Windowssystem blockiert! AntiVir Upgrade für 50€ soll geladen werden

Raymous · 13.01.2012, 17:16

Hallo @ all,
Also wie viele andere von euch habe auch ich seit gestern
folgendes Problem. Sobald ich den PC starte erscheint ohne das ich etwas machen kann die Meldung: "Ihr Windows System wird aufgrund eines kritischen Systemzustands blockiert. Laden sie sich das AntiVir Upgrade für 50 € herunter und ihr System wird komplett gesäubert und ist geschützt.

Zum Post: Ich bin momentan im abgesichteren Modus mit Netzwerk da der normale Modus ja nicht mehr funktioniert es sei denn man schaltet das WLAN am Lappy aus.Ich habe habe ,wie bei der Erstellung eines Post beschrieben,
den Text in das Feld "Benutzerdefinierte Scans/Fixes" kopiert und auf Quickscan geklickt und zur VErwunderung wurde nur eine OTL.txt erstellt und keine weitere Extras.txt deshalb hier die OTL.txt

Code:

ATTFilter

OTL logfile created on: 13.01.2012 16:48:37 - Run 4
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Raymous\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
 
3,75 Gb Total Physical Memory | 2,76 Gb Available Physical Memory | 73,64% Memory free
7,50 Gb Paging File | 6,53 Gb Available in Paging File | 87,10% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 297,99 Gb Total Space | 32,13 Gb Free Space | 10,78% Space Free | Partition Type: NTFS
Drive D: | 4,11 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: RAYMOUS-PC | User Name: Raymous | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.13 15:57:17 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Raymous\Desktop\OTL.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010.05.20 14:26:28 | 000,199,536 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Microsoft LifeCam\MSCamS64.exe -- (MSCamSvc)
SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2009.03.27 18:10:16 | 000,016,896 | ---- | M] (LSI Corporation) [Auto | Stopped] -- C:\Program Files\LSI SoftModem\agr64svc.exe -- (AgereModemAudio)
SRV - [2011.12.22 09:34:22 | 002,998,832 | ---- | M] (Emsi Software GmbH) [Auto | Stopped] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe -- (a2AntiMalware)
SRV - [2011.12.15 17:38:30 | 003,316,000 | ---- | M] () [Auto | Stopped] -- c:\program files (x86)\common files\akamai/netsession_win_b427739.dll -- (Akamai)
SRV - [2011.11.01 11:33:54 | 004,363,040 | ---- | M] (Emsi Software GmbH) [Auto | Stopped] -- C:\Program Files (x86)\Online Armor\oasrv.exe -- (SvcOnlineArmor)
SRV - [2011.11.01 11:33:52 | 000,207,936 | ---- | M] (Emsi Software GmbH) [Auto | Stopped] -- C:\Program Files (x86)\Online Armor\OAcat.exe -- (OAcat)
SRV - [2011.10.11 13:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.10.11 13:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.11.30 18:08:30 | 002,222,376 | ---- | M] (TeamViewer GmbH) [Auto | Stopped] -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2010.08.29 19:47:36 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.21 12:18:46 | 000,332,720 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009.06.15 17:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Stopped] -- C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011.12.09 17:01:37 | 000,130,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.11.01 11:34:08 | 000,032,920 | ---- | M] (Emsisoft) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\OAnet.sys -- (OAnet)
DRV:64bit: - [2011.10.11 14:00:01 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.10.11 14:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.05.16 21:42:52 | 000,027,176 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsemc.sys -- (ggsemc)
DRV:64bit: - [2011.05.16 21:42:52 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt)
DRV:64bit: - [2011.05.10 07:06:14 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl)
DRV:64bit: - [2011.05.10 07:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 12:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.05.20 14:26:30 | 002,060,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VX3000.sys -- (VX3000)
DRV:64bit: - [2009.10.05 16:34:00 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.08.21 20:24:04 | 000,084,512 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2009.07.24 16:01:26 | 000,040,448 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:10:49 | 000,024,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MODEMCSA.sys -- (MODEMCSA)
DRV:64bit: - [2009.06.11 13:34:38 | 001,208,320 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem)
DRV:64bit: - [2009.06.10 21:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.05.01 04:06:58 | 000,339,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2008.12.11 06:56:54 | 000,015,488 | ---- | M] (ROCCAT Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Kone.sys -- (KoneFltr)
DRV:64bit: - [2008.10.21 08:22:44 | 000,145,960 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017unic.sys -- (s0017unic) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM)
DRV:64bit: - [2008.10.21 08:22:44 | 000,128,552 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017obex.sys -- (s0017obex)
DRV:64bit: - [2008.10.21 08:22:44 | 000,034,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017nd5.sys -- (s0017nd5) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS)
DRV:64bit: - [2008.10.21 08:22:42 | 000,152,616 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017mdm.sys -- (s0017mdm)
DRV:64bit: - [2008.10.21 08:22:42 | 000,133,160 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017mgmt.sys -- (s0017mgmt) Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM)
DRV:64bit: - [2008.10.21 08:22:42 | 000,019,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017mdfl.sys -- (s0017mdfl)
DRV:64bit: - [2008.10.21 08:22:40 | 000,113,704 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0017bus.sys -- (s0017bus) Sony Ericsson Device 0017 driver (WDM)
DRV:64bit: - [2007.08.09 01:21:00 | 000,013,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor)
DRV:64bit: - [2007.06.19 06:50:54 | 000,143,400 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s816mdm.sys -- (s816mdm)
DRV:64bit: - [2007.06.19 06:50:54 | 000,129,064 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s816unic.sys -- (s816unic) Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM)
DRV:64bit: - [2007.06.19 06:50:54 | 000,124,968 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s816mgmt.sys -- (s816mgmt) Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM)
DRV:64bit: - [2007.06.19 06:50:54 | 000,121,896 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s816obex.sys -- (s816obex)
DRV:64bit: - [2007.06.19 06:50:54 | 000,030,248 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s816nd5.sys -- (s816nd5) Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS)
DRV:64bit: - [2007.06.19 06:50:48 | 000,018,472 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s816mdfl.sys -- (s816mdfl)
DRV:64bit: - [2007.06.19 06:50:46 | 000,107,048 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s816bus.sys -- (s816bus) Sony Ericsson Device 816 driver (WDM)
DRV:64bit: - [2007.04.03 12:57:40 | 000,130,824 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s116unic.sys -- (s116unic) Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (WDM)
DRV:64bit: - [2007.04.03 12:57:40 | 000,123,656 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s116obex.sys -- (s116obex)
DRV:64bit: - [2007.04.03 12:57:38 | 000,031,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s116nd5.sys -- (s116nd5) Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (NDIS)
DRV:64bit: - [2007.04.03 12:57:34 | 000,108,296 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s116bus.sys -- (s116bus) Sony Ericsson Device 116 driver (WDM)
DRV - [2011.11.01 11:34:08 | 000,059,176 | ---- | M] () [File_System | System | Stopped] -- C:\Windows\SysWOW64\drivers\OADriver.sys -- (OADevice)
DRV - [2011.11.01 11:34:08 | 000,038,064 | ---- | M] (Emsisoft) [Kernel | System | Running] -- C:\Windows\SysWOW64\drivers\OAmon.sys -- (OAmon)
DRV - [2011.05.19 13:10:34 | 000,023,208 | ---- | M] (Emsi Software GmbH) [Kernel | System | Stopped] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys -- (A2DDA)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2004.04.10 09:43:54 | 000,004,608 | ---- | M] (cansoft@livewiredev.com) [Kernel | System | Stopped] -- C:\Windows\SysWOW64\mbmiodrvr.sys -- (mbmiodrvr)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\tbWinl.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1060933
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 00 B1 09 96 4B A6 CA 01  [binary data]
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - No CLSID value found
IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\tbWinl.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.1
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {EEE6C361-6118-11DC-9C72-001320C79847}:1.0.0.10
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.5
FF - prefs.js..extensions.enabledItems: finder@meingutscheincode.de:1.0.2
FF - prefs.js..extensions.enabledItems: {40c3cc16-7269-4b32-9531-17f2950fb06f}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:2.9.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.0.14
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.11
FF - prefs.js..extensions.enabledItems: {b749fc7c-e949-447f-926c-3f4eed6accfe}:0.6.9
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.7
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.6&q="
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "chrome://browser-region/locale/region.properties"
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files (x86)\Virtual Earth 3D\ File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.0.198: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.0.198: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.0.198: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.0.198: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.0.198: c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.11.15 18:41:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.15 18:40:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.11.15 18:41:25 | 000,000,000 | ---D | M]
 
[2010.02.05 11:59:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Raymous\AppData\Roaming\mozilla\Extensions
[2012.01.10 18:19:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Raymous\AppData\Roaming\mozilla\Firefox\Profiles\cor0y9ui.default\extensions
[2012.01.08 18:50:57 | 000,000,000 | ---D | M] (Freecorder Community Toolbar) -- C:\Users\Raymous\AppData\Roaming\mozilla\Firefox\Profiles\cor0y9ui.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}
[2011.08.25 18:26:40 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\Raymous\AppData\Roaming\mozilla\Firefox\Profiles\cor0y9ui.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2011.11.15 18:38:54 | 000,000,000 | ---D | M] (Complitly - Speed up your search with your personal search suggestions tool) -- C:\Users\Raymous\AppData\Roaming\mozilla\Firefox\Profiles\cor0y9ui.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}
[2011.12.05 20:18:10 | 000,000,000 | ---D | M] (Winload Community Toolbar) -- C:\Users\Raymous\AppData\Roaming\mozilla\Firefox\Profiles\cor0y9ui.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}
[2012.01.04 20:09:54 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Raymous\AppData\Roaming\mozilla\Firefox\Profiles\cor0y9ui.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.01.08 18:51:23 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Raymous\AppData\Roaming\mozilla\Firefox\Profiles\cor0y9ui.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.07.23 19:03:24 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Raymous\AppData\Roaming\mozilla\Firefox\Profiles\cor0y9ui.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.05.09 17:33:28 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Raymous\AppData\Roaming\mozilla\Firefox\Profiles\cor0y9ui.default\extensions\engine@conduit.com
[2010.11.26 09:19:17 | 000,000,000 | ---D | M] (Facemoods) -- C:\Users\Raymous\AppData\Roaming\mozilla\Firefox\Profiles\cor0y9ui.default\extensions\ffxtlbr@Facemoods.com
[2011.11.09 16:40:39 | 000,000,950 | ---- | M] () -- C:\Users\Raymous\AppData\Roaming\Mozilla\Firefox\Profiles\cor0y9ui.default\searchplugins\icqplugin-1.xml
[2012.01.10 18:21:59 | 000,000,950 | ---- | M] () -- C:\Users\Raymous\AppData\Roaming\Mozilla\Firefox\Profiles\cor0y9ui.default\searchplugins\icqplugin-2.xml
[2011.05.05 21:20:28 | 000,000,950 | ---- | M] () -- C:\Users\Raymous\AppData\Roaming\Mozilla\Firefox\Profiles\cor0y9ui.default\searchplugins\icqplugin-3.xml
[2011.06.27 16:00:35 | 000,000,950 | ---- | M] () -- C:\Users\Raymous\AppData\Roaming\Mozilla\Firefox\Profiles\cor0y9ui.default\searchplugins\icqplugin-4.xml
[2011.08.05 17:12:34 | 000,000,950 | ---- | M] () -- C:\Users\Raymous\AppData\Roaming\Mozilla\Firefox\Profiles\cor0y9ui.default\searchplugins\icqplugin-5.xml
[2011.08.18 06:18:58 | 000,000,950 | ---- | M] () -- C:\Users\Raymous\AppData\Roaming\Mozilla\Firefox\Profiles\cor0y9ui.default\searchplugins\icqplugin-6.xml
[2011.08.22 14:02:17 | 000,000,950 | ---- | M] () -- C:\Users\Raymous\AppData\Roaming\Mozilla\Firefox\Profiles\cor0y9ui.default\searchplugins\icqplugin-7.xml
[2011.09.28 18:23:51 | 000,000,950 | ---- | M] () -- C:\Users\Raymous\AppData\Roaming\Mozilla\Firefox\Profiles\cor0y9ui.default\searchplugins\icqplugin-8.xml
[2011.03.02 17:28:31 | 000,001,056 | ---- | M] () -- C:\Users\Raymous\AppData\Roaming\Mozilla\Firefox\Profiles\cor0y9ui.default\searchplugins\icqplugin.xml
[2011.12.10 13:12:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
() (No name found) -- C:\USERS\RAYMOUS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\COR0Y9UI.DEFAULT\EXTENSIONS\{46551EC9-40F0-4E47-8E18-8E5CF550CFB8}.XPI
() (No name found) -- C:\USERS\RAYMOUS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\COR0Y9UI.DEFAULT\EXTENSIONS\{B749FC7C-E949-447F-926C-3F4EED6ACCFE}.XPI
() (No name found) -- C:\USERS\RAYMOUS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\COR0Y9UI.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\RAYMOUS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\COR0Y9UI.DEFAULT\EXTENSIONS\{EEE6C361-6118-11DC-9C72-001320C79847}.XPI
[2011.11.05 08:10:35 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010.07.17 04:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.11.05 04:38:54 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.11.05 04:32:18 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.11.05 04:38:54 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.11.05 04:38:54 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.11.05 04:38:54 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.11.05 04:38:54 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
 
O1 HOSTS File: ([2010.08.29 19:34:46 | 000,001,961 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 hxxp://www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 192.150.18.108
O1 - Hosts: 127.0.0.1 activate.adobe.com:443
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 192.150.18.108
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 14 more lines...
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\tbWinl.dll (Conduit Ltd.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\tbWinl.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Winload Toolbar) - {40C3CC16-7269-4B32-9531-17F2950FB06F} - C:\Program Files (x86)\Winload\tbWinl.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files (x86)\Online Armor\oaui.exe (Emsi Software GmbH)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [emsisoft anti-malware] C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe (Emsi Software GmbH)
O4 - HKLM..\Run: [Realtime Audio Engine] C:\Windows\SysWow64\mmrtkrnl.exe (AlcaTech)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [{78054C46-1235-11DF-9A76-806E6F6E6963}] C:\Users\Raymous\AppData\Roaming\Microsoft\dllhsts.exe (ffdshow                                                     )
O4 - HKCU..\Run: [AdobeBridge]  File not found
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Raymous\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 153
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 153
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Raymous\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Raymous\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Free YouTube Download - C:\Users\Raymous\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Raymous\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MIF5BA~1\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5B4B018E-EDD8-4EAB-A3A0-DED0312D7926}: DhcpNameServer = 193.254.160.1 10.74.83.22
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9AB2440C-17B4-464D-9C26-A9B5CD27C667}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
O20:64bit: - AppInit_DLLs: (acaptuser64.dll) - C:\Windows\SysNative\acaptuser64.dll (Adobe Systems, Inc.)
O20 - AppInit_DLLs: (acaptuser32.dll) -C:\Windows\SysWow64\acaptuser32.dll (Adobe Systems Incorporated)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - Unable to read "AutoRun" value or value not present!
O32 - AutoRun File - [2005.11.21 18:26:21 | 000,000,057 | R--- | M] () - D:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{3e019c75-aa87-11df-8840-00235483a93a}\Shell - "" = AutoRun
O33 - MountPoints2\{3e019c75-aa87-11df-8840-00235483a93a}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{7c3f060c-1246-11df-98c7-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{7c3f060c-1246-11df-98c7-806e6f6e6963}\Shell\AutoRun\command - "" = D:\OblivionLauncher.exe -- [2006.02.27 15:17:52 | 001,662,976 | R--- | M] (Bethesda Softworks)
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk -  - File not found
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Rainmeter.lnk -  - File not found
MsConfig:64bit - StartUpReg: Acrobat Assistant 8.0 - hkey= - key= - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
MsConfig:64bit - StartUpReg: Adobe Acrobat Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: AdobeAAMUpdater-1.0 - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: AdobeCS5ServiceManager - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: AmIcoSinglun64 - hkey= - key= - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)
MsConfig:64bit - StartUpReg: AppleSyncNotifier - hkey= - key= - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: AquaSnap - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MsConfig:64bit - StartUpReg: Google Update - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: GrooveMonitor - hkey= - key= - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: HControlUser - hkey= - key= - C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe (ASUS)
MsConfig:64bit - StartUpReg: ICQ - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: Kone - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: LifeCam - hkey= - key= - C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: MMAgent - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: MsnMsgr - hkey= - key= - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: phonostar-Player - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: phonostarTimer - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: Skype - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: Sony Ericsson PC Companion - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: Spiele Post - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: Steam - hkey= - key= - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig:64bit - StartUpReg: SweetIM - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: SwitchBoard - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: TkBellExe - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: vspdfprsrv.exe - hkey= - key= - C:\Program Files (x86)\Visagesoft\eXPert PDF\vspdfprsrv.exe ()
MsConfig:64bit - StartUpReg: VX3000 - hkey= - key= - C:\Windows\vVX3000.exe (Microsoft Corporation)
MsConfig:64bit - State: "bootini" - Reg Error: Key error.
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.13 16:31:15 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{55EC3934-A5A0-483C-B636-CE7ED4513BAD}
[2012.01.13 15:57:15 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Raymous\Desktop\OTL.exe
[2012.01.12 21:56:10 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Roaming\OnlineArmor
[2012.01.12 21:56:10 | 000,000,000 | ---D | C] -- C:\ProgramData\OnlineArmor
[2012.01.12 21:53:40 | 000,038,064 | ---- | C] (Emsisoft) -- C:\Windows\SysWow64\drivers\OAmon.sys
[2012.01.12 21:53:40 | 000,032,920 | ---- | C] (Emsisoft) -- C:\Windows\SysNative\drivers\OAnet.sys
[2012.01.12 21:53:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Online Armor
[2012.01.12 21:53:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Online Armor
[2012.01.12 21:53:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
[2012.01.12 21:52:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Emsisoft Anti-Malware
[2012.01.12 21:52:56 | 000,000,000 | ---D | C] -- C:\Users\Raymous\Documents\Anti-Malware
[2012.01.12 21:50:25 | 133,368,032 | ---- | C] (Emsi Software GmbH                                          ) -- C:\Users\Raymous\Desktop\EmsisoftInternetSecuritySetup.exe
[2012.01.12 19:39:25 | 000,000,000 | ---D | C] -- C:\Windows\VDLL.DLL
[2012.01.12 19:39:25 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\runouce.exe
[2012.01.12 19:39:25 | 000,000,000 | ---D | C] -- C:\Windows\RUNDL132.EXE
[2012.01.12 19:39:25 | 000,000,000 | ---D | C] -- C:\Windows\logo1_.exe
[2012.01.12 19:39:25 | 000,000,000 | ---D | C] -- C:\Windows\logo_1.exe
[2012.01.12 19:39:24 | 000,000,000 | ---D | C] -- C:\Users\Raymous\Desktop\TempBK
[2012.01.12 19:32:39 | 000,034,048 | ---- | C] (MicroWorld Technologies Inc.) -- C:\Windows\SysWow64\eEmpty.exe
[2012.01.12 19:32:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\MicroWorld
[2012.01.12 19:32:24 | 000,000,000 | ---D | C] -- C:\ProgramData\MicroWorld
[2012.01.12 19:15:10 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Roaming\Download Manager
[2012.01.12 17:04:14 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{BE8137A3-43AC-4E7B-8868-96A65276C941}
[2012.01.12 17:03:55 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{C39EDF41-07AB-43D1-B583-FE550561D8DE}
[2012.01.11 16:29:52 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{483AA978-A512-48AB-AFD0-ABAC2862DE8B}
[2012.01.11 16:29:35 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{6C2AC4D5-87CD-435F-94FA-8A21C56559E6}
[2012.01.10 17:59:47 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{42B693BE-5A2C-4052-AC47-5F8FC47D2661}
[2012.01.10 17:59:27 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{04339413-69D0-4EC9-90F8-9367A1B66FD2}
[2012.01.08 18:43:18 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{EAFCD66E-D5CB-41AC-9AF0-B7E2E5D706A1}
[2012.01.07 13:50:05 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{09FCFF98-F08A-4C35-9A91-0104E8128DF4}
[2012.01.06 13:43:54 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{939DCD24-118B-4CAD-B7F7-129EED101D77}
[2012.01.06 09:56:31 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{53A1D282-31A9-42F5-B60E-0C8DC3AB3780}
[2012.01.05 11:15:28 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{85205F3F-CB3E-42B1-84AE-DB9CC34E2455}
[2012.01.05 11:15:05 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{BD6B3703-29BB-41F4-89BC-6E242DF01ECB}
[2012.01.04 11:27:53 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{D513D89F-01A1-4A4D-B77C-28A18C048E9B}
[2012.01.04 11:27:35 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{94022E6D-13A7-4AFD-94BB-D2546E5FD303}
[2012.01.04 09:23:00 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{C596105F-336D-4C65-9DD2-CCD0CCDA65D5}
[2012.01.03 14:45:55 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2012.01.03 14:28:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda Softworks
[2012.01.03 14:28:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bethesda Softworks
[2012.01.03 14:27:39 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\Oblivion
[2012.01.03 14:27:39 | 000,000,000 | ---D | C] -- C:\Users\Raymous\Documents\My Games
[2012.01.03 12:47:24 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{0D1AF9FD-41A5-4A3C-9879-93C1CB017750}
[2012.01.03 12:47:06 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{BC7BCEA5-13C2-4222-AFF6-FF5AA75B7D8F}
[2011.12.31 15:00:10 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{A354762A-F692-4617-8562-CD93221E0B07}
[2011.12.31 14:59:52 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{40B819A9-5300-4819-8ACF-7F22A2B541C6}
[2011.12.28 12:13:20 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{4830362D-3E96-4383-AA43-E6E2DF9EECB2}
[2011.12.28 12:12:45 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{4AAEC4F6-6372-4231-8248-D9D2B4F7B57B}
[2011.12.27 10:18:50 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{EE4FC306-6372-49B8-9927-0556CC95338D}
[2011.12.27 10:18:20 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{36153BD3-30B1-4933-871A-9F611AE07570}
[2011.12.24 17:34:16 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{510C0E41-CA82-4ACB-A416-26358C34E0BF}
[2011.12.24 17:34:01 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{C7426F08-2346-4C02-A150-95F0920B6E29}
[2011.12.20 16:50:05 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{8BDD4743-FF11-4154-89E5-9A67EA3FEAFA}
[2011.12.20 16:49:49 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{62211434-3791-4912-B846-D317CB6C3A14}
[2011.12.19 18:12:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011.12.19 18:11:25 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011.12.19 18:11:24 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011.12.19 18:11:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2011.12.19 17:52:44 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{5FA26F08-361E-4AC9-A2E1-87BCC6A760CC}
[2011.12.19 17:52:30 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{D8F3EFE5-2820-4720-B9E6-1E2214AA58F9}
[2011.12.18 14:17:26 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{4FC03990-BDA0-47F6-97EB-42D59FE31F33}
[2011.12.18 14:17:11 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{29B3D2D8-2DBA-420F-8D2F-5FAF5F8F78FD}
[2011.12.17 20:01:50 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{720B770B-796E-45C3-918F-723AFCC9572B}
[2011.12.17 20:01:35 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{C7174AF9-939D-4753-8892-14910469EF71}
[2011.12.16 16:41:21 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{6931B577-7E42-49C2-9AC3-40BC38759392}
[2011.12.16 16:41:05 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{5B553B14-1D88-4136-8DF2-2276DD82CD7E}
[2011.12.15 17:41:14 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{63764C00-C200-4C07-8AF8-724D0C4B8767}
[2011.12.15 17:40:59 | 000,000,000 | ---D | C] -- C:\Users\Raymous\AppData\Local\{4B91FCDB-649A-4FF3-8B93-B21E3B86C67C}
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.13 16:47:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.01.13 16:46:47 | 3019,272,192 | -HS- | M] () -- C:\hiberfil.sys
[2012.01.13 16:38:25 | 000,016,944 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.01.13 16:38:25 | 000,016,944 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.01.13 16:26:43 | 001,110,476 | ---- | M] () -- C:\Users\Raymous\Desktop\7z920.exe
[2012.01.13 15:57:17 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Raymous\Desktop\OTL.exe
[2012.01.13 15:56:40 | 000,000,000 | ---- | M] () -- C:\Users\Raymous\defogger_reenable
[2012.01.13 15:56:11 | 000,050,477 | ---- | M] () -- C:\Users\Raymous\Desktop\Defogger.exe
[2012.01.12 22:36:18 | 000,503,030 | ---- | M] () -- C:\Users\Raymous\Documents\pinfect.zip
[2012.01.12 21:53:21 | 000,001,119 | ---- | M] () -- C:\Users\Raymous\Application Data\Microsoft\Internet Explorer\Quick Launch\Emsisoft Anti-Malware.lnk
[2012.01.12 21:53:21 | 000,001,095 | ---- | M] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
[2012.01.12 21:52:43 | 133,368,032 | ---- | M] (Emsi Software GmbH                                          ) -- C:\Users\Raymous\Desktop\EmsisoftInternetSecuritySetup.exe
[2012.01.12 19:49:21 | 019,600,158 | ---- | M] () -- C:\Windows\REGBK00.ZIP
[2012.01.12 19:39:24 | 000,000,056 | ---- | M] () -- C:\Windows\Lic.xxx
[2012.01.12 19:32:38 | 000,034,048 | ---- | M] (MicroWorld Technologies Inc.) -- C:\Windows\SysWow64\eEmpty.exe
[2012.01.12 19:32:25 | 000,001,040 | ---- | M] () -- C:\Users\Raymous\Desktop\MWAVSCAN.lnk
[2012.01.12 19:31:10 | 141,333,296 | ---- | M] () -- C:\Users\Raymous\Desktop\mwav.exe
[2012.01.11 19:02:28 | 001,569,516 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.01.11 19:02:28 | 000,671,056 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.01.11 19:02:28 | 000,632,056 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.01.11 19:02:28 | 000,138,218 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.01.11 19:02:28 | 000,113,436 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.01.07 14:02:11 | 000,000,023 | ---- | M] () -- C:\Windows\BlendSettings.ini
[2012.01.03 14:38:23 | 000,002,168 | ---- | M] () -- C:\Users\Public\Desktop\Oblivion.lnk
[2011.12.19 18:12:10 | 000,001,783 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011.12.19 18:06:19 | 000,002,515 | ---- | M] () -- C:\Users\Raymous\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011.12.19 18:06:19 | 000,002,491 | ---- | M] () -- C:\Users\Public\Desktop\Safari.lnk
[2011.12.15 17:37:58 | 005,123,992 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2012.01.13 16:26:41 | 001,110,476 | ---- | C] () -- C:\Users\Raymous\Desktop\7z920.exe
[2012.01.13 15:56:40 | 000,000,000 | ---- | C] () -- C:\Users\Raymous\defogger_reenable
[2012.01.13 15:56:09 | 000,050,477 | ---- | C] () -- C:\Users\Raymous\Desktop\Defogger.exe
[2012.01.12 22:36:18 | 000,503,030 | ---- | C] () -- C:\Users\Raymous\Documents\pinfect.zip
[2012.01.12 21:53:40 | 000,059,176 | ---- | C] () -- C:\Windows\SysWow64\drivers\OADriver.sys
[2012.01.12 21:53:40 | 000,056,648 | ---- | C] () -- C:\Windows\SysWow64\drivers\oahlp64.sys
[2012.01.12 21:53:21 | 000,001,119 | ---- | C] () -- C:\Users\Raymous\Application Data\Microsoft\Internet Explorer\Quick Launch\Emsisoft Anti-Malware.lnk
[2012.01.12 21:53:21 | 000,001,095 | ---- | C] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
[2012.01.12 19:48:08 | 019,600,158 | ---- | C] () -- C:\Windows\REGBK00.ZIP
[2012.01.12 19:32:58 | 000,000,056 | ---- | C] () -- C:\Windows\Lic.xxx
[2012.01.12 19:32:25 | 000,001,040 | ---- | C] () -- C:\Users\Raymous\Desktop\MWAVSCAN.lnk
[2012.01.12 19:14:20 | 141,333,296 | ---- | C] () -- C:\Users\Raymous\Desktop\mwav.exe
[2012.01.03 15:27:53 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2012.01.03 14:38:22 | 000,002,168 | ---- | C] () -- C:\Users\Public\Desktop\Oblivion.lnk
[2011.12.19 18:12:10 | 000,001,783 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011.09.28 18:43:32 | 000,000,275 | ---- | C] () -- C:\Users\Raymous\AppData\Local\HamsterVideoConverterSettings.cfg
[2011.04.14 19:41:09 | 000,110,080 | ---- | C] () -- C:\Windows\SysWow64\advd.dll
[2011.04.14 19:41:09 | 000,023,040 | ---- | C] () -- C:\Windows\SysWow64\auth.dll
[2011.04.14 19:41:08 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\lame_enc.dll
[2011.03.03 14:33:16 | 000,253,316 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2010.09.21 07:18:32 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.09.05 18:48:09 | 000,000,091 | ---- | C] () -- C:\Windows\SysWow64\nfsHDWaterfall03.ini
[2010.08.30 18:32:18 | 000,000,072 | ---- | C] () -- C:\Windows\EurekaLog.ini
[2010.08.30 17:43:40 | 000,014,336 | ---- | C] () -- C:\Windows\SysWow64\vsmon1.dll
[2010.07.18 15:33:17 | 000,000,095 | ---- | C] () -- C:\Users\Raymous\AppData\Local\fusioncache.dat
[2010.07.18 15:32:08 | 001,526,950 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.05.11 20:32:28 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010.03.27 20:09:46 | 000,007,597 | ---- | C] () -- C:\Users\Raymous\AppData\Local\Resmon.ResmonCfg
[2010.03.18 19:43:21 | 000,000,028 | ---- | C] () -- C:\Windows\Robota.INI
[2010.03.18 19:41:46 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\mgxasio2.dll
[2010.03.18 19:40:41 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[2010.03.18 19:40:22 | 000,007,119 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2010.02.10 20:59:34 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.26 16:24:18 | 000,015,498 | ---- | C] () -- C:\Windows\VX3000.ini
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2010.05.02 11:35:38 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\AD ON Multimedia
[2011.01.31 18:58:20 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\AlcaTech
[2011.12.10 12:11:19 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\Audacity
[2011.05.16 22:27:44 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\Belkasoft
[2011.02.01 17:27:18 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011.12.10 12:18:22 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\concept design
[2010.04.10 20:29:19 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\DeskSoft
[2012.01.12 20:44:12 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\Desktopicon
[2011.11.19 21:31:32 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\DVDVideoSoft
[2011.05.15 21:41:55 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.09.19 20:11:36 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\eXPert PDF Editor
[2011.12.10 12:36:17 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\FreeScreenToVideo
[2010.08.26 13:35:01 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\GARMIN
[2011.12.10 12:40:10 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\gtk-2.0
[2011.12.10 12:53:36 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\Jumping Bytes
[2011.11.26 08:57:03 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\MAGIX
[2010.10.19 19:48:11 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\Offline Explorer
[2012.01.12 21:57:11 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\OnlineArmor
[2010.02.05 20:38:11 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\OpenOffice.org
[2011.12.10 13:09:55 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\Power Sound Editor Free
[2010.02.21 19:09:00 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\Publish Providers
[2010.02.20 20:35:28 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\ROCCAT
[2011.09.29 18:24:37 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\Sony
[2010.12.07 17:14:30 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\TeamViewer
[2010.04.30 14:59:18 | 000,000,000 | ---D | M] -- C:\Users\Raymous\AppData\Roaming\Toolbars
[2011.08.23 16:36:44 | 000,032,608 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2010.02.05 10:11:47 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2010.07.19 09:21:39 | 000,000,000 | ---D | M] -- C:\Casino
[2010.11.09 14:45:11 | 000,000,000 | ---D | M] -- C:\db9814941d85ee8d67d75c93
[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2010.10.19 19:45:47 | 000,000,000 | ---D | M] -- C:\download
[2010.11.26 12:15:15 | 000,000,000 | ---D | M] -- C:\Downloads
[2011.03.21 18:31:05 | 000,000,000 | ---D | M] -- C:\DVDVideoSoft
[2010.09.21 07:13:45 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.12.19 18:11:25 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.01.12 21:53:33 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2012.01.12 21:56:10 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2010.02.05 10:11:14 | 000,000,000 | -HSD | M] -- C:\Recovery
[2012.01.11 19:01:21 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.11.15 18:39:10 | 000,000,000 | ---D | M] -- C:\temp
[2010.10.19 19:17:43 | 000,000,000 | R--D | M] -- C:\Users
[2012.01.12 22:33:54 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.manifest /3 >
 
 
< MD5 for: AFD.SYS  >
[2011.04.25 03:44:02 | 000,499,712 | ---- | M] (Microsoft Corporation) MD5=6EF20DDF3172E97D69F596FB90602F29 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16802_none_3430bc3977dfec2d\afd.sys
[2009.07.14 00:21:42 | 000,500,224 | ---- | M] (Microsoft Corporation) MD5=B9384E03479D2506BC924C16A3DB87BC -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16385_none_33dd3439781e25f7\afd.sys
[2010.11.20 10:23:34 | 000,499,712 | ---- | M] (Microsoft Corporation) MD5=D31DC7A16DEA4A9BAF179F3D6FBDB38C -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\afd.sys
[2011.04.25 03:34:03 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=D5B031C308A409A0A576BFF4CF083D30 -- C:\Windows\SysNative\drivers\afd.sys
[2011.04.25 03:34:03 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=D5B031C308A409A0A576BFF4CF083D30 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_3618198975057170\afd.sys
[2011.04.25 04:09:35 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=F4AD06143EAC303F55D0E86C40802976 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21712_none_3695e61e8e2c13d4\afd.sys
[2011.04.25 03:44:27 | 000,499,712 | ---- | M] (Microsoft Corporation) MD5=FBFF8B7C9D116229E9208A0D1CAEB49B -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.20951_none_3483491e9126fe55\afd.sys
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 07:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009.08.03 07:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010.11.20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011.02.26 07:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009.08.03 07:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe
[2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
 
<           >

< End of report >

Ich bin für jede Hilfe offen

markusg · 13.01.2012, 17:30

hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:

ATTFilter

:OTL
O4 - HKCU..\Run: [{78054C46-1235-11DF-9A76-806E6F6E6963}] C:\Users\Raymous\AppData\Roaming\Microsoft\dllhsts.exe (ffdshow                             
                       )
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
 :Files
C:\Users\Raymous\AppData\Roaming\Microsoft\dllhsts.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden
öffne computer, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
folge dem link, und lade das archiv im upload channel hoch
http://www.trojaner-board.de/54791-a...ner-board.html

Raymous · 13.01.2012, 17:41

OK habs gemacht hier

Code:

ATTFilter

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{78054C46-1235-11DF-9A76-806E6F6E6963} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{78054C46-1235-11DF-9A76-806E6F6E6963}\ not found.
C:\Users\Raymous\AppData\Roaming\Microsoft\dllhsts.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: All Users
 
User: AppData
 
User: Default
->Flash cache emptied: 41620 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Public
 
User: Raymous
->Flash cache emptied: 2707820 bytes
 
Total Flash Files Cleaned = 3,00 mb
 
 
[EMPTYTEMP]
 
User: All Users
 
User: AppData
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
User: Raymous
->Temp folder emptied: 445319861 bytes
->Temporary Internet Files folder emptied: 42465921 bytes
->Java cache emptied: 30904920 bytes
->FireFox cache emptied: 100781337 bytes
->Google Chrome cache emptied: 10139215 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 110875273 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 84793 bytes
RecycleBin emptied: 154648 bytes
 
Total Files Cleaned = 706,00 mb
 
 
OTL by OldTimer - Version 3.2.31.0 log created on 01132012_173424

Files\Folders moved on Reboot...
C:\Users\Raymous\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

markusg · 13.01.2012, 18:07

dann weiter mit dem upload.

Raymous · 13.01.2012, 18:07

Habe jetz auch Malewarebytes genutzt und 3 infizierte Objekte wurden gefunden siehe hier

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.13.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Raymous :: RAYMOUS-PC [Administrator]

Schutz: Aktiviert

13.01.2012 18:00:49
mbam-log-2012-01-13 (18-00-49).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 180020
Laufzeit: 4 Minute(n), 33 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\32 Vegas Casino (Adware.21Nova) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Raymous\AppData\Roaming\Desktopicon\eBayShortcuts.exe.mwt (Adware.ADON) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Raymous\Downloads\SetupCasino_1349c3_de.exe (PUP.Casino) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

hoffe es hilft zur Info

markusg · 13.01.2012, 18:14

wo steht hier was von malwarebytes.
arbeite das vernünftig ab was ich dir schreibe, und nicht nur die hälfte, und mach nichts was nicht angefordert wurde...

Raymous · 13.01.2012, 18:18

tut mir leid kommt nicht mehr vor
war nicht böse gemeint

So der Upload war erfolgreich
und jetzt

markusg · 13.01.2012, 18:22

danke für den upload.

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
Tool

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Hinweis:
Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Raymous · 13.01.2012, 20:13

So hat ganz schön lange gedauert eh die logdatei erstellt wurde

Code:

ATTFilter

ComboFix 12-01-13.03 - Raymous 13.01.2012  19:23:31.2.2 - x64
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1033.18.3839.2581 [GMT 1:00]
ausgeführt von:: c:\users\Raymous\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\etc\hosts.ics
.
---- Vorheriger Suchlauf -------
.
c:\users\Raymous\AppData\Roaming\AD ON Multimedia\eBay Shortcuts\config.ini
c:\windows\system32\drivers\etc\hosts.ics
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-12-13 bis 2012-01-13  ))))))))))))))))))))))))))))))
.
.
2012-01-13 18:46 . 2012-01-13 18:46	69000	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{7B2C61F8-79CA-4934-9EA9-319FC7BC1C93}\offreg.dll
2012-01-13 18:40 . 2012-01-13 18:40	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-01-13 16:57 . 2012-01-13 16:57	--------	d-----w-	c:\users\Raymous\AppData\Roaming\Malwarebytes
2012-01-13 16:57 . 2012-01-13 16:57	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2012-01-13 16:57 . 2012-01-13 16:57	--------	d-----w-	c:\programdata\Malwarebytes
2012-01-13 16:57 . 2011-12-10 14:24	23152	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-01-13 16:39 . 2012-01-13 16:39	548864	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcp80.dll
2012-01-13 16:39 . 2012-01-13 16:39	479232	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcm80.dll
2012-01-13 16:39 . 2012-01-13 16:39	43992	----a-w-	c:\program files (x86)\Mozilla Firefox\mozutils.dll
2012-01-13 16:39 . 2012-01-13 16:39	626688	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcr80.dll
2012-01-13 16:34 . 2012-01-13 17:09	--------	d-----w-	C:\_OTL
2012-01-13 15:36 . 2011-11-21 11:40	8822856	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{7B2C61F8-79CA-4934-9EA9-319FC7BC1C93}\mpengine.dll
2012-01-12 20:56 . 2012-01-13 14:38	--------	d-----w-	c:\programdata\OnlineArmor
2012-01-12 20:56 . 2012-01-12 20:57	--------	d-----w-	c:\users\Raymous\AppData\Roaming\OnlineArmor
2012-01-12 20:53 . 2011-11-01 10:34	56648	----a-w-	c:\windows\SysWow64\drivers\oahlp64.sys
2012-01-12 20:53 . 2011-11-01 10:34	59176	----a-w-	c:\windows\SysWow64\drivers\OADriver.sys
2012-01-12 20:53 . 2011-11-01 10:34	38064	----a-w-	c:\windows\SysWow64\drivers\OAmon.sys
2012-01-12 20:53 . 2011-11-01 10:34	32920	----a-w-	c:\windows\system32\drivers\OAnet.sys
2012-01-12 20:53 . 2012-01-13 18:44	--------	d-----w-	c:\program files (x86)\Online Armor
2012-01-12 20:52 . 2012-01-13 15:43	--------	d-----w-	c:\program files (x86)\Emsisoft Anti-Malware
2012-01-12 18:39 . 2012-01-12 18:39	--------	d---a-w-	c:\windows\VDLL.DLL
2012-01-12 18:39 . 2012-01-12 18:39	--------	d---a-w-	c:\windows\SysWow64\runouce.exe
2012-01-12 18:39 . 2012-01-12 18:39	--------	d---a-w-	c:\windows\RUNDL132.EXE
2012-01-12 18:39 . 2012-01-12 18:39	--------	d---a-w-	c:\windows\logo1_.exe
2012-01-12 18:39 . 2012-01-12 18:39	--------	d---a-w-	c:\windows\logo_1.exe
2012-01-12 18:32 . 2012-01-12 18:32	632064	----a-w-	c:\windows\SysWow64\msvcr80.dll
2012-01-12 18:32 . 2012-01-12 18:32	554240	----a-w-	c:\windows\SysWow64\msvcp80.dll
2012-01-12 18:32 . 2012-01-12 18:32	572928	----a-w-	c:\windows\SysWow64\msvcp90.dll
2012-01-12 18:32 . 2012-01-12 18:32	655872	----a-w-	c:\windows\SysWow64\msvcr90.dll
2012-01-12 18:32 . 2012-01-12 18:32	34048	----a-w-	c:\windows\SysWow64\eEmpty.exe
2012-01-12 18:32 . 2012-01-12 18:32	--------	d-----w-	c:\program files (x86)\Common Files\MicroWorld
2012-01-12 18:32 . 2012-01-12 18:32	--------	d-----w-	c:\programdata\MicroWorld
2012-01-12 18:15 . 2012-01-12 18:15	--------	d-----w-	c:\users\Raymous\AppData\Roaming\Download Manager
2012-01-11 15:41 . 2011-10-26 05:25	1572864	----a-w-	c:\windows\system32\quartz.dll
2012-01-11 15:41 . 2011-10-26 04:32	1328128	----a-w-	c:\windows\SysWow64\quartz.dll
2012-01-11 15:41 . 2011-10-26 04:32	514560	----a-w-	c:\windows\SysWow64\qdvd.dll
2012-01-11 15:41 . 2011-10-26 05:25	366592	----a-w-	c:\windows\system32\qdvd.dll
2012-01-11 15:41 . 2011-11-17 06:41	1731920	----a-w-	c:\windows\system32\ntdll.dll
2012-01-11 15:41 . 2011-11-17 05:38	1292080	----a-w-	c:\windows\SysWow64\ntdll.dll
2012-01-11 15:41 . 2011-11-19 14:58	77312	----a-w-	c:\windows\system32\packager.dll
2012-01-11 15:41 . 2011-11-19 14:01	67072	----a-w-	c:\windows\SysWow64\packager.dll
2012-01-03 13:28 . 2012-01-03 13:28	--------	d-----w-	c:\program files (x86)\Bethesda Softworks
2012-01-03 13:27 . 2005-04-03 22:00	63488	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ISBEW64.exe
2012-01-03 13:27 . 2005-04-03 21:57	32768	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\Objectps.dll
2012-01-03 13:27 . 2005-04-03 22:02	753664	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll
2012-01-03 13:27 . 2005-04-03 22:02	69714	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
2012-01-03 13:27 . 2005-04-03 22:01	274432	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll
2012-01-03 13:27 . 2005-04-03 22:00	184320	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll
2012-01-03 13:27 . 2005-04-03 21:59	5632	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe
2012-01-03 13:27 . 2012-01-03 13:27	331908	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll
2012-01-03 13:27 . 2012-01-03 13:27	200836	----a-w-	c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll
2012-01-03 13:27 . 2012-01-03 13:45	--------	d-----w-	c:\users\Raymous\AppData\Local\Oblivion
2011-12-19 17:11 . 2011-12-19 17:11	--------	d-----w-	c:\program files\iPod
2011-12-19 17:11 . 2011-12-19 17:12	--------	d-----w-	c:\program files\iTunes
2011-12-19 17:11 . 2011-12-19 17:12	--------	d-----w-	c:\program files (x86)\iTunes
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-12 18:49 . 2012-01-12 18:48	19600158	----a-w-	c:\windows\REGBK00.ZIP
2011-12-10 11:12 . 2011-01-31 17:58	126464	----a-w-	c:\windows\SysWow64\Setup.dll
2011-12-09 16:01 . 2011-10-21 06:32	130760	----a-w-	c:\windows\system32\drivers\avipbb.sys
2011-11-24 04:52 . 2011-12-14 15:51	3145216	----a-w-	c:\windows\system32\win32k.sys
2011-11-15 17:40 . 2009-08-27 11:23	348160	----a-w-	c:\windows\SysWow64\msvcr71.dll
2011-11-15 17:40 . 2009-02-19 15:49	499712	----a-w-	c:\windows\SysWow64\msvcp71.dll
2011-11-07 16:25 . 2009-07-14 02:36	152576	----a-w-	c:\windows\SysWow64\msclmd.dll
2011-11-07 16:25 . 2009-07-14 02:36	175616	----a-w-	c:\windows\system32\msclmd.dll
2011-11-06 06:57 . 2011-06-07 14:32	414368	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-05 05:41 . 2011-12-14 15:52	1188864	----a-w-	c:\windows\system32\wininet.dll
2011-11-05 05:32 . 2011-12-14 15:51	2048	----a-w-	c:\windows\system32\tzres.dll
2011-11-05 04:35 . 2011-12-14 15:52	981504	----a-w-	c:\windows\SysWow64\wininet.dll
2011-11-05 04:26 . 2011-12-14 15:51	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2011-11-05 03:32 . 2011-12-14 15:51	1638912	----a-w-	c:\windows\system32\mshtml.tlb
2011-11-05 02:48 . 2011-12-14 15:51	1638912	----a-w-	c:\windows\SysWow64\mshtml.tlb
2011-10-26 05:21 . 2011-12-14 15:52	43520	----a-w-	c:\windows\system32\csrsrv.dll
2011-10-24 13:29 . 2011-10-24 13:29	94208	----a-w-	c:\windows\SysWow64\QuickTimeVR.qtx
2011-10-24 13:29 . 2011-10-24 13:29	69632	----a-w-	c:\windows\SysWow64\QuickTime.qts
.
.
(((((((((((((((((((((((((((((   SnapShot@2012-01-13_17.51.31   )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-05 10:11 . 2012-01-13 18:44	68958              c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-01-13 18:44	43856              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-02-05 09:17 . 2012-01-13 18:44	19888              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1282487591-3300488161-2385820083-1000_UserData.bin
+ 2010-02-05 10:11 . 2012-01-13 18:43	16384              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-02-05 10:11 . 2012-01-13 17:52	16384              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-02-05 10:11 . 2012-01-13 17:52	32768              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-02-05 10:11 . 2012-01-13 18:43	32768              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-02-05 10:11 . 2012-01-13 18:43	16384              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-02-05 10:11 . 2012-01-13 17:52	16384              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-02-05 11:22 . 2012-01-13 18:43	16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-02-05 11:22 . 2012-01-13 17:52	16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-02-05 11:22 . 2012-01-13 18:43	16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-02-05 11:22 . 2012-01-13 17:52	16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2012-01-13 17:49 . 2012-01-13 17:49	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-01-13 18:42 . 2012-01-13 18:42	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-01-13 17:49 . 2012-01-13 17:49	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-01-13 18:42 . 2012-01-13 18:42	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 05:01 . 2012-01-13 17:48	606720              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-01-13 18:40	606720              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{40c3cc16-7269-4b32-9531-17f2950fb06f}"= "c:\program files (x86)\Winload\tbWinl.dll" [2010-03-17 2355224]
.
[HKEY_CLASSES_ROOT\clsid\{40c3cc16-7269-4b32-9531-17f2950fb06f}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{40c3cc16-7269-4b32-9531-17f2950fb06f}]
2010-03-17 13:45	2355224	----a-w-	c:\program files (x86)\Winload\tbWinl.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{40c3cc16-7269-4b32-9531-17f2950fb06f}"= "c:\program files (x86)\Winload\tbWinl.dll" [2010-03-17 2355224]
.
[HKEY_CLASSES_ROOT\clsid\{40c3cc16-7269-4b32-9531-17f2950fb06f}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeBridge"="" [BU]
"Akamai NetSession Interface"="c:\users\Raymous\AppData\Local\Akamai\netsession_win.exe" [2011-12-12 3305760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Realtime Audio Engine"="mmrtkrnl.exe" [2010-06-29 70144]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2011-11-15 296056]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"emsisoft anti-malware"="c:\program files (x86)\Emsisoft Anti-Malware\a2guard.exe" [2011-12-22 3322768]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SvcOnlineArmor;Online Armor;c:\program files (x86)\Online Armor\oasrv.exe [2011-11-01 4363040]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [x]
R3 KoneFltr;ROCCAT Kone;c:\windows\system32\drivers\Kone.sys [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\DRIVERS\s0017bus.sys [x]
R3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0017mdfl.sys [x]
R3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0017mdm.sys [x]
R3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0017mgmt.sys [x]
R3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\DRIVERS\s0017nd5.sys [x]
R3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0017obex.sys [x]
R3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\DRIVERS\s0017unic.sys [x]
R3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\DRIVERS\s816bus.sys [x]
R3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s816mdfl.sys [x]
R3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s816mdm.sys [x]
R3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s816mgmt.sys [x]
R3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:\windows\system32\DRIVERS\s816nd5.sys [x]
R3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s816obex.sys [x]
R3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:\windows\system32\DRIVERS\s816unic.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
S1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [2011-05-19 23208]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 OADevice;OADriver;c:\windows\SysWow64\Drivers\OADriver.sys [2011-11-01 59176]
S1 OAmon;OAmon;c:\windows\SysWOW64\Drivers\OAmon.sys [2011-11-01 38064]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 a2AntiMalware;Emsisoft Anti-Malware 6.0 - Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [2011-12-22 2998832]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-10-11 86224]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]
S2 OAcat;Online Armor Helper Service;c:\program files (x86)\Online Armor\OAcat.exe [2011-11-01 207936]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2010-11-30 2222376]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 OAnet;OnlineArmor Service;c:\windows\system32\DRIVERS\oanet.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai	REG_MULTI_SZ   	Akamai
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-02 16330272]
"@OnlineArmor GUI"="c:\program files (x86)\Online Armor\oaui.exe" [2011-11-01 2531104]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\System32\acaptuser64.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1060933
uInternet Settings,ProxyOverride = *.local
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Free YouTube Download - c:\users\Raymous\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\users\Raymous\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Raymous\AppData\Roaming\Mozilla\Firefox\Profiles\cor0y9ui.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.6&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
URLSearchHooks-{EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{40C3CC16-7269-4B32-9531-17F2950FB06F} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_b427739.dll"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10d.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10d.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
c:\program files (x86)\ASUS\ATK Hotkey\HControl.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\mmrtkrnl.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-01-13  20:10:45 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-01-13 19:10
.
Vor Suchlauf: 17 Verzeichnis(se), 34.830.647.296 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 34.389.499.904 Bytes frei
.
- - End Of File - - FB5EEE2FE088F63F48122A2ACE479372

markusg · 14.01.2012, 16:45

öffne malwarebytes, update, update einspielen.
dann einen vollständigen scan.

Raymous · 14.01.2012, 21:08

HIer die Logdatei nach dem Suchlauf

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.14.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Raymous :: RAYMOUS-PC [Administrator]

Schutz: Aktiviert

14.01.2012 18:08:10
mbam-log-2012-01-14 (21-05-54).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 398673
Laufzeit: 2 Stunde(n), 57 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 6
C:\Casino\21Nova Casino\_SetupCasino_252a76_de.exe (PUP.Casino) -> Keine Aktion durchgeführt.
C:\Casino\EuroGrand Casino\_SetupCasino_1349c3_de.exe (PUP.Casino) -> Keine Aktion durchgeführt.
C:\Casino\Joyland Casino\_SetupCasino_b79fad_de.exe (PUP.Casino) -> Keine Aktion durchgeführt.
C:\Casino\Prestige Casino\_SetupCasino_5456cb_de.exe (PUP.Casino) -> Keine Aktion durchgeführt.
C:\Casino\William Hill CASINO CLUB\_SetupCasino_eeb178_de.exe (PUP.Casino) -> Keine Aktion durchgeführt.
C:\Program Files\Fighters\SLOW-PCfighter\SLOW-PCfighter.exe.mwt (Trojan.Agent) -> Keine Aktion durchgeführt.

(Ende)

markusg · 15.01.2012, 16:45

hi

lade den CCleaner standard:
CCleaner Download - CCleaner 3.14.1616
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Raymous · 16.01.2012, 15:59

So hier die Liste

Code:

ATTFilter

Adobe Acrobat 9 Pro Extended - English, Français, Deutsch	Adobe Systems	18.05.2011		9.4.4 notwendig
Adobe Acrobat 9 Pro Extended 64-bit Add-On	Adobe Systems Incorporated	28.08.2010	38,00KB	9.0.0notwenidig
Adobe After Effects CS5	Adobe Systems Incorporated	30.01.2011	2.146MB	10 notwendig
Adobe After Effects CS5 Third Party Content	Adobe Systems Incorporated	06.11.2011	171,0MB	10.0.2 notwendig
Adobe After Effects CS5 Third Party Royalty Content	Adobe Systems Incorporated	06.11.2011	11,5MB	10.0.2 notwendig
Adobe AIR	Adobe Systems Inc.	30.01.2011		1.5.3.9120 unbekannt
Adobe Community Help	Adobe Systems Incorporated	30.01.2011		3.0.0.400 unnötig
Adobe Flash Player 10 ActiveX	Adobe Systems Incorporated	04.02.2010		10.0.42.34 unbekannt
Adobe Flash Player 11 Plugin	Adobe Systems Incorporated	05.11.2011	6,00MB	11.0.1.152 unbekannt
Adobe Media Player	Adobe Systems Incorporated	30.01.2011		1.8 notwendig
Adobe Reader 9.3 - Deutsch	Adobe Systems Incorporated	23.02.2010	240MB	9.3.0 notwendig
Akamai NetSession Interface		19.12.2011		unbekannt
Akamai NetSession Interface Service		09.11.2011	unbekannt	
Alcor Micro USB Card Reader	Alcor Micro Corp.	04.02.2010	2,90MB	1.4.1217.35202 notwednig
Apple Application Support	Apple Inc.	18.12.2011	61,1MB	2.1.6 notwendig
Apple Mobile Device Support	Apple Inc.	27.11.2011	24,4MB	4.0.0.97 notwendig
Apple Software Update	Apple Inc.	25.06.2011	2,25MB	2.1.3.127notwendig
ASUS Live Update	ASUS	04.02.2010		2.5.9 notwendig
ATK Hotkey	ASUS	04.02.2010	5,75MB	1.0.0053 unbekannt
Avanquest update	Avanquest Software	16.05.2011		1.29 unbekannt
Avira Free Antivirus	Avira	23.12.2011	104,8MB	12.0.0.872 notwendig
Belkasoft Forensic Carver		15.05.2011		 unbekannt
Bonjour	Apple Inc.	04.11.2011	1,46MB	3.0.0.10 unbekannt
CCleaner	Piriform	14.01.2012		3.14 notwendig
Counter-Strike: Source	Valve	19.02.2010	4.597MB	1.0.0.0 notwendig
Counter-Strike: Source Beta		09.12.2011		notwendig
DivX-Setup	DivX, Inc. 	08.04.2010		1.0.1.4 unbekannt
Emsisoft Anti-Malware	Emsi Software GmbH	11.01.2012	167,5MB	6.0 notwendig
eXPert PDF 4	Visage Software	29.08.2010	33,2MB	4.1.670.404 unnötig
ffdshow [rev 2527] [2008-12-19]		09.02.2010		1.0 unbekannt
Free Studio version 5.1.6	DVDVideoSoft Limited.	15.08.2011	341MB notwendig	
Free YouTube Download version 2.10.35.426	DVDVideoSoft Limited.	14.05.2011	27,2MB notwendig	
Free YouTube to MP3 Converter version 3.10.11.923	DVDVideoSoft Ltd.	14.11.2011	42,4MB	notwendig
GIMP 2.6.8		22.02.2010		notwendig
Hamster Free Video Converter	Hamster Soft	27.09.2011	16,2MB	2.0.1.25 unnötig
iCloud	Apple Inc.	18.12.2011	31,2MB	1.0.2.17 unnötig
iTunes	Apple Inc.	18.12.2011	170,5MB	10.5.2.11 notwendig
Java(TM) 6 Update 21	Sun Microsystems, Inc.	15.06.2010	94,5MB	6.0.210 unbekannt
JDownloader	AppWork UG (haftungsbeschränkt)	12.02.2010		0.89 unnötig
LSI HDA Modem	LSI Corporation	04.02.2010	16,00KB	2.2.95.1 unbekannt
Malwarebytes Anti-Malware Version 1.60.0.1800	Malwarebytes Corporation	12.01.2012	18,6MB	1.60.0.1800 notwendig
Media Player Classic - Home Cinema v. 1.3.1249.0		09.02.2010		notwendig
Microsoft .NET Framework 1.1	Microsoft	17.07.2010	34,8MB	1.1.4322 unbekannt
Microsoft .NET Framework 4 Client Profile	Microsoft Corporation	10.11.2010	38,8MB	4.0.30319 unbekannt
Microsoft DirectX SDK (February 2010)	Microsoft Corporation	31.03.2010		9.28.1886.0unbekannt
Microsoft LifeCam	Microsoft Corporation	15.08.2010	60,6MB	3.22.270.0 notwendig
Microsoft Office Enterprise 2007	Microsoft Corporation	20.09.2010		12.0.6425.1000 unnötig
Microsoft Office File Validation Add-In	Microsoft Corporation	07.11.2011	7,95MB	14.0.5130.5003 unbekannt
Microsoft Office Visio Professional 2003	Microsoft Corporation	27.09.2011	431MB	11.0.8173.0 notwendig
Microsoft Silverlight	Microsoft Corporation	20.10.2011	174,2MB	4.0.60831.0  unbekannt
Microsoft Visual C++ 2005 Redistributable	Microsoft Corporation	15.06.2011	0,29MB	8.0.61001 unbekannt
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148	Microsoft Corporation	20.02.2010	0,21MB	9.0.30729.4148 unbekannt
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148	Microsoft Corporation	05.02.2010	0,20MB	9.0.30729.4148 unbekannt
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022	Microsoft Corporation	06.03.2010	1,71MB	9.0.21022 unbekannt
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17	Microsoft Corporation	20.02.2010	0,77MB	9.0.30729 unbekannt
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161	Microsoft Corporation	15.06.2011	0,77MB	9.0.30729.6161 unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218	Microsoft Corporation	06.03.2010	0,23MB	9.0.21022.218 unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17	Microsoft Corporation	04.02.2010	0,58MB	9.0.30729 unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148	Microsoft Corporation	10.02.2010	0,58MB	9.0.30729.4148 unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161	Microsoft Corporation	15.06.2011	0,59MB	9.0.30729.6161 unbekannt
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219	Microsoft Corporation	20.10.2011	12,3MB	10.0.40219 unbekannt
MobileMe Control Panel	Apple Inc.	06.11.2011	12,9MB	3.1.8.0 notwendig
Motherboard Monitor 5	Alexander van Kaam	11.12.2010		5 unbekannt
Mozilla Firefox 9.0.1 (x86 de)	Mozilla	12.01.2012	38,6MB	9.0.1 notwendig
MSXML 4.0 SP2 (KB954430)	Microsoft Corporation	18.03.2010	1,28MB	4.20.9870.0 unbekannt
MSXML 4.0 SP2 (KB973688)	Microsoft Corporation	18.03.2010	1,33MB	4.20.9876.0 unbekannt
NVIDIA Drivers	NVIDIA Corporation	04.02.2010		1.7 notwendig
Oblivion	Bethesda Softworks	02.01.2012		1.00.0000 notwendig
Online Armor 5.1	Emsi Software GmbH	11.01.2012	60,8MB	5.1 unnötig
OpenOffice.org 3.2	OpenOffice.org	06.03.2010	373MB	3.2.9483 notwendig
phonostar-Player Version 3.02.4		14.01.2012		notwendig
Power Sound Editor Free	PowerSoundEditorFree Inc.	17.03.2010	notwendig	
QuickTime	Apple Inc.	04.11.2011	73,3MB	7.71.80.42 notwendig
RealPlayer	RealNetworks	14.11.2011		unbekannt
Safari	Apple Inc.	18.12.2011	43,3MB	5.34.52.7 notwendig
Spelling Dictionaries Support For Adobe Reader 9	Adobe Systems Incorporated	28.08.2010	29,7MB	9.0.0 unbekannt
Steam(TM)	Valve	19.02.2010	16,6MB	1.0.0.0 notwendig
TeamViewer 6	TeamViewer GmbH	06.12.2010		6.0.9895 notwendig
Uninstall 1.0.0.1		10.05.2011	11,2MB	unbekannt
Vegas Pro 9.0	Sony	27.04.2010	326MB	9.0.1133 notwendig
Vegas Pro 9.0 (64-bit)	Sony	20.02.2010	321MB	9.0.771 notwendig
VLC media player 1.0.5	VideoLAN Team	04.02.2010		1.0.5 notwendig
Windows Live Essentials	Microsoft Corporation	05.08.2011		15.4.3538.0513 notwendig
Windows Media Player Firefox Plugin	Microsoft Corp	07.08.2010	0,29MB	1.0.0.8 unbekannt
Winload Toolbar		07.08.2010		unbekannt
WinRAR		12.02.2010		notwendig

markusg · 16.01.2012, 16:59

deinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
Akamai beide
DivX
Avira wenn du emsisoft nutzen willst, wozu ich dir raten würde, dann muss avira runter, emsisoft kann man für 10 € bekommen für eine 1 jahres lizenz, link bekommst du falls gewünscht
deinstaliere
eXPert
Hamster Free
iCloud
Java
Download der kostenlosen Java-Software
downloade java jre instalieren

deinstaliere
JDownloader
Online Armor

öffne otl, klicke bereinigen, neustart durchführen
öffne CCleaner analysieren bereinigen.
neustarten, testen ob alles läuft wie gewünscht

Raymous · 18.01.2012, 20:03

OK alles gemacht

1. Könntest du mir den Link für Emsidoft geben, würde das gerne nutzen
2. Benötige ich sonst noch einen Schutz auf meinem Lappy außer Emsisoft Malware deiner Erfahrung nach
3. Vielen vielen Dank für die Hilfe ich werde euch auf jeden Fall weiterempfehlen
- Die Beschreibung der einzelnen Schritte ist top
- Die geposteten Links funktionieren alle (is ja nich immer der Fall^^)
- Das Ergebnis ist super!!!

13.01.2012, 18:07	#4
markusg /// Malware-holic	Windowssystem blockiert! AntiVir Upgrade für 50€ soll geladen werden dann weiter mit dem upload. __________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet

13.01.2012, 18:14	#6
markusg /// Malware-holic	Windowssystem blockiert! AntiVir Upgrade für 50€ soll geladen werden wo steht hier was von malwarebytes. arbeite das vernünftig ab was ich dir schreibe, und nicht nur die hälfte, und mach nichts was nicht angefordert wurde... __________________ --> Windowssystem blockiert! AntiVir Upgrade für 50€ soll geladen werden

Windowssystem blockiert! AntiVir Upgrade für 50€ soll geladen werden

Log-Analyse und Auswertung: Windowssystem blockiert! AntiVir Upgrade für 50€ soll geladen werden