Gema Trojaner 2.05 OTL !

TommyParavi · 24.03.2012, 21:44

Hallo, habe den Gema virus auch und habe mein pc mit OTL gescannt aber brauche das neue Script was ich in das Custom scans/Fixes einfügen muss.
Hier die Extras.Txt und OTL.Txt

Code:

ATTFilter

OTL Extras logfile created on: 24.03.2012 21:29:12 - Run 2
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Divan\Desktop
 Enterprise Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,93 Gb Total Physical Memory | 1,79 Gb Available Physical Memory | 61,07% Memory free
5,86 Gb Paging File | 4,50 Gb Available in Paging File | 76,79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,79 Gb Total Space | 100,37 Gb Free Space | 43,12% Space Free | Partition Type: NTFS
Drive D: | 100,00 Mb Total Space | 71,70 Mb Free Space | 71,70% Space Free | Partition Type: NTFS
 
Computer Name: TOMMY-PC | User Name: Tommy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-1386417269-986701621-1243459835-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83217002FF}" = Java(TM) 7 Update 2
"{2F603A45-D956-496B-81B5-50D782424976}" = SweetPacks Toolbar for Internet Explorer 4.4
"{37476589-E48E-439E-A706-56189E2ED4C4}" = TheBflix
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5EBAC9CB-97D7-44CD-A82D-4FCB37F582AC}" = World Racing 2
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{782AE8DA-30DA-44bd-BA9A-9F23B8A4AC79}" = pdfforge Toolbar v5.1
"{80304C76-723D-4472-B0E8-4094624566A3}_is1" = Counter-Strike Source 4426
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{943A8D28-80D6-41DC-AE94-81FEB42041BF}" = System Requirements Lab CYRI
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch
"{B85C4CB2-B352-4BD8-818C-BCE353599107}" = SweetIM for Messenger 3.6
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"Azureus" = Azureus
"BabylonToolbar" = Babylon toolbar on IE
"BitTorrent" = BitTorrent
"BittorrentBar_DE Toolbar" = BittorrentBar_DE Toolbar
"Counter-Strike 1.6 V40.1" = Counter-Strike 1.6 V40.1
"DAEMON Tools Lite" = DAEMON Tools Lite
"Empire - Total War (RePack by spider91)_is1" = Empire - Total War
"Fraps" = Fraps (remove only)
"Free Screen Video Recorder_is1" = Free Screen Video Recorder version 2.5.19.1228
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.15.1228
"incredibar" = Incredibar Toolbar  on IE and Chrome
"InstallShield_{5EBAC9CB-97D7-44CD-A82D-4FCB37F582AC}" = World Racing 2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)
"PriceGong" = PriceGong 2.5.4
"San Andreas Mod Installer1.1" = San Andreas Mod Installer
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"uTorrent" = µTorrent
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinRAR archiver" = WinRAR 4.01 (32-Bit)
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1386417269-986701621-1243459835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"RedLight Evolution" = RedLight Evolution
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1386417269-986701621-1243459835-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ExpressFiles" = ExpressFiles
"Google Chrome" = Google Chrome
"phonostar3RadioPlayer_is1" = phonostar-Player Version 3.02.4
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 12.03.2012 19:11:09 | Computer Name = Tommy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: MP Lounge 2.exe, Version: 0.0.0.0,
 Zeitstempel: 0x4370bfda  Name des fehlerhaften Moduls: MP Lounge 2.exe, Version: 
0.0.0.0, Zeitstempel: 0x4370bfda  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00014b90
ID
 des fehlerhaften Prozesses: 0x9c8  Startzeit der fehlerhaften Anwendung: 0x01cd00a5381fc244
Pfad
 der fehlerhaften Anwendung: C:\Program Files\Playlogic\World Racing 2\MP Lounge
 2.exe  Pfad des fehlerhaften Moduls: C:\Program Files\Playlogic\World Racing 2\MP
 Lounge 2.exe  Berichtskennung: a664247c-6c98-11e1-a531-001f16b24209
 
Error - 14.03.2012 20:21:44 | Computer Name = Tommy-PC | Source = Application Hang | ID = 1002
Description = Programm engine.exe, Version 0.0.0.0 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 3a0    Startzeit: 
01cd023f01c26851    Endzeit: 109    Anwendungspfad: C:\Program Files\RedLight Evolution21-10-2011\engine.exe

Berichts-ID:
 d4a28155-6e34-11e1-bf4f-001f16b24209  
 
Error - 17.03.2012 18:35:42 | Computer Name = Tommy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: MP Lounge 2.exe, Version: 0.0.0.0,
 Zeitstempel: 0x4370bfda  Name des fehlerhaften Moduls: MP Lounge 2.exe, Version: 
0.0.0.0, Zeitstempel: 0x4370bfda  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00014b90
ID
 des fehlerhaften Prozesses: 0x544  Startzeit der fehlerhaften Anwendung: 0x01cd048dd960d685
Pfad
 der fehlerhaften Anwendung: C:\Program Files\Playlogic\World Racing 2\MP Lounge
 2.exe  Pfad des fehlerhaften Moduls: C:\Program Files\Playlogic\World Racing 2\MP
 Lounge 2.exe  Berichtskennung: 86ed43fc-7081-11e1-8365-001f16b24209
 
Error - 17.03.2012 18:53:04 | Computer Name = Tommy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: MP Lounge 2.exe, Version: 0.0.0.0,
 Zeitstempel: 0x4370bfda  Name des fehlerhaften Moduls: MP Lounge 2.exe, Version: 
0.0.0.0, Zeitstempel: 0x4370bfda  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00014b90
ID
 des fehlerhaften Prozesses: 0xbb0  Startzeit der fehlerhaften Anwendung: 0x01cd048e63391c79
Pfad
 der fehlerhaften Anwendung: C:\Program Files\Playlogic\World Racing 2\MP Lounge
 2.exe  Pfad des fehlerhaften Moduls: C:\Program Files\Playlogic\World Racing 2\MP
 Lounge 2.exe  Berichtskennung: f3fab738-7083-11e1-8365-001f16b24209
 
Error - 18.03.2012 17:40:33 | Computer Name = Tommy-PC | Source = Application Hang | ID = 1002
Description = Programm samp.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt
 werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: cb8    Startzeit: 
01cd054fb4aee316    Endzeit: 0    Anwendungspfad: C:\Users\Tommy\Documents\Games\Grand Theft
 Auto San Andreas\samp.exe    Berichts-ID: f889d59a-7142-11e1-8087-001f16b24209  
 
Error - 18.03.2012 17:41:59 | Computer Name = Tommy-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 9.0.8112.16421 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 848    Startzeit: 01cd054fa6e27768    Endzeit: 30    Anwendungspfad: 
C:\Program Files\Internet Explorer\iexplore.exe    Berichts-ID:   
 
Error - 19.03.2012 21:47:50 | Computer Name = Tommy-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 10.0.1.4421 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: da4    Startzeit: 
01cd063b63fbbc62    Endzeit: 40    Anwendungspfad: C:\Program Files\Mozilla Firefox\firefox.exe

Berichts-ID:
 b1a054c9-722e-11e1-a674-001f16b24209  
 
Error - 19.03.2012 22:17:54 | Computer Name = Tommy-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 10.0.1.4421 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 9c8    Startzeit: 
01cd063fa137994d    Endzeit: 60    Anwendungspfad: C:\Program Files\Mozilla Firefox\firefox.exe

Berichts-ID:
 e4507428-7232-11e1-a674-001f16b24209  
 
Error - 23.03.2012 22:53:58 | Computer Name = Tommy-PC | Source = EventSystem | ID = 4621
Description = 
 
Error - 23.03.2012 22:56:58 | Computer Name = Tommy-PC | Source = Application Hang | ID = 1002
Description = Programm gema.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt
 werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 134    Startzeit: 
01cd09699a682cb5    Endzeit: 16    Anwendungspfad: C:\Users\Tommy\AppData\Roaming\gema\gema.exe

Berichts-ID:
 fe593e40-755c-11e1-90c6-001f16b24209  
 
[ System Events ]
Error - 24.03.2012 15:19:33 | Computer Name = Tommy-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?24.?03.?2012 um 20:18:49 unerwartet heruntergefahren.
 
Error - 24.03.2012 15:19:48 | Computer Name = Tommy-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   sfdrv01  sfsync02  sfvfs02
 
Error - 24.03.2012 15:26:41 | Computer Name = Tommy-PC | Source = cdrom | ID = 262159
Description = Das Gerät \Device\CdRom0 ist für den Zugriff noch nicht bereit.
 
Error - 24.03.2012 15:26:41 | Computer Name = Tommy-PC | Source = cdrom | ID = 262159
Description = Das Gerät \Device\CdRom0 ist für den Zugriff noch nicht bereit.
 
Error - 24.03.2012 15:26:41 | Computer Name = Tommy-PC | Source = cdrom | ID = 262159
Description = Das Gerät \Device\CdRom0 ist für den Zugriff noch nicht bereit.
 
Error - 24.03.2012 15:26:41 | Computer Name = Tommy-PC | Source = cdrom | ID = 262159
Description = Das Gerät \Device\CdRom0 ist für den Zugriff noch nicht bereit.
 
Error - 24.03.2012 15:26:41 | Computer Name = Tommy-PC | Source = cdrom | ID = 262159
Description = Das Gerät \Device\CdRom0 ist für den Zugriff noch nicht bereit.
 
Error - 24.03.2012 15:26:41 | Computer Name = Tommy-PC | Source = cdrom | ID = 262159
Description = Das Gerät \Device\CdRom0 ist für den Zugriff noch nicht bereit.
 
Error - 24.03.2012 15:26:41 | Computer Name = Tommy-PC | Source = atapi | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.
 
Error - 24.03.2012 15:26:41 | Computer Name = Tommy-PC | Source = cdrom | ID = 262159
Description = Das Gerät \Device\CdRom0 ist für den Zugriff noch nicht bereit.
 
 
< End of report >

Code:

ATTFilter

OTL logfile created on: 24.03.2012 21:29:12 - Run 2
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Divan\Desktop
 Enterprise Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,93 Gb Total Physical Memory | 1,79 Gb Available Physical Memory | 61,07% Memory free
5,86 Gb Paging File | 4,50 Gb Available in Paging File | 76,79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,79 Gb Total Space | 100,37 Gb Free Space | 43,12% Space Free | Partition Type: NTFS
Drive D: | 100,00 Mb Total Space | 71,70 Mb Free Space | 71,70% Space Free | Partition Type: NTFS
 
Computer Name: TOMMY-PC | User Name: Tommy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.24 20:44:47 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Divan\Desktop\OTL (2).exe
PRC - [2012.03.24 03:42:38 | 000,243,712 | ---- | M] () -- C:\Users\Tommy\AppData\Roaming\gema\gema.exe
PRC - [2012.03.12 20:27:48 | 000,250,528 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil11g_ActiveX.exe
PRC - [2012.03.07 22:34:50 | 000,741,240 | ---- | M] (BitTorrent, Inc.) -- C:\Programme\uTorrent\uTorrent.exe
PRC - [2012.03.04 22:48:40 | 000,934,752 | ---- | M] (Spigot, Inc.) -- C:\Programme\Common Files\Spigot\Search Settings\SearchSettings.exe
PRC - [2012.03.04 22:40:10 | 000,748,440 | ---- | M] (Spigot, Inc.) -- C:\Programme\Application Updater\ApplicationUpdater.exe
PRC - [2012.02.13 09:06:52 | 002,602,304 | ---- | M] (DT Soft Ltd) -- C:\Programme\DAEMON Tools Lite\DTShellHlp.exe
PRC - [2012.01.31 20:38:51 | 000,424,568 | ---- | M] (hxxp://www.express-files.com/) -- C:\Programme\ExpressFiles\ExpressFiles.exe
PRC - [2012.01.19 12:30:04 | 000,114,992 | R--- | M] (SweetIM Technologies Ltd.) -- C:\Programme\SweetIM\Messenger\SweetIM.exe
PRC - [2012.01.12 00:49:38 | 006,054,256 | ---- | M] (BitTorrent, Inc.) -- C:\Programme\BitTorrent\BitTorrent.exe
PRC - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.01.01 02:11:05 | 000,748,336 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe
PRC - [2011.12.23 15:28:00 | 000,041,472 | ---- | M] () -- C:\Users\Divan\Documents\phonostar-Player\phonostarTimer.exe
PRC - [2011.12.15 15:00:00 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.12.15 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.07.16 05:31:12 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.16 05:25:09 | 000,717,824 | ---- | M] (Bliz0R) -- C:\Programme\RedLight Evolution21-10-2011\RedLight Evolution.exe
PRC - [2009.07.14 02:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009.07.14 02:14:38 | 001,173,504 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.03.24 03:42:38 | 000,243,712 | ---- | M] () -- C:\Users\Tommy\AppData\Roaming\gema\gema.exe
MOD - [2012.02.17 09:57:46 | 001,670,144 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\4745cd79cd87ef98af5163b152088e28\Microsoft.VisualBasic.ni.dll
MOD - [2012.02.17 03:48:51 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0a894f77b9aa64acbd3ce791916357d8\System.Runtime.Remoting.ni.dll
MOD - [2012.02.17 03:48:07 | 012,431,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ff30db6905f8ec024fc808ed8779c0f3\System.Windows.Forms.ni.dll
MOD - [2012.02.17 03:47:53 | 001,586,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\a09ee392fa90849f2e9313a1ebbe0279\System.Drawing.ni.dll
MOD - [2012.02.17 03:47:00 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49f4cb0755ccc34cd35ff96dc2ef9e3\System.Xml.ni.dll
MOD - [2012.02.17 03:46:54 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\15742b3597258ce67cbe219005c197e5\System.Configuration.ni.dll
MOD - [2012.02.17 03:46:50 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1f14b3e1ee0847f8662f513e67f92547\System.ni.dll
MOD - [2012.01.03 15:00:36 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll
MOD - [2011.12.23 15:28:00 | 000,041,472 | ---- | M] () -- C:\Users\Divan\Documents\phonostar-Player\phonostarTimer.exe
MOD - [2011.06.15 13:07:10 | 002,293,248 | ---- | M] () -- C:\Users\Divan\Documents\phonostar-Player\QtCore4.dll
MOD - [2011.05.28 22:04:56 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2011.03.30 10:46:40 | 000,416,256 | ---- | M] () -- C:\Users\Divan\Documents\phonostar-Player\plugins\sqldrivers\qsqlite4.dll
MOD - [2011.03.30 07:16:34 | 008,173,568 | ---- | M] () -- C:\Users\Divan\Documents\phonostar-Player\QtGui4.dll
MOD - [2011.03.30 06:59:40 | 000,191,488 | ---- | M] () -- C:\Users\Divan\Documents\phonostar-Player\QtSql4.dll
MOD - [2009.07.14 09:54:34 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2009.07.14 09:54:32 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.07.14 09:54:32 | 000,208,896 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.03.04 22:40:10 | 000,748,440 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Programme\Application Updater\ApplicationUpdater.exe -- (Application Updater)
SRV - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.07.14 09:56:28 | 000,017,920 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\System32\wlms\wlms.exe -- (WLMS)
SRV - [2009.07.14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.07.14 02:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (amifqqre)
DRV - [2012.03.07 22:51:34 | 000,473,656 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2012.03.07 22:46:50 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2012.02.15 17:57:51 | 000,137,416 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.12.15 15:00:00 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.12.15 15:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.10.07 10:24:36 | 000,126,976 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.07.14 02:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2009.07.14 02:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2009.07.14 02:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2009.07.14 00:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009.07.14 00:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2009.07.14 00:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2009.07.13 23:13:48 | 001,035,776 | ---- | M] (LSI Corp) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2009.07.13 23:02:49 | 000,229,888 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\k57nd60x.sys -- (k57nd60x) Broadcom NetLink (TM)
DRV - [2009.07.13 23:02:46 | 001,096,704 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2005.08.24 14:55:48 | 000,066,560 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x)
DRV - [2005.08.10 15:06:28 | 000,019,968 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\sfsync02.sys -- (sfsync02) StarForce Protection Synchronization Driver (version 2.x)
DRV - [2005.08.10 13:44:04 | 000,050,688 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2005.05.16 14:20:39 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Programme\BittorrentBar_DE\prxtbBit0.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms}
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 97 19 6D AA 22 C8 CC 01  [binary data]
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\URLSearchHook: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Programme\BittorrentBar_DE\prxtbBit0.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\SearchScopes,DefaultScope = {4D632744-B696-48D6-B3AF-B7C0E581C978}
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/web/{searchTerms}?babsrc=SP_ss&affID=110482&mntrId=3affef9d00000000000006225fedc958
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\SearchScopes\{4D632744-B696-48D6-B3AF-B7C0E581C978}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms}
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\SearchScopes\{B1C51B79-9B38-4234-9DD5-B2D24828ED9D}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2849855
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb106/?search={searchTerms}&loc=IB_DS&a=6OyovPlcB2&i=26
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 99 70 6D 72 43 C9 CC 01  [binary data]
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1001\..\SearchScopes,DefaultScope = {44AD2780-5C97-4FD4-90BB-D9A41D18A4F6}
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1001\..\SearchScopes\{44AD2780-5C97-4FD4-90BB-D9A41D18A4F6}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaultthis.engineName: "BittorrentBar_DE Customized Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316&ilc=12"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://mystart.incredibar.com/mb106?a=6OyovPlcB2&i=26"
FF - prefs.js..keyword.URL: "hxxp://mystart.incredibar.com/mb106/?loc=IB_DS&a=6OyovPlcB2&&i=26&search="
FF - prefs.js..network.proxy.type: 0
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2849855&SearchSource=3&q={searchTerms}"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "MyStart Search"
FF - prefs.js..browser.startup.homepage: "hxxp://mystart.incredibar.com/mb106?a=6OyovPlcB2&i=26"
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.23 03:37:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012.02.27 01:22:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tommy\AppData\Roaming\mozilla\Extensions
[2012.03.12 18:13:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tommy\AppData\Roaming\mozilla\Firefox\Profiles\9v00ijvq.default\extensions
[2012.03.09 03:02:04 | 000,000,000 | ---D | M] (BittorrentBar_DE Community Toolbar) -- C:\Users\Tommy\AppData\Roaming\mozilla\Firefox\Profiles\9v00ijvq.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}
[2012.02.27 01:20:18 | 000,000,000 | ---D | M] (PriceGong) -- C:\Users\Tommy\AppData\Roaming\mozilla\Firefox\Profiles\9v00ijvq.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}
[2012.01.11 03:15:21 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Tommy\AppData\Roaming\mozilla\Firefox\Profiles\9v00ijvq.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.02.27 01:22:16 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Tommy\AppData\Roaming\mozilla\Firefox\Profiles\9v00ijvq.default\extensions\ffxtlbr@babylon.com
[2012.03.09 01:45:11 | 000,000,000 | ---D | M] (TheBflix) -- C:\Users\Tommy\AppData\Roaming\mozilla\Firefox\Profiles\9v00ijvq.default\extensions\info@bflix.info
[2011.11.30 21:58:50 | 000,000,935 | ---- | M] () -- C:\Users\Tommy\AppData\Roaming\Mozilla\Firefox\Profiles\9v00ijvq.default\searchplugins\conduit.xml
[2012.01.01 23:33:34 | 000,002,203 | ---- | M] () -- C:\Users\Tommy\AppData\Roaming\Mozilla\Firefox\Profiles\9v00ijvq.default\searchplugins\MyStart Search.xml
[2012.01.30 16:02:08 | 000,003,915 | ---- | M] () -- C:\Users\Tommy\AppData\Roaming\Mozilla\Firefox\Profiles\9v00ijvq.default\searchplugins\SweetIM Search.xml
[2012.02.27 01:20:11 | 000,003,915 | ---- | M] () -- C:\Users\Tommy\AppData\Roaming\Mozilla\Firefox\Profiles\9v00ijvq.default\searchplugins\sweetim.xml
[2012.01.13 21:13:23 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.23 03:37:51 | 000,000,000 | ---D | M] (Widgi Toolbar Platform) -- C:\PROGRAM FILES\COMMON FILES\SPIGOT\WTXPCOM
[2012.03.12 18:13:18 | 000,000,000 | ---D | M] (pdfforge Toolbar) -- C:\PROGRAM FILES\PDFFORGE TOOLBAR\FF
[2012.03.23 03:37:50 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.26 21:39:45 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.29 02:43:10 | 000,002,288 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012.02.26 21:39:45 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.26 21:39:45 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.26 21:39:45 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.26 21:39:45 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.26 21:39:45 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.03.22 02:13:13 | 000,000,903 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: ::1         www.facebook.com
O1 - Hosts: 173.194.35.184         hxxp://de-de.facebook.com/
O2 - BHO: (Shopping Assistant Plugin) - {1631550F-191D-4826-B069-D9439253D926} - C:\Programme\PriceGong\2.5.4\PriceGongIE.dll (PriceGong)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (TheBflix Class) - {3D568DC4-D0DB-4EC0-BDF6-20BC87C3E0C9} - C:\ProgramData\TheBflix\bhoclass.dll (Injector)
O2 - BHO: (BittorrentBar_DE Toolbar) - {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Programme\BittorrentBar_DE\prxtbBit0.dll (Conduit Ltd.)
O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Programme\Incredibar.com\incredibar\1.5.3.27\bh\incredibar.dll (Montera Technologeis LTD)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (BittorrentBar_DE Toolbar) - {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Programme\BittorrentBar_DE\prxtbBit0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Programme\Incredibar.com\incredibar\1.5.3.27\incredibarTlbr.dll (Montera Technologeis LTD)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\Toolbar\WebBrowser: (BittorrentBar_DE Toolbar) - {64EAD72B-FFD4-4E01-AA3A-4C71665D73E4} - C:\Programme\BittorrentBar_DE\prxtbBit0.dll (Conduit Ltd.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ExpressFiles] C:\Program Files\ExpressFiles\ExpressFiles.exe (hxxp://www.express-files.com/)
O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000..\Run: [BitTorrent] C:\Program Files\BitTorrent\BitTorrent.exe (BitTorrent, Inc.)
O4 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000..\Run: [gema] C:\Users\Tommy\AppData\Roaming\gema\gema.exe ()
O4 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000..\Run: [Media Finder] "C:\Program Files\Media Finder\MF.exe" /opentotray File not found
O4 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - HKU\S-1-5-21-1386417269-986701621-1243459835-1001..\Run: [Media Finder] "C:\Program Files\Media Finder\MF.exe" /opentotray File not found
O4 - HKU\S-1-5-21-1386417269-986701621-1243459835-1001..\Run: [phonostarTimer] C:\Users\Divan\Documents\phonostar-Player\phonostarTimer.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Download with &Media Finder - C:\Program Files\Media Finder\hook.html File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Tommy\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.0)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab (SysInfo Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5854CD09-C763-4A22-939C-AA9DAF6EFA7D}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9ABCCBBF-F4D0-48C8-8257-76B536D439E2}: DhcpNameServer = 192.168.178.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (c:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000 Winlogon: Shell - (C:\Users\Tommy\AppData\Roaming\gema\gema.exe) - C:\Users\Tommy\AppData\Roaming\gema\gema.exe ()
O20 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000 Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.24 03:42:39 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\gema
[2012.03.24 03:42:38 | 000,000,000 | ---D | C] -- C:\ProgramData\gema
[2012.03.20 15:36:21 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\Malwarebytes
[2012.03.20 15:36:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.03.20 15:36:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.03.20 15:36:12 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.03.20 15:36:12 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.03.14 14:17:14 | 003,957,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2012.03.14 14:17:13 | 003,902,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2012.03.14 09:57:55 | 002,341,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.03.14 09:57:52 | 001,170,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2012.03.14 09:57:52 | 001,074,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2012.03.14 09:57:52 | 000,739,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2012.03.14 09:57:52 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2012.03.14 09:57:52 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2012.03.14 09:57:23 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll
[2012.03.14 09:57:23 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe
[2012.03.14 09:57:22 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2012.03.14 09:57:19 | 000,826,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcore.dll
[2012.03.12 23:40:01 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RedLight Evolution
[2012.03.12 23:32:35 | 000,000,000 | ---D | C] -- C:\Program Files\RedLight Evolution21-10-2011
[2012.03.12 18:13:16 | 000,000,000 | ---D | C] -- C:\Program Files\Application Updater
[2012.03.12 18:13:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Spigot
[2012.03.12 18:13:15 | 000,000,000 | ---D | C] -- C:\Program Files\pdfforge Toolbar
[2012.03.11 16:07:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012.03.11 16:07:17 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2012.03.11 15:49:10 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\Neuer Ordner
[2012.03.11 13:44:34 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\WR2Mods
[2012.03.10 22:23:12 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2012.03.09 03:51:08 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\wr2 edit car
[2012.03.09 03:47:27 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\world racing mods
[2012.03.09 03:47:24 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\KalOnline
[2012.03.09 03:47:04 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\crack wr2
[2012.03.09 03:46:51 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\Backup für crack
[2012.03.09 00:47:12 | 025,037,979 | ---- | C] (InstallShield Software Corporation                          ) -- C:\Users\Tommy\Desktop\WR2upd_111_133.exe
[2012.03.08 23:55:58 | 000,000,000 | ---D | C] -- C:\Program Files\InstallShield Installation Information
[2012.03.08 23:55:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World Racing 2
[2012.03.08 23:45:52 | 000,000,000 | ---D | C] -- C:\Program Files\Playlogic
[2012.03.08 23:45:00 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2012.03.08 23:44:12 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\wracing2
[2012.03.08 22:08:18 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\The Creative Assembly
[2012.03.08 22:06:49 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_40.dll
[2012.03.08 22:06:49 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_40.dll
[2012.03.08 22:06:48 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_3.dll
[2012.03.08 22:06:48 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_2.dll
[2012.03.08 22:06:48 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_3.dll
[2012.03.08 22:06:48 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_2.dll
[2012.03.08 22:06:48 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_1.dll
[2012.03.08 22:06:48 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_5.dll
[2012.03.08 22:06:47 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_39.dll
[2012.03.08 22:06:47 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_39.dll
[2012.03.08 22:06:47 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_39.dll
[2012.03.08 22:06:47 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_2.dll
[2012.03.08 22:06:46 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_1.dll
[2012.03.08 22:06:46 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_0.dll
[2012.03.08 22:06:45 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_38.dll
[2012.03.08 22:06:45 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_38.dll
[2012.03.08 22:06:45 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_1.dll
[2012.03.08 22:06:45 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_4.dll
[2012.03.08 22:06:44 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_38.dll
[2012.03.08 22:06:44 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_0.dll
[2012.03.08 22:06:43 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_37.dll
[2012.03.08 22:06:43 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_37.dll
[2012.03.08 22:06:43 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_0.dll
[2012.03.08 22:06:43 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_3.dll
[2012.03.08 22:06:42 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_37.dll
[2012.03.08 22:06:42 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_10.dll
[2012.03.08 22:06:41 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_36.dll
[2012.03.08 22:06:41 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_36.dll
[2012.03.08 22:06:41 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_36.dll
[2012.03.08 22:06:40 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_35.dll
[2012.03.08 22:06:40 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_35.dll
[2012.03.08 22:06:40 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_35.dll
[2012.03.08 22:06:40 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_9.dll
[2012.03.08 22:06:40 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_8.dll
[2012.03.08 22:06:40 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_2.dll
[2012.03.08 22:06:39 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_34.dll
[2012.03.08 22:06:39 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_34.dll
[2012.03.08 22:06:39 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_34.dll
[2012.03.08 22:06:38 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_7.dll
[2012.03.08 22:06:38 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_3.dll
[2012.03.08 22:06:37 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_33.dll
[2012.03.08 22:06:37 | 001,123,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_33.dll
[2012.03.08 22:06:37 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_33.dll
[2012.03.08 22:06:36 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_32.dll
[2012.03.08 22:06:36 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10.dll
[2012.03.08 22:06:36 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_6.dll
[2012.03.08 22:06:36 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_5.dll
[2012.03.08 22:06:35 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_31.dll
[2012.03.08 22:06:35 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_4.dll
[2012.03.08 22:06:35 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\x3daudio1_1.dll
[2012.03.08 22:06:34 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_3.dll
[2012.03.08 22:06:34 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_2.dll
[2012.03.08 22:06:34 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_1.dll
[2012.03.08 22:06:34 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_2.dll
[2012.03.08 22:06:34 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_1.dll
[2012.03.08 22:06:20 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_30.dll
[2012.03.08 22:06:19 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_29.dll
[2012.03.08 22:06:19 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_28.dll
[2012.03.08 22:06:19 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_27.dll
[2012.03.08 22:06:19 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_0.dll
[2012.03.08 22:06:19 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\x3daudio1_0.dll
[2012.03.08 22:06:18 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_26.dll
[2012.03.08 22:06:17 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_24.dll
[2012.03.08 22:04:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Empire - Total War
[2012.03.08 20:19:38 | 000,000,000 | ---D | C] -- C:\Program Files\Empire - Total War
[2012.03.08 16:39:54 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\Empire - Total War
[2012.03.08 15:26:41 | 000,000,000 | ---D | C] -- C:\ProgramData\TheBflix
[2012.03.08 15:26:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TheBflix
[2012.03.08 14:49:36 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Local\BittorrentBar_DE
[2012.03.07 22:51:34 | 000,473,656 | ---- | C] (Duplex Secure Ltd.) -- C:\Windows\System32\drivers\sptd.sys
[2012.03.07 22:50:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
[2012.03.07 22:46:50 | 000,242,240 | ---- | C] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys
[2012.03.07 22:46:42 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite
[2012.03.07 22:45:36 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\DAEMON Tools Lite
[2012.03.07 22:45:34 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite
[2012.03.07 22:34:50 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent
[2012.03.07 22:34:13 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\uTorrent
[2012.03.06 21:10:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DigitalZone
[2012.02.28 17:59:08 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Local\Google
[2012.02.28 17:59:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Google
[2012.02.28 17:59:02 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2012.02.28 17:57:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2012.02.28 17:57:42 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2012.02.28 17:56:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2012.02.28 17:46:45 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\pdfforge
[2012.02.28 17:46:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
[2012.02.28 17:46:41 | 000,662,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSCOMCT2.OCX
[2012.02.28 17:46:41 | 000,137,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSMAPI32.OCX
[2012.02.28 17:46:40 | 000,158,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSCMCDE.DLL
[2012.02.28 17:46:40 | 000,125,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\VB6DE.DLL
[2012.02.28 17:46:39 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSCC2DE.DLL
[2012.02.28 17:46:39 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSMPIDE.DLL
[2012.02.28 17:46:39 | 000,000,000 | ---D | C] -- C:\Program Files\PDFCreator
[2012.02.27 20:29:32 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\Download
[2012.02.27 01:22:18 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\Media Finder
[2012.02.27 01:20:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PriceGong
[2012.02.27 01:20:17 | 000,000,000 | ---D | C] -- C:\Program Files\PriceGong
[2012.02.27 01:20:05 | 000,000,000 | ---D | C] -- C:\ProgramData\SweetIM
[2012.02.27 01:20:05 | 000,000,000 | ---D | C] -- C:\Program Files\SweetIM
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.24 21:14:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.24 21:08:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1386417269-986701621-1243459835-1001UA.job
[2012.03.24 20:28:57 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.24 20:23:46 | 000,664,634 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.24 20:23:46 | 000,624,776 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.24 20:23:46 | 000,134,770 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.24 20:23:46 | 000,110,414 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.24 20:19:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.24 20:19:24 | 2359,951,360 | -HS- | M] () -- C:\hiberfil.sys
[2012.03.24 20:17:47 | 000,009,936 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.24 20:17:47 | 000,009,936 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.24 17:08:02 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1386417269-986701621-1243459835-1001Core.job
[2012.03.22 02:13:13 | 000,000,903 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.03.20 20:23:58 | 000,002,057 | ---- | M] () -- C:\Users\Tommy\Desktop\KalOnline RedLight.lnk
[2012.03.20 15:36:15 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.03.20 01:16:13 | 000,010,411 | ---- | M] () -- C:\Users\Tommy\.recently-used.xbel
[2012.03.14 14:23:48 | 000,265,640 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.03.14 14:19:47 | 000,000,129 | ---- | M] () -- C:\Windows\System32\MRT.INI
[2012.03.12 21:36:37 | 000,000,951 | ---- | M] () -- C:\Users\Tommy\Desktop\Empire - Total War.lnk
[2012.03.12 20:27:48 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.03.11 16:14:21 | 076,050,636 | ---- | M] () -- C:\Users\Tommy\Desktop\WR2_Akina_Mountain_Mindkiller.7z
[2012.03.11 16:10:14 | 039,577,870 | ---- | M] () -- C:\Users\Tommy\Desktop\Autumn_Driving_RaoulEmilian.rar
[2012.03.11 16:05:53 | 063,119,096 | ---- | M] () -- C:\Users\Tommy\Desktop\gr2_wr2_gk_bw_stadt.7z
[2012.03.11 13:38:36 | 762,695,948 | ---- | M] () -- C:\Users\Tommy\Desktop\RedLight_Setup21102011.exe
[2012.03.11 00:08:53 | 011,665,358 | ---- | M] () -- C:\Users\Tommy\Desktop\Saleen_S281.rar
[2012.03.11 00:08:02 | 001,645,338 | ---- | M] () -- C:\Users\Tommy\Desktop\k6Volvo9700420Traveller.rar
[2012.03.11 00:01:15 | 001,518,826 | ---- | M] () -- C:\Users\Tommy\Desktop\Traffic_AudiS6_TheTestdriver700 (1).rar
[2012.03.11 00:00:54 | 001,769,998 | ---- | M] () -- C:\Users\Tommy\Desktop\Mercedes_Cls_63_Traffic_Testdriver.rar
[2012.03.11 00:00:24 | 000,234,083 | ---- | M] () -- C:\Users\Tommy\Desktop\Smart_Pischti.zip
[2012.03.10 23:25:57 | 005,046,823 | ---- | M] () -- C:\Users\Tommy\Desktop\Brabus_G_61.rar
[2012.03.10 23:25:28 | 003,146,213 | ---- | M] () -- C:\Users\Tommy\Desktop\CK_Mercedes_S600_W140.7z
[2012.03.10 23:25:02 | 006,585,895 | ---- | M] () -- C:\Users\Tommy\Desktop\Mercedes_O305.rar
[2012.03.08 23:55:49 | 000,002,029 | ---- | M] () -- C:\Users\Tommy\Desktop\World Racing 2.lnk
[2012.03.08 00:04:33 | 000,001,896 | ---- | M] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
[2012.03.07 22:46:50 | 000,242,240 | ---- | M] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys
[2012.03.07 22:34:50 | 000,000,913 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2012.03.07 16:42:39 | 005,716,992 | ---- | M] () -- C:\Users\Tommy\Desktop\FAQ_eng.exe
[2012.03.06 21:10:15 | 000,001,999 | ---- | M] () -- C:\Users\Public\Desktop\Counter-Strike 1.6 DigitalZone.lnk
[2012.03.06 21:10:15 | 000,001,970 | ---- | M] () -- C:\Users\Public\Desktop\Half-Life DigitalZone.lnk
[2012.02.29 02:43:12 | 000,002,418 | ---- | M] () -- C:\user.js
[2012.02.28 17:58:30 | 000,001,989 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.02.28 17:46:46 | 000,000,989 | ---- | M] () -- C:\Users\Public\Desktop\PDFCreator.lnk
[2012.02.27 01:19:57 | 000,000,202 | ---- | M] () -- C:\Users\Tommy\Desktop\SweetPcFix.url
[2012.02.23 23:48:18 | 000,539,196 | ---- | M] () -- C:\Users\Tommy\Desktop\1313570206_Gta Sa SOK Market By MegaGTAMyths.rar
 
========== Files Created - No Company Name ==========
 
[2012.03.20 15:36:15 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.03.20 01:16:13 | 000,010,411 | ---- | C] () -- C:\Users\Tommy\.recently-used.xbel
[2012.03.12 23:40:01 | 000,002,057 | ---- | C] () -- C:\Users\Tommy\Desktop\KalOnline RedLight.lnk
[2012.03.12 23:30:29 | 762,695,948 | ---- | C] () -- C:\Users\Tommy\Desktop\RedLight_Setup21102011.exe
[2012.03.11 16:12:36 | 076,050,636 | ---- | C] () -- C:\Users\Tommy\Desktop\WR2_Akina_Mountain_Mindkiller.7z
[2012.03.11 16:09:22 | 039,577,870 | ---- | C] () -- C:\Users\Tommy\Desktop\Autumn_Driving_RaoulEmilian.rar
[2012.03.11 16:04:22 | 063,119,096 | ---- | C] () -- C:\Users\Tommy\Desktop\gr2_wr2_gk_bw_stadt.7z
[2012.03.11 00:08:09 | 011,665,358 | ---- | C] () -- C:\Users\Tommy\Desktop\Saleen_S281.rar
[2012.03.11 00:07:56 | 001,645,338 | ---- | C] () -- C:\Users\Tommy\Desktop\k6Volvo9700420Traveller.rar
[2012.03.11 00:01:15 | 001,518,826 | ---- | C] () -- C:\Users\Tommy\Desktop\Traffic_AudiS6_TheTestdriver700 (1).rar
[2012.03.11 00:00:51 | 001,769,998 | ---- | C] () -- C:\Users\Tommy\Desktop\Mercedes_Cls_63_Traffic_Testdriver.rar
[2012.03.11 00:00:24 | 000,234,083 | ---- | C] () -- C:\Users\Tommy\Desktop\Smart_Pischti.zip
[2012.03.10 23:25:51 | 005,046,823 | ---- | C] () -- C:\Users\Tommy\Desktop\Brabus_G_61.rar
[2012.03.10 23:25:24 | 003,146,213 | ---- | C] () -- C:\Users\Tommy\Desktop\CK_Mercedes_S600_W140.7z
[2012.03.10 23:24:56 | 006,585,895 | ---- | C] () -- C:\Users\Tommy\Desktop\Mercedes_O305.rar
[2012.03.10 22:25:55 | 000,000,129 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2012.03.09 01:10:11 | 021,224,019 | ---- | C] () -- C:\Users\Tommy\Desktop\Alps_v1.0neu.rar
[2012.03.08 23:55:49 | 000,002,029 | ---- | C] () -- C:\Users\Tommy\Desktop\World Racing 2.lnk
[2012.03.08 22:04:54 | 000,000,951 | ---- | C] () -- C:\Users\Tommy\Desktop\Empire - Total War.lnk
[2012.03.07 22:50:34 | 000,001,896 | ---- | C] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
[2012.03.07 22:34:50 | 000,000,913 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2012.03.07 16:42:39 | 005,716,992 | ---- | C] () -- C:\Users\Tommy\Desktop\FAQ_eng.exe
[2012.03.06 21:10:15 | 000,001,999 | ---- | C] () -- C:\Users\Public\Desktop\Counter-Strike 1.6 DigitalZone.lnk
[2012.03.06 21:10:15 | 000,001,970 | ---- | C] () -- C:\Users\Public\Desktop\Half-Life DigitalZone.lnk
[2012.02.28 17:59:14 | 000,001,096 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.02.28 17:59:13 | 000,001,092 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.02.28 17:58:30 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012.02.28 17:58:30 | 000,001,989 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.02.28 17:46:46 | 000,000,989 | ---- | C] () -- C:\Users\Public\Desktop\PDFCreator.lnk
[2012.02.28 17:46:41 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2012.02.27 01:19:57 | 000,000,202 | ---- | C] () -- C:\Users\Tommy\Desktop\SweetPcFix.url
[2010.12.09 17:04:51 | 000,159,744 | ---- | C] () -- C:\Windows\System32\msmOn-ern.dll
[2010.10.12 01:21:31 | 000,159,744 | ---- | C] () -- C:\Windows\System32\msmmc-ocd.dll
[2010.08.25 19:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2010.08.25 19:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2010.08.25 19:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2010.08.25 18:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2010.08.25 18:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2010.08.25 18:52:00 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2010.08.25 18:52:00 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
 
========== LOP Check ==========
 
[2012.01.31 21:19:22 | 000,000,000 | ---D | M] -- C:\Users\Divan\AppData\Roaming\Azureus
[2012.03.23 21:10:06 | 000,000,000 | ---D | M] -- C:\Users\Divan\AppData\Roaming\ExpressFiles
[2012.03.23 02:21:12 | 000,000,000 | ---D | M] -- C:\Users\Divan\AppData\Roaming\Media Finder
[2012.02.24 11:54:08 | 000,000,000 | ---D | M] -- C:\Users\Divan\AppData\Roaming\phonostar GmbH
[2012.01.02 01:04:50 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\Azureus
[2012.01.01 05:05:56 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\Babylon
[2012.03.24 21:30:03 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\BitTorrent
[2012.03.12 21:08:53 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\DAEMON Tools Lite
[2012.01.11 03:16:36 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\DVDVideoSoft
[2012.01.11 03:15:21 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.03.23 16:48:41 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\ExpressFiles
[2012.03.24 03:42:39 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\gema
[2012.03.09 01:28:04 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\gtk-2.0
[2012.03.23 02:21:12 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\Media Finder
[2012.02.28 17:46:45 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\pdfforge
[2012.03.08 22:08:18 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\The Creative Assembly
[2012.01.07 17:03:22 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\TS3Client
[2012.03.24 21:30:03 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\uTorrent
[2012.03.07 22:52:50 | 000,032,630 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 192 bytes -> C:\ProgramData\TEMP:8927A071

< End of report >

Swisstreasure · 25.03.2012, 12:48

Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst.
Bitte kein Crossposting ( posten in mehreren Foren).
Installiere oder Deinstalliere während der Bereinigung keine Software ausser Du wurdest dazu aufgefordert.
Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf. Erschwert mir nämlich das auswerten.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

Schritt 1

Programme deinstallieren

Da einige Programme und Anti-Spy-Programme uns u. U. bei der Bereinigung behindern (z. B. durch ständig laufende Hintergrundwächter), unnötig oder schädlich sind oder einfach nicht mehr gebraucht werden, bitte ich darum, die folgenden Programme über Systemsteuerung => Software komplett zu deinstallieren.

Code:

ATTFilter

Application Updater
Search Settings
Babylon toolbar
Incredibar.com
pdfforge Toolbar

Berichte mir, falls sich ein Programm nicht deinstallieren lässt. Nach Beendigung der Bereinigung können wir schauen, welche davon Du wieder installieren kannst/sollest.

Schritt 2

Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.

Starte das Tool mit Doppelklick.
Vista User: Bitte mit Rechtsklick "als Administrator starten".
Klicke nun auf den Disable Button um die Treiber gewisser Emulatoren zu deaktivieren.
Wenn der Scan beendet wurde ( Finished ), klicke auf OK.
Defogger fordert nun zum Neustart auf. Bestätige dies mit OK.
DeFogger erstellt nun ein Logfile auf dem Desktop (defogger_disable).

Poste bitte den Inhalt der Logfile in Deiner nächsten Antwort.
Wenn wir die Bereinigung beendet haben, starte bitte defogger erneut und klicke den Re-enable Button.

Schritt 3

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die Textbox.

Code:

ATTFilter

:OTL
PRC - [2012.03.24 03:42:38 | 000,243,712 | ---- | M] () -- C:\Users\Tommy\AppData\Roaming\gema\gema.exe
PRC - [2012.03.04 22:48:40 | 000,934,752 | ---- | M] (Spigot, Inc.) -- C:\Programme\Common Files\Spigot\Search Settings\SearchSettings.exe
PRC - [2012.03.04 22:40:10 | 000,748,440 | ---- | M] (Spigot, Inc.) -- C:\Programme\Application Updater\ApplicationUpdater.exe
MOD - [2012.03.24 03:42:38 | 000,243,712 | ---- | M] () -- C:\Users\Tommy\AppData\Roaming\gema\gema.exe
SRV - [2012.03.04 22:40:10 | 000,748,440 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Programme\Application Updater\ApplicationUpdater.exe -- (Application Updater)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Programme\Incredibar.com\incredibar\1.5.3.27\bh\incredibar.dll (Montera Technologeis LTD)
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Programme\Incredibar.com\incredibar\1.5.3.27\incredibarTlbr.dll (Montera Technologeis LTD)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000..\Run: [gema] C:\Users\Tommy\AppData\Roaming\gema\gema.exe ()
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.0)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O20 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000 Winlogon: Shell - (C:\Users\Tommy\AppData\Roaming\gema\gema.exe) - C:\Users\Tommy\AppData\Roaming\gema\gema.exe ()
[2012.03.24 03:42:39 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\gema
[2012.03.24 03:42:39 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\gema
[2012.03.24 03:42:38 | 000,000,000 | ---D | C] -- C:\ProgramData\gema
:Commands
[purity]
[emptytemp]

Schliesse bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

Schritt 4

Bitte

alle anderen Scanner gegen Viren, Spyware, usw. deaktivieren,
keine bestehende Verbindung zu einem Netzwerk/Internet (WLAN nicht vergessen),
nichts am Rechner arbeiten,
nach jedem Scan der Rechner neu gestarten.

Gmer scannen lassen

Lade Dir Gmer von dieser Seite herunter
(auf den Button Download EXE drücken) und das Programm auf dem Desktop speichern.
Alle anderen Programme sollen geschlossen sein.
Starte gmer.exe (Programm hat einen willkürlichen Programm-Namen).
Vista und Win7 User mit Rechtsklick und als Administrator starten.
Sollte sich ein Fenster mit folgender Warnung öffnen:
WARNING !!!
GMER has found system modification, which might have been caused by ROOTKIT activity.
Do you want to fully scan your system ?
Unbedingt auf "No" klicken.
Entferne rechts den Haken bei:
- IAT/EAT
- Alle Festplatten ausser die Systemplatte (normalerweise ist nur C:\ angehackt)
- Show all (sollte abgehackt sein)
Starte den Scan mit "Scan". Mache nichts am Computer während der Scan läuft.
Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.

Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

Gema Trojaner 2.05 OTL !

Log-Analyse und Auswertung: Gema Trojaner 2.05 OTL !

Gema Trojaner 2.05 OTL !

Gema Trojaner 2.05 OTL !

Ähnliche Themen: Gema Trojaner 2.05 OTL !