualCoreCenter\NTGLM7X64.sys -- (DualCoreCenter)
DRV - [2007.09.07 14:55:04 | 000,012,744 | ---- | M] (EnTech Taiwan) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\Entech64.sys -- (ENTECH64)
DRV - [2007.02.07 19:27:46 | 000,014,104 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | Boot | Running] -- C:\Windows\SysWOW64\speedfan.sys -- (speedfan)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaultthis.engineName: "Google"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?btnG=Google+Search&q="
FF - prefs.js..browser.search.order.1: "Google"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=382950&ilc=12"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://cojobo.net/~g_urff"
FF - prefs.js..extensions.enabledItems: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.16
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.1.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?sourceid=navclient&hl=de&q="
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files (x86)\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.09 12:25:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.08.28 21:45:38 | 000,000,000 | ---D | M]
 
[2008.12.17 21:05:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Shorschy\AppData\Roaming\mozilla\Extensions
[2011.12.15 22:33:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Shorschy\AppData\Roaming\mozilla\Firefox\Profiles\wgzoezlb.default\extensions
[2010.05.24 14:17:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Shorschy\AppData\Roaming\mozilla\Firefox\Profiles\wgzoezlb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.06.16 13:21:59 | 000,000,000 | ---D | M] (Live HTTP Headers) -- C:\Users\Shorschy\AppData\Roaming\mozilla\Firefox\Profiles\wgzoezlb.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}
[2011.11.24 17:27:49 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Shorschy\AppData\Roaming\mozilla\Firefox\Profiles\wgzoezlb.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010.01.27 13:15:12 | 000,000,923 | ---- | M] () -- C:\Users\Shorschy\AppData\Roaming\Mozilla\Firefox\Profiles\wgzoezlb.default\searchplugins\conduit.xml
[2011.12.23 21:34:33 | 000,001,056 | ---- | M] () -- C:\Users\Shorschy\AppData\Roaming\Mozilla\Firefox\Profiles\wgzoezlb.default\searchplugins\icqplugin.xml
[2011.11.09 12:25:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.12.04 20:42:05 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
() (No name found) -- C:\USERS\SHORSCHY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WGZOEZLB.DEFAULT\EXTENSIONS\{46551EC9-40F0-4E47-8E18-8E5CF550CFB8}.XPI
() (No name found) -- C:\USERS\SHORSCHY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WGZOEZLB.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.11.09 12:25:51 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.01 09:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 09:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2010.01.01 09:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.12.19 16:10:45 | 000,000,143 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\foxsearch.src
[2010.01.01 09:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 09:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 09:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.12.10 13:44:39 | 000,438,870 | R--- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O1 - Hosts: 127.0.0.1	www.007guard.com
O1 - Hosts: 127.0.0.1	007guard.com
O1 - Hosts: 127.0.0.1	008i.com
O1 - Hosts: 127.0.0.1	www.008k.com
O1 - Hosts: 127.0.0.1	008k.com
O1 - Hosts: 127.0.0.1	www.00hq.com
O1 - Hosts: 127.0.0.1	00hq.com
O1 - Hosts: 127.0.0.1	010402.com
O1 - Hosts: 127.0.0.1	www.032439.com
O1 - Hosts: 127.0.0.1	032439.com
O1 - Hosts: 127.0.0.1	www.0scan.com
O1 - Hosts: 127.0.0.1	0scan.com
O1 - Hosts: 127.0.0.1	1000gratisproben.com
O1 - Hosts: 127.0.0.1	www.1000gratisproben.com
O1 - Hosts: 127.0.0.1	1001namen.com
O1 - Hosts: 127.0.0.1	www.1001namen.com
O1 - Hosts: 127.0.0.1	100888290cs.com
O1 - Hosts: 127.0.0.1	www.100888290cs.com
O1 - Hosts: 127.0.0.1	www.100sexlinks.com
O1 - Hosts: 127.0.0.1	100sexlinks.com
O1 - Hosts: 127.0.0.1	10sek.com
O1 - Hosts: 127.0.0.1	www.10sek.com
O1 - Hosts: 127.0.0.1	www.1-2005-search.com
O1 - Hosts: 15096 more lines...
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - G:\Programme\Free Download Manager\iefdm2.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [ICQ] G:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [iexploer.exe] C:\Users\Shorschy\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O8:64bit: - Extra context menu item: Alles mit FDM herunterladen - G:\Programme\Free Download Manager\dlall.htm ()
O8:64bit: - Extra context menu item: Auswahl mit FDM herunterladen - G:\Programme\Free Download Manager\dlselected.htm ()
O8:64bit: - Extra context menu item: Datei mit FDM herunterladen - G:\Programme\Free Download Manager\dllink.htm ()
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Shorschy\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Shorschy\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Videos mit FDM herunterladen - G:\Programme\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Alles mit FDM herunterladen - G:\Programme\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Auswahl mit FDM herunterladen - G:\Programme\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Datei mit FDM herunterladen - G:\Programme\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\Shorschy\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Shorschy\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Videos mit FDM herunterladen - G:\Programme\Free Download Manager\dlfvideo.htm ()
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - G:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - G:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 10.1.0)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} https://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.21.0.cab (Battlefield Heroes Updater)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{43F9E8BA-5054-40CE-B4BE-007CDA718DE7}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Shorschy\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Shorschy\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.08.28 13:08:39 | 000,000,000 | ---D | M] - G:\AUTORUN -- [ NTFS ]
O33 - MountPoints2\{1ae2e9e9-fae1-11df-835e-002185617c03}\Shell\AutoRun\command - "" = I:\autorun.bat
O33 - MountPoints2\{3947d88c-1af4-11df-8b1f-002185617c03}\Shell\AutoRun\command - "" = Speedport_W_101_Stick.exe
O33 - MountPoints2\{428bc02a-59eb-11e0-a782-002185617c03}\Shell - "" = AutoRun
O33 - MountPoints2\{428bc02a-59eb-11e0-a782-002185617c03}\Shell\AutoRun\command - "" = E:\S3\Autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.2
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.2
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
NetSvcs:64bit: UxTuneUp - C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ZyAIR USB.lnk -  - File not found
MsConfig:64bit - StartUpFolder: C:^Users^Shorschy^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma.lnk - C:\PROGRA~2\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE - (Adobe Systems, Inc.)
MsConfig:64bit - StartUpFolder: C:^Users^Shorschy^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Media Player.lnk -  - File not found
MsConfig:64bit - StartUpFolder: C:^Users^Shorschy^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk - G:\Programme\Xfire\Xfire.exe - (Xfire Inc.)
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: AdobeAAMUpdater-1.0 - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: AdobeCS5.5ServiceManager - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: APSDaemon - hkey= - key= - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - hkey= - key= - C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
MsConfig:64bit - StartUpReg: Core Temp - hkey= - key= - C:\CoreTemp\Core Temp.exe ()
MsConfig:64bit - StartUpReg: iexploer.exe - hkey= - key= - C:\Users\Shorschy\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe ()
MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: JP595IR86O - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: Kernel and Hardware Abstraction Layer - hkey= - key= - C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
MsConfig:64bit - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
MsConfig:64bit - StartUpReg: Metropolis - hkey= - key= - C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: SearchSettings - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: Steam - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig:64bit - StartUpReg: SwitchBoard - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: WMPNSCFG - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: WTClient - hkey= - key= - C:\Windows\SysWow64\WTClient.exe (Tablet Driver)
MsConfig:64bit - State: "services" - Reg Error: Key error.
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.12.25 22:40:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011.12.25 22:40:04 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011.12.25 22:40:03 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011.12.25 22:40:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2011.12.25 17:59:12 | 000,000,000 | ---D | C] -- C:\Users\Shorschy\Desktop\DSndFX
[2011.12.25 14:08:20 | 000,000,000 | ---D | C] -- C:\Users\Shorschy\Desktop\Sounds
[2011.12.24 15:30:28 | 000,000,000 | ---D | C] -- C:\AECS5COMMONPATH
[2011.12.24 15:30:26 | 000,000,000 | ---D | C] -- C:\CS5AEPRESETSFOLDER
[2011.12.24 15:26:53 | 000,000,000 | ---D | C] -- C:\Users\Shorschy\Desktop\[SquishDesigns] Trapcode Particular 2.1 For CS5
[2011.12.24 14:56:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trapcode Particular
[2011.12.23 18:47:48 | 000,000,000 | ---D | C] -- C:\Users\Shorschy\Desktop\13
[2011.12.23 17:49:34 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2011.12.23 17:47:25 | 000,000,000 | ---D | C] -- C:\adobeTemp
[2011.12.23 16:10:02 | 000,000,000 | ---D | C] -- C:\Users\Shorschy\Desktop\Adobe After Effects CS5.5
[2011.12.22 17:19:57 | 000,000,000 | ---D | C] -- C:\Users\Shorschy\Desktop\Plätzchen 2011
[2011.12.17 02:41:27 | 000,000,000 | ---D | C] -- C:\Users\Shorschy\Desktop\Scans
[2011.12.15 14:44:34 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2011.12.15 14:44:27 | 000,559,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll
[2011.12.15 14:44:27 | 000,429,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2011.12.15 14:44:17 | 000,759,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2011.12.15 14:44:17 | 000,590,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2011.12.15 14:44:17 | 000,485,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2011.12.15 14:44:17 | 000,478,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011.12.15 14:44:17 | 000,422,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2011.12.15 14:44:17 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2011.12.15 14:44:17 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2011.12.15 14:44:17 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2011.12.15 14:44:17 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2011.12.15 14:44:17 | 000,108,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2011.12.15 14:44:17 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2011.12.14 19:30:06 | 000,000,000 | ---D | C] -- C:\Users\Shorschy\Desktop\10TIHAL
[2011.12.14 18:59:42 | 000,000,000 | ---D | C] -- C:\Users\Shorschy\Documents\ANNO 2070
[2011.12.14 18:15:44 | 000,000,000 | ---D | C] -- C:\Users\Shorschy\AppData\Local\Ubisoft Game Launcher
[2011.12.14 17:23:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ubisoft
[2011.12.14 17:22:33 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_7.dll
[2011.12.14 17:22:33 | 000,518,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_7.dll
[2011.12.14 17:22:33 | 000,077,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_5.dll
[2011.12.14 17:22:33 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_5.dll
[2011.12.14 17:22:32 | 002,526,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_43.dll
[2011.12.14 17:22:32 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_43.dll
[2011.12.14 17:22:32 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_7.dll
[2011.12.14 17:22:32 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_7.dll
[2011.12.14 17:22:30 | 001,907,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_43.dll
[2011.12.14 17:22:30 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_43.dll
[2011.12.14 17:22:30 | 000,276,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_43.dll
[2011.12.14 17:22:30 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_43.dll
[2011.12.14 17:22:29 | 002,401,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_43.dll
[2011.12.14 17:22:29 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_43.dll
[2011.12.14 17:22:29 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_43.dll
[2011.12.14 17:22:29 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_43.dll
[2011.12.14 17:22:28 | 000,530,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_6.dll
[2011.12.14 17:22:28 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_6.dll
[2011.12.14 17:22:28 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_6.dll
[2011.12.14 17:22:28 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_6.dll
[2011.12.14 17:22:28 | 000,078,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_4.dll
[2011.12.14 17:22:28 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_4.dll
[2011.12.14 17:22:28 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_7.dll
[2011.12.14 17:22:28 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_7.dll
[2011.12.06 16:10:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sweex
[2011.12.06 16:10:10 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\TabletPmt
[2011.12.06 16:10:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SWEEX
[2011.11.28 21:22:59 | 000,627,600 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\deployJava1.dll
[2011.11.28 21:22:59 | 000,252,296 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2011.11.28 21:22:59 | 000,188,808 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2011.11.28 21:22:59 | 000,188,808 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2011.11.28 20:47:31 | 034,510,329 | ---- | C] (Adobe Systems, Inc.) -- C:\Users\Shorschy\Desktop\FILM3.exe
[2009.01.07 19:06:05 | 001,224,704 | ---- | C] ( ) -- C:\Windows\SysWow64\lxblserv.dll
[2009.01.07 19:06:05 | 000,995,328 | ---- | C] ( ) -- C:\Windows\SysWow64\lxblusb1.dll
[2009.01.07 19:06:05 | 000,696,320 | ---- | C] ( ) -- C:\Windows\SysWow64\lxblhbn3.dll
[2009.01.07 19:06:05 | 000,684,032 | ---- | C] ( ) -- C:\Windows\SysWow64\lxblcomc.dll
[2009.01.07 19:06:05 | 000,643,072 | ---- | C] ( ) -- C:\Windows\SysWow64\lxblpmui.dll
[2009.01.07 19:06:05 | 000,585,728 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbllmpm.dll
[2009.01.07 19:06:05 | 000,537,520 | ---- | C] ( ) -- C:\Windows\SysWow64\lxblcoms.exe
[2009.01.07 19:06:05 | 000,421,888 | ---- | C] ( ) -- C:\Windows\SysWow64\lxblcomm.dll
[2009.01.07 19:06:05 | 000,413,696 | ---- | C] ( ) -- C:\Windows\SysWow64\lxblinpa.dll
[2009.01.07 19:06:05 | 000,397,312 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbliesc.dll
[2009.01.07 19:06:05 | 000,385,968 | ---- | C] ( ) -- C:\Windows\SysWow64\lxblih.exe
[2009.01.07 19:06:05 | 000,381,872 | ---- | C] ( ) -- C:\Windows\SysWow64\lxblcfg.exe
[2009.01.07 19:06:05 | 000,181,168 | ---- | C] ( ) -- C:\Windows\SysWow64\lxblppls.exe
[2009.01.07 19:06:05 | 000,163,840 | ---- | C] ( ) -- C:\Windows\SysWow64\lxblprox.dll
[2009.01.07 19:06:05 | 000,094,208 | ---- | C] ( ) -- C:\Windows\SysWow64\lxblpplc.dll
[2004.11.24 20:25:52 | 000,335,872 | ---- | C] ( ) -- C:\Windows\SysWow64\drvc.dll
[7 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[5 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
[4 C:\Users\Shorschy\AppData\Local\*.tmp files -> C:\Users\Shorschy\AppData\Local\*.tmp -> ]
[21 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[21 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[11 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.12.27 14:05:50 | 001,445,310 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.12.27 14:05:50 | 000,628,504 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.12.27 14:05:50 | 000,595,798 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.12.27 14:05:50 | 000,126,248 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.12.27 14:05:50 | 000,103,872 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.12.27 14:00:24 | 000,000,534 | ---- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job
[2011.12.27 14:00:12 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.12.27 14:00:06 | 000,003,712 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.27 14:00:06 | 000,003,712 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.27 13:59:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.27 13:59:14 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011.12.27 13:58:51 | 000,000,020 | ---- | M] () -- C:\Users\Shorschy\defogger_reenable
[2011.12.27 03:40:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.12.26 16:49:03 | 000,280,736 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2011.12.26 16:49:03 | 000,280,736 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.12.26 16:47:14 | 000,215,128 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2011.12.26 13:29:01 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2011.12.25 22:40:43 | 000,001,694 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011.12.25 22:33:08 | 209,715,200 | ---- | M] () -- C:\Users\Shorschy\Desktop\DSndFX.part06.rar
[2011.12.25 21:34:13 | 190,257,899 | ---- | M] () -- C:\Users\Shorschy\Desktop\DSndFX.part07.rar
[2011.12.25 19:30:41 | 209,715,200 | ---- | M] () -- C:\Users\Shorschy\Desktop\DSndFX.part05.rar
[2011.12.25 19:03:53 | 000,138,752 | ---- | M] () -- C:\Users\Shorschy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.12.25 18:53:49 | 101,200,044 | ---- | M] () -- C:\Users\Shorschy\Desktop\DSndFX.part04.rar
[2011.12.25 18:24:24 | 209,715,200 | ---- | M] () -- C:\Users\Shorschy\Desktop\DSndFX.part03.rar
[2011.12.25 18:08:25 | 209,715,200 | ---- | M] () -- C:\Users\Shorschy\Desktop\DSndFX.part02.rar
[2011.12.25 15:56:27 | 209,715,200 | ---- | M] () -- C:\Users\Shorschy\Desktop\DSndFX.part01.rar
[2011.12.24 15:26:38 | 006,368,744 | ---- | M] () -- C:\Users\Shorschy\Desktop\[SquishDesigns] Trapcode Particular 2.1 For CS5.zip
[2011.12.24 02:03:05 | 004,830,216 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.12.23 18:47:27 | 000,355,747 | ---- | M] () -- C:\Users\Shorschy\Desktop\13.zip
[2011.12.23 00:08:52 | 011,480,728 | ---- | M] () -- C:\Users\Shorschy\Desktop\Crunkin' Bass Beats - DJ Billy E.wmv.mp3
[2011.12.22 23:59:56 | 014,038,546 | ---- | M] () -- C:\Users\Shorschy\Desktop\Feed Me - Blood Red.mp3
[2011.12.21 13:26:49 | 008,296,359 | ---- | M] () -- C:\Users\Shorschy\Desktop\uebung9_helmoltz_spulen.pdf
[2011.12.18 12:04:10 | 000,034,190 | ---- | M] () -- C:\Users\Shorschy\Desktop\OpermusicalTheater.odt
[2011.12.17 02:39:38 | 006,015,442 | ---- | M] () -- C:\Users\Shorschy\Desktop\Scans.zip
[2011.12.15 17:00:14 | 002,359,664 | ---- | M] () -- C:\Users\Shorschy\Desktop\arbeit_mathe.pdf
[2011.12.14 15:53:31 | 000,001,744 | ---- | M] () -- C:\Users\Shorschy\Desktop\f8862c54379ed21e21ed459680435e88.ccf
[2011.12.10 13:44:39 | 000,438,870 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2011.12.07 14:26:43 | 000,001,356 | ---- | M] () -- C:\Users\Shorschy\AppData\Local\d3d9caps.dat
[2011.12.06 16:26:05 | 000,003,092 | ---- | M] () -- C:\Windows\Tablet8000x5000M.ini
[2011.12.01 22:35:49 | 000,715,562 | ---- | M] () -- C:\Users\Shorschy\Desktop\polarisation.pdf
[2011.11.28 21:22:19 | 000,627,600 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\deployJava1.dll
[2011.11.28 21:22:19 | 000,252,296 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2011.11.28 21:22:19 | 000,188,808 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2011.11.28 21:22:19 | 000,188,808 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2011.11.28 20:49:05 | 034,510,329 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Shorschy\Desktop\FILM3.exe
[2011.11.27 16:52:27 | 106,625,647 | ---- | M] () -- C:\Users\Shorschy\Desktop\Herbert-Groenemeyer---Schiffsverkehr--Special-Edition-.rar
[7 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[5 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
[4 C:\Users\Shorschy\AppData\Local\*.tmp files -> C:\Users\Shorschy\AppData\Local\*.tmp -> ]
[21 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[21 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[11 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.12.27 13:58:51 | 000,000,020 | ---- | C] () -- C:\Users\Shorschy\defogger_reenable
[2011.12.25 22:40:43 | 000,001,694 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011.12.25 22:23:37 | 209,715,200 | ---- | C] () -- C:\Users\Shorschy\Desktop\DSndFX.part06.rar
[2011.12.25 21:25:34 | 190,257,899 | ---- | C] () -- C:\Users\Shorschy\Desktop\DSndFX.part07.rar
[2011.12.25 19:19:43 | 209,715,200 | ---- | C] () -- C:\Users\Shorschy\Desktop\DSndFX.part05.rar
[2011.12.25 18:32:19 | 101,200,044 | ---- | C] () -- C:\Users\Shorschy\Desktop\DSndFX.part04.rar
[2011.12.25 18:10:05 | 209,715,200 | ---- | C] () -- C:\Users\Shorschy\Desktop\DSndFX.part03.rar
[2011.12.25 17:58:51 | 209,715,200 | ---- | C] () -- C:\Users\Shorschy\Desktop\DSndFX.part02.rar
[2011.12.25 15:44:39 | 209,715,200 | ---- | C] () -- C:\Users\Shorschy\Desktop\DSndFX.part01.rar
[2011.12.24 15:25:45 | 006,368,744 | ---- | C] () -- C:\Users\Shorschy\Desktop\[SquishDesigns] Trapcode Particular 2.1 For CS5.zip
[2011.12.23 18:47:25 | 000,355,747 | ---- | C] () -- C:\Users\Shorschy\Desktop\13.zip
[2011.12.23 17:49:42 | 000,000,916 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe After Effects CS5.5.lnk
[2011.12.23 17:49:12 | 000,000,820 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Media Encoder CS5.5.lnk
[2011.12.23 17:48:33 | 000,001,368 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Pixel Bender Toolkit 2.6.lnk
[2011.12.23 00:08:32 | 011,480,728 | ---- | C] () -- C:\Users\Shorschy\Desktop\Crunkin' Bass Beats - DJ Billy E.wmv.mp3
[2011.12.22 23:59:37 | 014,038,546 | ---- | C] () -- C:\Users\Shorschy\Desktop\Feed Me - Blood Red.mp3
[2011.12.21 13:25:07 | 008,296,359 | ---- | C] () -- C:\Users\Shorschy\Desktop\uebung9_helmoltz_spulen.pdf
[2011.12.18 10:47:52 | 000,034,190 | ---- | C] () -- C:\Users\Shorschy\Desktop\OpermusicalTheater.odt
[2011.12.17 02:38:58 | 006,015,442 | ---- | C] () -- C:\Users\Shorschy\Desktop\Scans.zip
[2011.12.14 16:30:39 | 002,359,664 | ---- | C] () -- C:\Users\Shorschy\Desktop\arbeit_mathe.pdf
[2011.12.14 15:53:29 | 000,001,744 | ---- | C] () -- C:\Users\Shorschy\Desktop\f8862c54379ed21e21ed459680435e88.ccf
[2011.12.06 16:26:05 | 000,003,092 | ---- | C] () -- C:\Windows\Tablet8000x5000M.ini
[2011.12.01 22:35:49 | 000,715,562 | ---- | C] () -- C:\Users\Shorschy\Desktop\polarisation.pdf
[2011.11.27 16:39:39 | 106,625,647 | ---- | C] () -- C:\Users\Shorschy\Desktop\Herbert-Groenemeyer---Schiffsverkehr--Special-Edition-.rar
[2011.08.26 23:21:30 | 000,042,392 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll
[2011.08.15 22:30:50 | 000,040,960 | ---- | C] () -- C:\Windows\SysWow64\psfind.dll
[2011.08.10 23:12:19 | 000,000,132 | ---- | C] () -- C:\Users\Shorschy\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2011.08.10 23:12:01 | 000,000,132 | ---- | C] () -- C:\Users\Shorschy\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011.07.18 17:33:50 | 000,000,043 | ---- | C] () -- C:\Windows\SIERRA.INI
[2011.07.17 22:54:02 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.05.27 20:25:57 | 000,043,520 | ---- | C] () -- C:\Windows\SysWow64\CmdLineExt03.dll
[2011.03.23 14:49:02 | 000,004,352 | ---- | C] () -- C:\Windows\SysWow64\drivers\TF0801.sys
[2011.03.17 18:51:44 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.03.14 20:39:13 | 000,007,933 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2010.12.29 14:48:32 | 000,014,115 | ---- | C] () -- C:\Windows\twspmm.ini
[2010.12.26 15:02:15 | 000,111,932 | ---- | C] () -- C:\Windows\SysWow64\EPPICPrinterDB.dat
[2010.12.26 15:02:15 | 000,031,053 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern131.dat
[2010.12.26 15:02:15 | 000,027,417 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern121.dat
[2010.12.26 15:02:15 | 000,026,154 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern1.dat
[2010.12.26 15:02:15 | 000,024,903 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern3.dat
[2010.12.26 15:02:15 | 000,021,390 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern5.dat
[2010.12.26 15:02:15 | 000,020,148 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern2.dat
[2010.12.26 15:02:15 | 000,011,811 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern4.dat
[2010.12.26 15:02:15 | 000,004,943 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern6.dat
[2010.12.26 15:02:15 | 000,001,146 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_DU.dat
[2010.12.26 15:02:15 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_PT.dat
[2010.12.26 15:02:15 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_BP.dat
[2010.12.26 15:02:15 | 000,001,136 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_ES.dat
[2010.12.26 15:02:15 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_FR.dat
[2010.12.26 15:02:15 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_CF.dat
[2010.12.26 15:02:15 | 000,001,120 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_IT.dat
[2010.12.26 15:02:15 | 000,001,107 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_GE.dat
[2010.12.26 15:02:15 | 000,001,104 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_EN.dat
[2010.12.26 15:02:15 | 000,000,097 | ---- | C] () -- C:\Windows\SysWow64\PICSDK.ini
[2010.12.06 16:04:35 | 000,000,091 | ---- | C] () -- C:\Windows\wininit.ini
[2010.09.27 23:11:42 | 000,089,180 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2010.03.28 16:49:48 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2010.03.23 16:41:52 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe
[2009.12.03 15:35:58 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009.12.03 15:35:31 | 000,107,612 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchema.bin
[2009.12.03 15:35:02 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.10.30 09:11:48 | 000,204,800 | ---- | C] () -- C:\Windows\SysWow64\WinTab32.dll
[2009.10.17 20:27:42 | 000,000,259 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009.09.27 20:40:11 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2009.08.29 12:37:37 | 000,233,472 | ---- | C] () -- C:\Windows\SysWow64\MafiaSetup.exe
[2009.08.29 12:35:19 | 000,233,472 | ---- | C] () -- C:\Users\Shorschy\AppData\Roaming\MafiaSetup.exe
[2009.06.30 19:37:21 | 000,061,440 | ---- | C] () -- C:\Windows\SysWow64\ZDTRLib.DLL
[2009.06.30 19:37:21 | 000,049,152 | ---- | C] () -- C:\Windows\SysWow64\ZD12APP.dll
[2009.06.30 19:37:21 | 000,040,960 | ---- | C] () -- C:\Windows\SysWow64\PassAPP.dll
[2009.06.30 19:37:21 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\INSAPP.dll
[2009.06.30 19:37:21 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\ZyDelReg.exe
[2009.06.30 19:37:21 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\InsDrvZD.dll
[2009.06.30 18:23:20 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2009.06.23 17:11:20 | 003,107,788 | ---- | C] () -- C:\Windows\SysWow64\atiumdva.dat
[2009.05.07 16:00:30 | 000,000,760 | ---- | C] () -- C:\Users\Shorschy\AppData\Roaming\setup_ldm.iss
[2009.04.21 23:19:06 | 000,172,173 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2009.01.11 21:12:34 | 000,280,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2009.01.11 21:12:33 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2009.01.11 21:12:32 | 000,000,310 | ---- | C] () -- C:\Windows\game.ini
[2009.01.07 19:06:05 | 000,385,024 | ---- | C] () -- C:\Windows\SysWow64\lxblcomx.dll
[2009.01.07 19:06:05 | 000,274,432 | ---- | C] () -- C:\Windows\SysWow64\LXBLinst.dll
[2009.01.02 12:03:15 | 000,052,456 | ---- | C] () -- C:\Windows\War3Unin.dat
[2008.12.28 10:35:13 | 000,001,100 | ---- | C] () -- C:\Users\Shorschy\AppData\Local\d3d8caps.dat
[2008.12.23 22:30:15 | 000,003,972 | ---- | C] () -- C:\Windows\SysWow64\drivers\PciBus.sys
[2008.12.23 17:12:19 | 000,138,752 | ---- | C] () -- C:\Users\Shorschy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.12.19 16:15:58 | 004,338,246 | ---- | C] () -- C:\Windows\SysWow64\libavcodec.dll
[2008.12.17 23:45:03 | 000,018,904 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin
[2008.12.17 23:11:58 | 000,001,356 | ---- | C] () -- C:\Users\Shorschy\AppData\Local\d3d9caps.dat
[2008.12.17 18:41:18 | 000,884,237 | ---- | C] () -- C:\Windows\SysWow64\ff_x264.dll
[2008.12.17 18:22:58 | 000,093,184 | ---- | C] () -- C:\Windows\SysWow64\ff_wmv9.dll
[2008.12.17 18:22:48 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2008.12.17 18:17:34 | 000,239,247 | ---- | C] () -- C:\Windows\SysWow64\ff_theora.dll
[2008.12.17 17:59:54 | 000,560,802 | ---- | C] () -- C:\Windows\SysWow64\libmplayer.dll
[2008.12.17 17:42:58 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2008.12.17 17:27:45 | 000,217,088 | ---- | C] () -- C:\Windows\NVGfxOgl.dll
[2008.12.17 16:59:35 | 000,000,732 | ---- | C] () -- C:\Users\Shorschy\AppData\Local\d3d9caps64.dat
[2008.10.07 08:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll
[2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll
[2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll
[2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll
[2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll
[2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll
[2008.10.07 08:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll
[2008.06.06 18:13:06 | 000,197,912 | ---- | C] () -- C:\Windows\SysWow64\physxcudart_20.dll
[2008.02.08 17:03:43 | 000,516,096 | ---- | C] () -- C:\Windows\SysWow64\RegisterDialog.dll
[2008.01.21 03:50:05 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2006.11.02 17:10:16 | 000,080,912 | ---- | C] () -- C:\Windows\SysWow64\sherlock2.exe
[2006.11.02 16:37:05 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:37:14 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2006.11.02 13:24:17 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2006.11.02 13:18:17 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2006.11.02 10:47:54 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.10.11 04:33:58 | 000,010,288 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS
[2004.10.03 18:50:54 | 000,129,024 | ---- | C] () -- C:\Windows\SysWow64\ff_mpeg2enc.dll
[2004.05.10 14:33:46 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\lhtool.exe
[1997.06.14 09:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\iyvu9_32.dll
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2009.05.14 20:40:00 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2009.05.29 14:55:30 | 000,000,000 | ---D | M] -- C:\2926c28454527f0a023b
[2011.12.23 17:47:25 | 000,000,000 | ---D | M] -- C:\adobeTemp
[2011.12.24 15:30:28 | 000,000,000 | ---D | M] -- C:\AECS5COMMONPATH
[2009.06.24 18:09:48 | 000,000,000 | ---D | M] -- C:\ATI
[2009.12.06 11:24:32 | 000,000,000 | -HSD | M] -- C:\Boot
[2011.12.26 10:39:33 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2008.12.21 15:05:29 | 000,000,000 | ---D | M] -- C:\CoreTemp
[2009.01.30 14:34:35 | 000,000,000 | ---D | M] -- C:\CrashReport
[2011.12.24 15:30:27 | 000,000,000 | ---D | M] -- C:\CS5AEPRESETSFOLDER
[2006.11.02 16:42:17 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2008.12.17 16:57:19 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2010.06.01 17:57:42 | 000,000,000 | ---D | M] -- C:\Downloads
[2009.01.07 19:05:53 | 000,000,000 | ---D | M] -- C:\drivers
[2010.12.16 23:39:09 | 000,000,000 | ---D | M] -- C:\f82a71861d654544b6
[2008.12.17 17:09:18 | 000,000,000 | ---D | M] -- C:\Intel
[2008.01.21 04:04:13 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.12.25 22:40:04 | 000,000,000 | R--D | M] -- C:\Program Files
[2011.12.25 22:40:03 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2011.12.20 16:41:41 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2008.12.17 16:57:19 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.12.27 14:10:29 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2010.08.15 16:46:17 | 000,000,000 | R--D | M] -- C:\Users
[2011.12.24 15:02:09 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.manifest /3 >
[7 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
 
< MD5 for: AFD.SYS  >
[2011.04.21 15:20:24 | 000,405,504 | ---- | M] (Microsoft Corporation) MD5=0CC146C4ADDEA45791B18B1E2659F4A9 -- C:\Windows\SysNative\drivers\afd.sys
[2011.04.21 15:20:24 | 000,405,504 | ---- | M] (Microsoft Corporation) MD5=0CC146C4ADDEA45791B18B1E2659F4A9 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18457_none_35be4fb214130ed1\afd.sys
[2009.04.11 06:44:24 | 000,406,016 | ---- | M] (Microsoft Corporation) MD5=12415CCFD3E7CEC55B5184E67B039FE4 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18005_none_35f2572213ec5bd2\afd.sys
[2011.04.21 14:54:10 | 000,405,504 | ---- | M] (Microsoft Corporation) MD5=7B8E5F3A0626CA83B706F0738830845F -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.22629_none_366a5ebb2d168a9d\afd.sys
[2011.04.21 14:42:48 | 000,407,552 | ---- | M] (Microsoft Corporation) MD5=9BB97042FA331A0FB4BDD98B9280A50A -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18639_none_33ef7c5016dab752\afd.sys
[2011.04.21 14:47:41 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=B53144D2EBB0843DD0436F5EA6953F65 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.22905_none_34958b832fe3983b\afd.sys
[2008.01.21 03:48:18 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=DB37041AB857ABC7E179E856D8E1582C -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_3406de1616ca9086\afd.sys
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_b5f700fe698beb14\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_b7eb106e66a7ac19\explorer.exe
[2008.10.29 07:15:50 | 003,087,360 | ---- | M] (Microsoft Corporation) MD5=50514057C28A74BAC2BD04B7B990D615 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_aba256ac352b2919\explorer.exe
[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_b8583e9d7fda0512\explorer.exe
[2009.04.11 08:10:17 | 003,079,168 | ---- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 -- C:\Windows\explorer.exe
[2009.04.11 08:10:17 | 003,079,168 | ---- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_afbebba22f3bab41\explorer.exe
[2008.10.28 03:30:12 | 003,086,848 | ---- | M] (Microsoft Corporation) MD5=72B9990E45C25AA3C75C4FB50A9D6CE0 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_ac5266dd4e2b0a41\explorer.exe
[2008.10.29 07:49:22 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=BBD8E74F23D7605CB0CDB57A1B25D826 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_ad96661c3246ea1e\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\SysWOW64\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_ba1365f4639c6d3c\explorer.exe
[2008.10.30 06:30:07 | 003,081,216 | ---- | M] (Microsoft Corporation) MD5=E404A65EF890140410E9F3D405841C95 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_ae03944b4b794317\explorer.exe
[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_b6a7112f828bcc3c\explorer.exe
[2008.01.21 03:48:44 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=F6D765FB6B457542D954682F50C26E4F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_add342963219dff5\explorer.exe
[2008.01.21 03:49:23 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_b827ece8667aa1f0\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2008.01.21 03:49:53 | 000,161,792 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe
[2008.01.21 03:50:29 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\SysWOW64\regedit.exe
[2008.01.21 03:50:29 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_5aa1fb3ac896d9c8\regedit.exe
[2008.01.21 03:49:53 | 000,161,792 | ---- | M] (Microsoft Corporation) MD5=5DFBCE56E689D90AE9E2FB278F80058E -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_504d50e8943617cd\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SysWOW64\userinit.exe
[2008.01.21 03:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2008.01.21 03:49:46 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\Windows\SysNative\userinit.exe
[2008.01.21 03:49:46 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_384755998a0d6941\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 03:48:04 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\SysWOW64\wininit.exe
[2008.01.21 03:48:04 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2008.01.21 03:50:23 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=117EA87DF785CA1B9D821F6F213DCE07 -- C:\Windows\SysNative\wininit.exe
[2008.01.21 03:50:23 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=117EA87DF785CA1B9D821F6F213DCE07 -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_8d115452bcae17d8\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:11:08 | 000,405,504 | ---- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A -- C:\Windows\SysNative\winlogon.exe
[2009.04.11 08:11:08 | 000,405,504 | ---- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_cdcd15a68a70b877\winlogon.exe
[2008.01.21 03:49:47 | 000,406,016 | ---- | M] (Microsoft Corporation) MD5=856491FCED98093D824B9EB2892F564A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_cbe19c9a8d4eed2b\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SysWOW64\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 03:50:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
 
<           >

< End of report >

--- --- ---

markusg · 27.12.2011, 17:18

hi
wie nett, du hast also von deinem dienste anbieter eine ernsthafte mail erhalten und dich nicht drumm gekümmert?
ist dir bewusst das du damit gefahr läufst das bestimmte dienste gespert werden, mail versand zb und du außerdem damit gefahr läufst das dein pc für spam versand und schlimmeres genutzt wird?

achtung!

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:

ATTFilter

:OTL
O4 - HKCU..\Run: [iexploer.exe] C:\Users\Shorschy\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
[7 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[5 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
[4 C:\Users\Shorschy\AppData\Local\*.tmp files -> C:\Users\Shorschy\AppData\Local\*.tmp -> ]
[21 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[21 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[11 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 :Files
C:\Users\Shorschy\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.

starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

öffne Computer, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
folge dem link, und lade das archiv im upload channel hoch
http://www.trojaner-board.de/54791-a...ner-board.html

Geniu · 27.12.2011, 18:56

Tja, ich hatte gedacht ich hätte den verseuchten PC vom Netzwerk ausgeschlossen.

Ausgeführt und im normalen Modus neugestartet.
Das Logfile:

Zitat:

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\iexploer.exe deleted successfully.
C:\Users\Shorschy\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
C:\Windows\SysWow64\ST~2B9D.tmp deleted successfully.
C:\Windows\SysWow64\ST~2B9E.tmp deleted successfully.
C:\Windows\SysWow64\ST~2BAF.tmp deleted successfully.
C:\Windows\SysWow64\ST~2BBF.tmp deleted successfully.
C:\Windows\SysWow64\ST~2BD0.tmp deleted successfully.
C:\Windows\SysWow64\ST~2BE0.tmp deleted successfully.
C:\Windows\SysWow64\ST~2BF1.tmp deleted successfully.
C:\Windows\SysNative\drivers\ST~2A5F.tmp deleted successfully.
C:\Windows\SysNative\drivers\ST~2A6F.tmp deleted successfully.
C:\Windows\SysNative\drivers\ST~2A80.tmp deleted successfully.
C:\Windows\SysNative\drivers\ST~2AD4.tmp deleted successfully.
C:\Windows\SysNative\drivers\ST~2AF6.tmp deleted successfully.
C:\Users\Shorschy\AppData\Local\MAN4F07.tmp deleted successfully.
C:\Users\Shorschy\AppData\Local\SDB4F39.tmp deleted successfully.
C:\Users\Shorschy\AppData\Local\VWL4F28.tmp deleted successfully.
C:\Users\Shorschy\AppData\Local\WLF4F29.tmp deleted successfully.
C:\ProgramData\SPL13C1.tmp deleted successfully.
C:\ProgramData\SPL1506.tmp deleted successfully.
C:\ProgramData\SPL24ED.tmp deleted successfully.
C:\ProgramData\SPL34C5.tmp deleted successfully.
C:\ProgramData\SPL3A04.tmp deleted successfully.
C:\ProgramData\SPL3F31.tmp deleted successfully.
C:\ProgramData\SPL477C.tmp deleted successfully.
C:\ProgramData\SPL47B0.tmp deleted successfully.
C:\ProgramData\SPL6DEF.tmp deleted successfully.
C:\ProgramData\SPL6FA3.tmp deleted successfully.
C:\ProgramData\SPL75AB.tmp deleted successfully.
C:\ProgramData\SPL9D.tmp deleted successfully.
C:\ProgramData\SPLACD1.tmp deleted successfully.
C:\ProgramData\SPLBAE6.tmp deleted successfully.
C:\ProgramData\SPLC956.tmp deleted successfully.
C:\ProgramData\SPLD26B.tmp deleted successfully.
C:\ProgramData\SPLE07E.tmp deleted successfully.
C:\ProgramData\SPLEBB5.tmp deleted successfully.
C:\ProgramData\SPLECED.tmp deleted successfully.
C:\ProgramData\SPLF7C.tmp deleted successfully.
C:\ProgramData\SPLFE23.tmp deleted successfully.
File delete failed. C:\Windows\SysNative\ST~2A81.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\SysNative\ST~2A91.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\SysNative\ST~2AA2.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\SysNative\ST~2AB3.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\SysNative\ST~2AB4.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\SysNative\ST~2AE4.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\SysNative\ST~2AF5.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\SysNative\ST~2B07.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\SysNative\ST~2B17.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\SysNative\ST~2B28.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\SysNative\ST~2B29.tmp scheduled to be deleted on reboot.
C:\Windows\msdownld.tmp folder deleted successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: AppData

User: Default
->Flash cache emptied: 56509 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: Shorschy
->Flash cache emptied: 3310744 bytes

Total Flash Files Cleaned = 3.00 mb

[EMPTYTEMP]

User: All Users

User: AppData

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: Shorschy
->Temp folder emptied: 7471553 bytes
->Temporary Internet Files folder emptied: 25683378 bytes
->Java cache emptied: 52804089 bytes
->FireFox cache emptied: 66432205 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 529724 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1161983 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 12266339 bytes

Total Files Cleaned = 159.00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 12272011_184317

Files\Folders moved on Reboot...
File move failed. C:\Windows\SysNative\ST~2A81.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\ST~2A91.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\ST~2AA2.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\ST~2AB3.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\ST~2AB4.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\ST~2AE4.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\ST~2AF5.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\ST~2B07.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\ST~2B17.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\ST~2B28.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\ST~2B29.tmp scheduled to be moved on reboot.

Registry entries deleted on Reboot...

markusg · 27.12.2011, 19:11

hi,
1. danke für den upload.
verstehe ich jetzt nicht, erst schreibst du:
Daraufhin bekamen wir einen Brief von unserem Internetanbieter mit dem Hinweis darauf, dass unser System mit einem Zlob.DNSChanger Trojaner infiziert ist.
Ich konnte diesen jedoch nicht lokalisieren und habe nachdem das Problem vorerst nichtmehr auftrat darauf verzichtet weitere Schritte einzuleiten.
und dann sagst du du hast den pc identiviziert?
bitte nähere infos :-)

Geniu · 27.12.2011, 19:17

Ähm *hust*
Also ich hab das Internetverhalten von nem Laptop aus beobachtet und dann die rechner der reihe nach angeschaltet und bei einem war die Verbindung beim start sofort komplett weg/ausgelastet und da hab ich geschlussfolgert das darauf der Trojaner sein müsste...
Hatte keine Zeit mich näher damit zu beschäftigen und hab es dann erstmal auf sich beruhen lassen und auch keine weiteren Probleme mehr gehabt.
Der Rechner um den du dich momentan kümmerst ist ein anderer als der den ich damals als übeltäter identifiert hatte. (damals nenn ich jetzt mal PC2)
Da ich mit dem PC2 nicht arbeite hab ich das Thema hier erstmal für das akute Problem auf dem PC1 eröffnet und werde falls sich kein Trojaner oder ähnliches findet später auch noch mit dem PC2 so verfahren.
PC2 ist also geraten und der Trojaner nicht lokalisiert
War das verständlich?, ich hoffe man kann alles nachvollziehen.

markusg · 27.12.2011, 19:21

ja wars.
wir sehen uns pc 2 dann auch noch an, nachdem wir mit dem durch sind.

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
Tool

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Hinweis:
Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Geniu · 27.12.2011, 20:34

Done:
Hier ComboFix.txt
Combofix Logfile:

Code:

ATTFilter

ComboFix 11-12-27.01 - Shorschy 27.12.2011  20:18:15.1.2 - x64
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.4094.2499 [GMT 1:00]
ausgeführt von:: c:\users\Shorschy\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Shorschy\AppData\Roaming\Microsoft\Windows\Recent\Anno 1701 - Der Fluch des Drachen.url
c:\windows\IsUn0407.exe
c:\windows\system32\java.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-11-27 bis 2011-12-27  ))))))))))))))))))))))))))))))
.
.
2011-12-27 19:24 . 2011-12-27 19:24	--------	d-----w-	c:\users\Shorschy\AppData\Local\temp
2011-12-27 19:24 . 2011-12-27 19:24	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-12-27 17:45 . 2011-12-27 17:45	69000	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{14DCBCA9-57FA-4EC1-A838-E56C80F26264}\offreg.dll
2011-12-25 21:40 . 2011-12-25 21:40	--------	d-----w-	c:\program files\iPod
2011-12-25 21:40 . 2011-12-25 21:40	--------	d-----w-	c:\program files\iTunes
2011-12-25 21:40 . 2011-12-25 21:40	--------	d-----w-	c:\program files (x86)\iTunes
2011-12-24 14:30 . 2011-12-24 14:30	--------	d-----w-	C:\AECS5COMMONPATH
2011-12-24 14:30 . 2011-12-24 14:30	--------	d-----w-	C:\CS5AEPRESETSFOLDER
2011-12-23 16:47 . 2011-12-23 16:47	--------	d-----w-	C:\adobeTemp
2011-12-23 14:24 . 2011-11-21 11:40	8822856	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{14DCBCA9-57FA-4EC1-A838-E56C80F26264}\mpengine.dll
2011-12-14 17:15 . 2011-12-15 13:57	--------	d-----w-	c:\users\Shorschy\AppData\Local\Ubisoft Game Launcher
2011-12-14 16:23 . 2011-12-14 16:23	--------	d-----w-	c:\program files (x86)\Ubisoft
2011-12-06 15:10 . 2011-12-06 15:15	--------	d-----w-	c:\windows\SysWow64\TabletPmt
2011-12-06 15:10 . 2011-12-06 15:10	--------	d-----w-	c:\program files (x86)\SWEEX
2011-11-28 20:22 . 2011-11-28 20:22	627600	----a-w-	c:\windows\system32\deployJava1.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-26 15:49 . 2009-02-28 14:10	280736	----a-w-	c:\windows\SysWow64\PnkBstrB.xtr
2011-12-26 15:49 . 2009-01-11 20:12	280736	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
2011-12-26 15:47 . 2009-01-11 20:12	215128	----a-w-	c:\windows\SysWow64\PnkBstrB.ex0
2011-11-16 11:31 . 2011-06-11 14:50	414368	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-10-13 17351304]
"ICQ"="g:\programme\ICQ7.5\ICQ.exe" [2011-08-01 124480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2010-12-16 281768]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-28 336384]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-12-08 421736]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files (x86)\Logitech\SetPoint\SetPoint.exe [2009-6-7 1200144]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
.
R2 Ca1528av;SPCA1528 Video Camera Service;c:\windows\system32\Drivers\Ca1528av.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 ATICDSDr;ATICDSDr;c:\users\Shorschy\AppData\Local\Temp\ATICDSDr.sys [x]
R3 Bulk1528;SPCA1528 Still Camera Service;c:\windows\system32\Drivers\Bulk1528.sys [x]
R3 cpuz130;cpuz130;c:\users\Shorschy\AppData\Local\Temp\cpuz130\cpuz_x64.sys [x]
R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]
R3 DualCoreCenter;DualCoreCenter;c:\programme\MSI\DualCoreCenter\NTGLM7X64.sys [2008-02-27 40248]
R3 ENTECH64;ENTECH64;c:\windows\system32\DRIVERS\ENTECH64.sys [2008-09-17 12744]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [x]
R3 PTSimHid;PenTablet Simulated HID MiniDriver;c:\windows\system32\DRIVERS\PTSimHid.sys [x]
R3 RushTopDevice2;RushTopDevice2;c:\programme\MSI\DualCoreCenter\RushTop64.sys [2008-04-23 75096]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768]
R4 gupdate1c9e36b40e38351;Google Update Service (gupdate1c9e36b40e38351);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-06-02 133104]
R4 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-06-02 133104]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-27 136360]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-15 2329480]
S2 lxbl_device;lxbl_device;c:\windows\system32\lxblcoms.exe [2007-04-20 566704]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdLH6.sys [x]
S3 PTSimBus;PenTablet Bus Enumerator;c:\windows\system32\DRIVERS\PTSimBus.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2011-12-27 c:\windows\Tasks\1-Klick-Wartung.job
- c:\program files (x86)\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 12:39]
.
2011-12-26 c:\windows\Tasks\Google Software Updater.job
- c:\program files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-12-17 13:38]
.
2011-12-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-06-02 10:16]
.
2011-12-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-06-02 10:16]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2008-11-25 6936096]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2008-11-25 1833504]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-12-18 243216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = %SystemRoot%\system32\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Alles mit FDM herunterladen - file://g:\programme\Free Download Manager\dlall.htm
IE: Auswahl mit FDM herunterladen - file://g:\programme\Free Download Manager\dlselected.htm
IE: Datei mit FDM herunterladen - file://g:\programme\Free Download Manager\dllink.htm
IE: Free YouTube Download - c:\users\Shorschy\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Shorschy\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Videos mit FDM herunterladen - file://g:\programme\Free Download Manager\dlfvideo.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - g:\programme\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 192.168.1.1
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
FF - ProfilePath - c:\users\Shorschy\AppData\Roaming\Mozilla\Firefox\Profiles\wgzoezlb.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?btnG=Google+Search&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://cojobo.net/~g_urff
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=de&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-Windows Defender - c:\program files (x86)\Windows Defender\MSASCui.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_bc2.exe
AddRemove-S3 - c:\windows\IsUn0407.exe
AddRemove-S4Uninst - c:\windows\IsUn0407.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-4015848776-3597943728-1866229362-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:4c,47,28,36,0a,1f,88,eb,f3,2a,f1,80,4b,53,e4,dd,de,03,71,76,17,55,21,
   db,09,4a,c6,bc,7a,46,14,7b,a7,f0,e8,ff,85,e4,7a,72,ff,d5,82,b0,dd,01,88,4c,\
"??"=hex:41,e0,42,8c,cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b
.
[HKEY_USERS\S-1-5-21-4015848776-3597943728-1866229362-1000\Software\SecuROM\License information*]
"datasecu"=hex:43,c3,68,52,33,6e,34,5d,c5,05,8d,c2,f4,c4,b2,61,aa,9f,6c,b3,c0,
   89,4c,81,e6,12,1d,ac,69,31,77,d1,e9,b8,c3,81,d7,ed,bd,a8,30,63,d7,6f,d8,13,\
"rkeysecu"=hex:73,42,5e,e1,80,1e,00,94,da,f5,11,e3,a6,a5,02,4e
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
Zeit der Fertigstellung: 2011-12-27  20:26:53
ComboFix-quarantined-files.txt  2011-12-27 19:26
.
Vor Suchlauf: 17 Verzeichnis(se), 62.869.336.064 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 62.825.074.688 Bytes frei
.
- - End Of File - - BEB2E6C9C5A36A51B309BD7AB1C37496

--- --- ---

markusg · 27.12.2011, 20:38

malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Geniu · 27.12.2011, 22:13

Hab eine Datei vergessen hab ich grad gesehen.
Ich Scanne grad nochmal und werd die dann auch entfernen...
Auch wenn ich mir bei eigentlich jeder dieser Dateien sicher bin das sie ungefährlich waren, nur iexplorer ist garantiert nicht ungefährlich gewesen. Aber die Datei war auf meinem Stick unter removed objekts und ich hab aus irgendeinem Grund den Stick mitgescannt

Zitat:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 911122704

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

27.12.2011 22:00:30
mbam-log-2011-12-27 (22-00-29).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|G:\|H:\|)
Durchsuchte Objekte: 466745
Laufzeit: 49 Minute(n), 32 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 6

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\Shorschy\documents\ICQ\307958995\receivedfiles\234087493 hörschel\Keygen.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.
g:\programme\cryptloader\cryptload_1.1.6\router\fritz!box\nc.exe (PUP.Netcat) -> Not selected for removal.
g:\programme\ea sports\FIFA 08\Patch\best_of_f4f_2008_bugfix1.exe (Adware.Onlinegames) -> Quarantined and deleted successfully.
g:\programme\gw visions\updater.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.
g:\programme\gw visions\Visions.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.
h:\_OTL\movedfiles\12272011_184317\C_Users\Shorschy\AppData\Roaming\microsoft\internet explorer\iexploer.exe (Trojan.Agent.BH) -> Quarantined and deleted successfully.

markusg · 28.12.2011, 12:24

c:\Users\Shorschy\documents\ICQ\307958995\receivedfiles\234087493 hörschel\Keygen.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.
wer keygens nutzt muss sich nicht über infektionen fundern.
wie du im angepinnten topic über keygens und andere illegale software lesen konntest wirst du hier nur hilfe beim formatieren und neu aufsetzen erhalten.
ich werde keine fragen mehr zum stand der infektion beantworten.

Geniu · 28.12.2011, 14:09

Die Zeiten sind zwar längst vorbei, aber da kann man dann wohl nichts machen, schade...

Aus sicherheitsgründen wurde Ihr System blockiert

Log-Analyse und Auswertung: Aus sicherheitsgründen wurde Ihr System blockiert