Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: GVU Trojaner

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 30.08.2012, 01:13   #1
NinjaB
 
GVU Trojaner - Standard

GVU Trojaner



Hallo
ICh hoffe ich habe da alles richtig gemacht bin zum ersten mal hier ^^ naja zurück zu meinen prob. nehmlich mein bruter hat den gvu trojaner und jetzt stadt alles neu installiren (das erst vor 3 wochen neu installirt wurde) und bei euch schon öffteres hilfreiche sachen gefunden habe habe jetzt das prob


OTL.TXT

Code:
ATTFilter
OTL logfile created on: 30.08.2012 01:38:52 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\DAVID\Desktop
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,41 Gb Available Physical Memory | 74,12% Memory free
6,50 Gb Paging File | 5,52 Gb Available in Paging File | 85,03% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 114,40 Gb Total Space | 79,37 Gb Free Space | 69,38% Space Free | Partition Type: NTFS
Drive D: | 37,25 Gb Total Space | 28,81 Gb Free Space | 77,35% Space Free | Partition Type: NTFS
 
Computer Name: DAVID-PC | User Name: DAVID | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.30 01:22:15 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\DAVID\Desktop\OTL.exe
PRC - [2012.07.29 11:23:14 | 000,188,760 | ---- | M] () -- C:\Programme\Web Assistant\ExtensionUpdaterService.exe
PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.07.04 08:21:18 | 000,453,632 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2012.07.04 08:20:42 | 000,217,088 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2012.07.04 01:34:42 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.06.05 09:39:42 | 000,289,544 | ---- | M] () -- C:\Programme\PC Beschleunigen\PCSUService.exe
PRC - [2012.05.29 15:50:04 | 000,115,032 | R--- | M] (SweetIM Technologies Ltd.) -- C:\Programme\SweetIM\Messenger\SweetIM.exe
PRC - [2012.02.26 16:01:44 | 000,295,728 | ---- | M] (SweetIM Technologies Ltd.) -- C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe
PRC - [2011.03.28 20:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2011.03.28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\BingBar\SeaPort.EXE
PRC - [2010.05.20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft LifeCam\MSCamS32.exe
PRC - [2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.08.01 19:37:35 | 000,240,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\961b28b18dc304d4434ca9938abd1d60\WindowsFormsIntegration.ni.dll
MOD - [2012.08.01 17:51:04 | 002,295,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\c366ebd7f33816762268154efc68176d\System.Core.ni.dll
MOD - [2012.08.01 01:14:04 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\fc626095c194be137bceb219934b06a7\PresentationFramework.Aero.ni.dll
MOD - [2012.08.01 01:13:59 | 014,325,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\517358eb2fd962a942dd1ea6afc5b93e\PresentationFramework.ni.dll
MOD - [2012.08.01 01:13:46 | 012,218,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\e9d0ba41128f363f2390c7e630129c2b\PresentationCore.ni.dll
MOD - [2012.08.01 01:13:46 | 000,060,928 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\68b5806af0df6ce86027bacb7dc37233\UIAutomationProvider.ni.dll
MOD - [2012.08.01 01:13:36 | 003,325,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\b68fdf2c95b93fc5006a092c11eed07c\WindowsBase.ni.dll
MOD - [2012.08.01 01:13:29 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll
MOD - [2012.08.01 01:13:09 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll
MOD - [2012.08.01 01:13:02 | 011,824,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\84fbf353f91385690a3e4e982aa6930e\System.Web.ni.dll
MOD - [2012.08.01 01:12:54 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll
MOD - [2012.08.01 01:12:51 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll
MOD - [2012.08.01 01:12:47 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll
MOD - [2012.08.01 01:12:42 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll
MOD - [2012.08.01 01:12:33 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll
MOD - [2012.07.20 14:42:02 | 000,652,800 | ---- | M] () -- C:\Programme\IZArc\IZArcCM.dll
MOD - [2012.07.04 01:34:48 | 000,095,232 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
MOD - [2012.07.04 01:16:08 | 000,369,152 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2009.07.14 10:47:20 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll
MOD - [2009.07.14 10:47:12 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.07.14 10:47:12 | 000,208,896 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2012.08.23 18:52:58 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.08.01 01:43:59 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.07.29 11:23:14 | 000,188,760 | ---- | M] () [Auto | Running] -- C:\Programme\Web Assistant\ExtensionUpdaterService.exe -- (Web Assistant Updater)
SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.14 02:13:54 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.07.04 08:20:42 | 000,217,088 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012.07.04 01:34:42 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.06.05 09:39:42 | 000,289,544 | ---- | M] () [Auto | Running] -- C:\Programme\PC Beschleunigen\PCSUService.exe -- (PCSUService)
SRV - [2012.03.08 18:32:24 | 001,492,840 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2011.04.01 11:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Programme\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2011.03.28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2010.09.22 16:33:04 | 000,051,040 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.05.20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2012.07.04 08:58:12 | 010,070,016 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2012.07.04 08:58:12 | 010,070,016 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2012.07.04 07:10:30 | 000,290,304 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.02.23 14:31:58 | 000,086,544 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService)
DRV - [2010.05.20 15:27:24 | 000,030,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nx6000.sys -- (MSHUSBVideo)
DRV - [2010.02.18 09:18:22 | 000,037,944 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\amdiox86.sys -- (amdiox86)
DRV - [2009.07.14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2009.07.14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2009.07.14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2009.07.14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2009.07.14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6}
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&crg=3.16010003&st=12&q={searchTerms}&barid={02010704-9E70-4432-A75F-0CAEB55238B6}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://mystart.incredibar.com/mb178?a=6OyM8En1pg&i=26
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 55 73 BC AC 68 6F CD 01  [binary data]
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A}
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=112555&tt=010812_nich_3112_7&babsrc=SP_ss&mntrId=60755749000000000000001d9284e761
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb178/?search={searchTerms}&loc=IB_DS&a=6OyM8En1pg&i=26
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&crg=3.16010003&st=12&q={searchTerms}&barid={02010704-9E70-4432-A75F-0CAEB55238B6}
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.hlportal.de/"
FF - prefs.js..keyword.URL: "hxxp://mystart.incredibar.com/mb178/?loc=IB_DS&a=6OyM8En1pg&&i=26&search="
FF - prefs.js..network.proxy.type: 0
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.hlportal.de/"
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\DAVID\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\DAVID\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\DAVID\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\DAVID\AppData\Local\Facebook\Messenger\2.1.4590.0\npFbDesktopPlugin.dll (Facebook, Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012.08.25 23:35:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.08.01 01:25:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012.08.01 01:25:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DAVID\AppData\Roaming\mozilla\Extensions
[2012.08.25 23:44:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions
[2012.08.01 22:42:36 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.08.04 15:35:56 | 000,000,000 | ---D | M] (Default Manager) -- C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\DefaultManager@Microsoft
[2012.08.05 14:07:33 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com
[2012.08.25 23:35:07 | 000,002,203 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\searchplugins\MyStart Search.xml
[2012.08.13 12:21:26 | 000,004,003 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\searchplugins\sweetim.xml
[2012.08.01 01:25:37 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.08.25 23:35:09 | 000,000,000 | ---D | M] (Web Assistant) -- C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX
[2012.08.02 16:10:28 | 000,330,316 | ---- | M] () (No name found) -- C:\USERS\DAVID\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2ST5ITBF.DEFAULT\EXTENSIONS\PERSONAS@CHRISTOPHER.BEARD.XPI
[2012.07.14 02:15:45 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.07.14 02:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.04 18:20:45 | 000,002,361 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012.07.14 02:45:08 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.07.14 02:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.14 02:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.14 02:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.14 02:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6}
CHR - default_search_provider: MyStart Search (Enabled)
CHR - default_search_provider: search_url = hxxp://mystart.incredibar.com/mb178/?loc=IB_DS&search={searchTerms}&a=6OyM8En1pg&i=26
CHR - default_search_provider: suggest_url = 
CHR - homepage: hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\DAVID\AppData\Local\Google\Chrome\Application\21.0.1180.75\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\DAVID\AppData\Local\Google\Chrome\Application\21.0.1180.83\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\DAVID\AppData\Local\Google\Chrome\Application\21.0.1180.83\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\DAVID\AppData\Local\Google\Chrome\Application\21.0.1180.83\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java(TM) Platform SE 7 U5 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.50.6 (Enabled) = C:\Windows\system32\npDeployJava1.dll
CHR - plugin: Windows Live\\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Facebook Desktop (Enabled) = C:\Users\DAVID\AppData\Local\Facebook\Messenger\2.1.4590.0\npFbDesktopPlugin.dll
CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\DAVID\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
CHR - plugin: Google Update (Enabled) = C:\Users\DAVID\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw_1165635.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll
CHR - Extension: Blue Mist = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\chgkbmdcobedhknnajfbimomnhndjfaa\1_0\
CHR - Extension: Web Assistant = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.474_0\
CHR - Extension: SweetIM for Facebook = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\Copy of 
CHR - Extension: SweetIM for Facebook = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\
CHR - Extension: New tab for Chrome\u2122 = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg\1.0.0_0\
CHR - Extension: Blue Mist = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\chgkbmdcobedhknnajfbimomnhndjfaa\1_0\
CHR - Extension: Web Assistant = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.474_0\
CHR - Extension: SweetIM for Facebook = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\Copy of 
CHR - Extension: SweetIM for Facebook = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\
CHR - Extension: New tab for Chrome\u2122 = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg\1.0.0_0\
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Programme\Web Assistant\Extension32.dll ()
O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Programme\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (Montera Technologeis LTD)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Programme\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD)
O3 - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [AMD AVT] C:\Windows\System32\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [Sweetpacks Communicator] C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.)
O4 - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000..\Run: [Facebook Update] C:\Users\DAVID\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000..\Run: [PCSpeedUp] C:\Programme\PC Beschleunigen\PCSUNotifier.exe ()
O4 - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000..\Run: [Speech Recognition] C:\Windows\Speech\Common\sapisvr.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\DAVID\AppData\Local\Facebook\Messenger\2.1.4590.0\FacebookMessenger.exe (Facebook)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\DAVID\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A4F21A1A-2DCA-4472-8E3E-8C886204D1F9}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)
ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {23A20C3C-2ADD-4A80-AFB4-C146F8847D79} - .NET Framework
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.30 01:30:29 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Malwarebytes
[2012.08.30 01:30:19 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.08.30 01:30:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.30 01:30:19 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.08.30 01:30:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.30 01:24:40 | 010,652,120 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\DAVID\Desktop\mbam-setup-1.62.0.1300.exe
[2012.08.30 01:22:13 | 000,598,528 | ---- | C] (OldTimer Tools) -- C:\Users\DAVID\Desktop\OTL.exe
[2012.08.29 19:36:28 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2012.08.29 16:43:49 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{FDEFC916-94F8-402F-BF07-85166C54D94D}
[2012.08.28 14:59:18 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\test
[2012.08.28 14:57:48 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Kaiba Corporation
[2012.08.28 13:53:23 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.08.28 13:47:34 | 000,445,016 | ---- | C] (Creative Labs) -- C:\Windows\System32\wrap_oal.dll
[2012.08.28 13:47:34 | 000,265,216 | ---- | C] (The OpenSSL Project, hxxp://www.openssl.org/) -- C:\Windows\System32\ssleay32.dll
[2012.08.28 13:47:33 | 000,265,216 | ---- | C] (The OpenSSL Project, hxxp://www.openssl.org/) -- C:\Windows\System32\libssl32.dll
[2012.08.28 13:47:33 | 000,103,424 | ---- | C] (GNU <www.gnu.org>) -- C:\Windows\System32\libintl3.dll
[2012.08.28 13:47:32 | 002,288,181 | ---- | C] (Red Hat) -- C:\Windows\System32\cygwin1.dll
[2012.08.28 13:47:32 | 001,178,112 | ---- | C] (The OpenSSL Project, hxxp://www.openssl.org/) -- C:\Windows\System32\libeay32.dll
[2012.08.28 13:47:32 | 001,008,128 | ---- | C] (GnuWin32 <hxxp://gnuwin32.sourceforge.net>) -- C:\Windows\System32\libiconv2.dll
[2012.08.28 13:47:32 | 000,325,376 | ---- | C] (AutoIt Team) -- C:\Windows\System32\AutoItX3.dll
[2012.08.28 13:47:32 | 000,131,072 | ---- | C] (Sereby Corporation) -- C:\Windows\System32\AiORuntimes.dll
[2012.08.28 13:45:52 | 000,000,000 | ---D | C] -- C:\Windows\System32\URTTEMP
[2012.08.28 13:27:38 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{AA70E4C7-3EA6-4479-AAFD-4B32DC075A42}
[2012.08.27 16:14:31 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{3DE389B4-21C6-4EF5-8BF2-2125B738FB7E}
[2012.08.26 16:04:19 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{74C5C7E0-7B28-40F1-B457-603587B130DD}
[2012.08.25 23:36:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IZArc
[2012.08.25 23:36:55 | 000,000,000 | ---D | C] -- C:\Program Files\IZArc
[2012.08.25 23:35:17 | 000,000,000 | ---D | C] -- C:\Program Files\Perion
[2012.08.25 23:35:12 | 000,000,000 | ---D | C] -- C:\Program Files\Incredibar.com
[2012.08.25 23:35:09 | 000,000,000 | ---D | C] -- C:\Program Files\Web Assistant
[2012.08.25 16:39:53 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1422C04D-9D74-4483-865B-52C45E21E570}
[2012.08.24 15:53:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{A5C05416-0D11-4151-97E2-EC046BE23852}
[2012.08.23 16:15:25 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{A3BDA7CD-7DC8-4F42-B547-D0FE664CC038}
[2012.08.23 01:00:11 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{81CC2B07-26AC-448A-936F-B214C29D51AB}
[2012.08.22 12:59:25 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{3B1172AC-8B45-4ED4-9572-266D3B87A182}
[2012.08.22 00:58:49 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{D5D78E76-B6C4-43ED-A7E9-4E0226747904}
[2012.08.21 12:58:26 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{90C325E5-C120-49B6-B17F-51BC89180147}
[2012.08.21 00:57:51 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{8D27366A-EF92-4DEA-A76E-40514405ADBE}
[2012.08.20 12:57:16 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{B7698B4A-3A96-4D69-BBCE-612004A05FD7}
[2012.08.19 14:07:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft LifeCam
[2012.08.19 12:58:48 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1BCE4FB6-C611-48A9-ADB4-A4BE3F99FFB9}
[2012.08.18 17:46:35 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\Neuer Ordner (2)
[2012.08.18 09:27:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{F5FF8639-8AAA-4099-B3B3-3AE8D854DB48}
[2012.08.18 09:27:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{5429EB52-19E3-43D6-BCC3-B199799BB7AD}
[2012.08.15 13:12:56 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{0AC293C2-380F-4FC8-973B-D1DA57F894E3}
[2012.08.15 13:12:34 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{69187003-FC8F-4047-A90E-97A4608E6069}
[2012.08.15 01:12:09 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{5A3141BA-7C90-404A-BDCD-C519CC469776}
[2012.08.15 01:11:47 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{5647895B-9C4B-409E-A38C-2772D698418F}
[2012.08.14 13:11:04 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{B0C8A4DA-2EAB-4BB2-9709-E04AFFC4CE21}
[2012.08.14 13:10:54 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{17BFBFA2-3B8A-4DCD-990B-5E34AB8589D3}
[2012.08.14 00:09:17 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{FAD0800A-D4C8-472E-BCBE-AD056320F233}
[2012.08.14 00:08:55 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{297A7543-3CE9-4971-9F13-1548882E53F0}
[2012.08.13 12:21:07 | 000,000,000 | ---D | C] -- C:\ProgramData\SweetIM
[2012.08.13 12:21:07 | 000,000,000 | ---D | C] -- C:\Program Files\SweetIM
[2012.08.13 12:21:04 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Namco
[2012.08.13 12:21:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Pacman
[2012.08.13 12:07:57 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1C986E0F-39FE-404D-9C06-AFFF63788D27}
[2012.08.13 12:07:40 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{235318B8-F279-4CA9-A52E-A5CC759CE37E}
[2012.08.12 23:52:40 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1863F3F9-C4EE-4E4E-BE72-6B42E973A38A}
[2012.08.12 23:52:19 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{840B3278-5D66-4516-ADD9-0AC97A23CB30}
[2012.08.12 21:48:34 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.08.12 21:47:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Google
[2012.08.12 12:52:05 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Facebook
[2012.08.12 12:34:21 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\Neuer Ordner
[2012.08.12 11:51:35 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{C1E37549-7EB1-4C8E-93A5-8FE0C663A06C}
[2012.08.12 11:51:19 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1ED976BA-9880-4615-8287-38FE7E3D7F83}
[2012.08.12 01:41:48 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{2AC7E57D-A98C-41F3-BFB1-4D4DB3863B53}
[2012.08.12 01:41:26 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{A6B5B453-2E78-4CDB-8B52-B99E543F0188}
[2012.08.11 13:40:56 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{269AA1F6-34B6-4809-BE3C-DC44F4FA75D4}
[2012.08.11 13:40:43 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{310F73D9-E60F-483F-9B61-8BC8AF9494B2}
[2012.08.11 01:28:36 | 000,000,000 | ---D | C] -- C:\Program Files\osu!
[2012.08.11 01:27:32 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Downloaded Installations
[2012.08.10 15:59:37 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{DDDEBA05-4446-4E17-9086-4A17F993C423}
[2012.08.10 15:59:15 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{456EA81D-AF2B-416A-B8E4-331D321D94CD}
[2012.08.10 03:58:49 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{B7EF1C98-97A8-4FAF-83EC-E773C8EB479C}
[2012.08.09 15:57:49 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{C59EEA8A-D61E-4067-B523-B362207F253B}
[2012.08.09 15:57:28 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{05D54603-FF7E-4972-A537-E4E99B176E79}
[2012.08.09 15:50:01 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft LifeCam
[2012.08.09 15:49:03 | 000,000,000 | ---D | C] -- C:\e51500d3262ef71cfa616f1fe023
[2012.08.09 15:02:04 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1912FD8E-4F8C-4DD2-9ABE-B6337B08A99F}
[2012.08.08 15:22:32 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{3EA14EC2-49DA-4ABF-9973-41A45A6A36E4}
[2012.08.08 15:22:08 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1F2267B3-DCE0-4DC8-B3A4-E0D9A0B5E061}
[2012.08.08 03:21:43 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{4838BC28-92D9-4830-8577-0213983EC707}
[2012.08.08 03:21:21 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{0C079B8E-8EC4-414A-8962-97BE5F46FC49}
[2012.08.07 15:21:07 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{E02D56C4-A005-431F-9758-88F30D4BFD59}
[2012.08.07 15:20:45 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{CBDA15B1-0953-4E03-9631-24B4ECF4DC67}
[2012.08.07 03:20:17 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{9F2A31F6-DBF8-45BA-AE38-8DC41891BECB}
[2012.08.07 03:19:56 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{2666C542-9294-44C6-989C-A3AA218411CB}
[2012.08.06 15:19:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{A8A3BA5A-B6F5-47A7-A155-714F8EA8AC8D}
[2012.08.06 15:19:30 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{408FFAD5-F2FA-4003-87C0-B5BE3EE339A7}
[2012.08.05 19:50:29 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Facebook
[2012.08.05 15:37:03 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{F5F71426-9B07-440E-8A74-893D43DB5AC5}
[2012.08.05 15:36:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{660D6C36-EB57-4749-99B8-EC6A1731ECF9}
[2012.08.05 03:36:17 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{199BBFA7-03AB-4B30-B7B2-0F36BB5F406E}
[2012.08.05 03:36:07 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{49BB09EF-F59F-48F5-9CF2-C1A95C8E6203}
[2012.08.04 18:20:54 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\BabylonToolbar
[2012.08.04 18:20:49 | 000,000,000 | ---D | C] -- C:\Program Files\BabylonToolbar
[2012.08.04 18:20:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012.08.04 18:20:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Babylon
[2012.08.04 18:20:33 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\YourFileDownloader
[2012.08.04 18:20:33 | 000,000,000 | ---D | C] -- C:\Program Files\YourFileDownloader
[2012.08.04 18:09:37 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2012.08.04 15:35:51 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{8C8178A6-3AF8-4CC6-BCE1-F66F1883CE6C}
[2012.08.04 15:35:37 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{8FB349F9-71F5-4C01-8982-5A562376DAAF}
[2012.08.04 15:35:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{B4EF47E7-3879-4F1C-91B6-F28AEAF05972}
[2012.08.03 18:15:30 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\INVedit
[2012.08.03 14:06:47 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{9CD59B95-DBD1-4F4B-821E-1643F6892142}
[2012.08.03 14:06:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{C6697D36-273A-4462-A68B-BC4711B63CA9}
[2012.08.02 16:18:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{7A4C2557-182F-48B5-9824-24BC1977C34B}
[2012.08.02 16:18:01 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{FF041113-94D8-4843-B1B9-CD21598ADF43}
[2012.08.01 22:44:30 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Documents\PCSpeedUp
[2012.08.01 22:44:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Beschleunigen
[2012.08.01 22:44:21 | 000,000,000 | ---D | C] -- C:\Program Files\PC Beschleunigen
[2012.08.01 22:42:55 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\OpenCandy
[2012.08.01 22:42:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.08.01 22:42:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2012.08.01 22:42:30 | 000,405,144 | ---- | C] (Newtonsoft) -- C:\Windows\System32\Newtonsoft.Json.Net20.dll
[2012.08.01 22:42:17 | 000,000,000 | ---D | C] -- C:\Program Files\DVDVideoSoft
[2012.08.01 22:42:17 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DVDVideoSoft
[2012.08.01 22:41:33 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoft
[2012.08.01 21:33:11 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{44362EDA-AF1C-463A-803F-03AB0D7903B8}
[2012.08.01 21:33:05 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Documents\Meine empfangenen Dateien
[2012.08.01 21:33:01 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{BD0C36FC-4345-475D-8E00-7B2CB1546E34}
[2012.08.01 21:32:47 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Tracing
[2012.08.01 21:29:15 | 000,000,000 | ---D | C] -- C:\Windows\de
[2012.08.01 21:28:31 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2012.08.01 21:28:08 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
[2012.08.01 21:27:36 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SQL Server Compact Edition
[2012.08.01 21:25:26 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live
[2012.08.01 21:24:31 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft
[2012.08.01 21:23:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012.08.01 21:23:14 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2012.08.01 21:19:57 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Windows Live
[2012.08.01 21:19:55 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live
[2012.08.01 20:48:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\rom & emulator
[2012.08.01 20:46:18 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\musik meins
[2012.08.01 20:46:16 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\deck
[2012.08.01 20:45:24 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\mein bilder neue version ^_^
[2012.08.01 20:45:02 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\Love
[2012.08.01 20:43:40 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\hg und so bilder
[2012.08.01 20:42:34 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\Neuer Ordner (9)
[2012.08.01 20:42:31 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\fotos und co
[2012.08.01 20:42:30 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\Neuer Ordner (13)
[2012.08.01 20:42:19 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\David sicherung
[2012.08.01 20:22:50 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\ElevatedDiagnostics
[2012.08.01 20:00:18 | 000,000,000 | ---D | C] -- C:\Windows\ja-JP
[2012.08.01 20:00:17 | 000,000,000 | ---D | C] -- C:\Windows\en-US
[2012.08.01 19:59:53 | 000,000,000 | ---D | C] -- C:\Windows\System32\ja
[2012.08.01 19:59:53 | 000,000,000 | ---D | C] -- C:\Windows\System32\0411
[2012.08.01 19:59:49 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\ja-JP
[2012.08.01 19:54:35 | 000,003,072 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\System32\drivers\ja-JP\pscr.sys.mui
[2012.08.01 19:54:32 | 000,031,744 | ---- | C] (Marvell) -- C:\Windows\System32\drivers\ja-JP\yk62x86.sys.mui
[2012.08.01 19:53:54 | 000,006,656 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\drivers\ja-JP\BrSerIb.sys.mui
[2012.08.01 19:53:53 | 000,006,144 | ---- | C] (Agere Systems) -- C:\Windows\System32\drivers\ja-JP\ltmdmnt.sys.mui
[2012.08.01 19:53:32 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\drivers\ja-JP\BrParwdm.sys.mui
[2012.08.01 19:53:31 | 000,006,656 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\drivers\ja-JP\BrSerId.sys.mui
[2012.08.01 17:49:51 | 000,000,000 | ---D | C] -- C:\Program Files\Paint.NET
[2012.08.01 17:49:33 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Paint.NET
[2012.08.01 17:48:39 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\PhotoScape
[2012.08.01 17:48:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoScape
[2012.08.01 17:48:18 | 000,000,000 | ---D | C] -- C:\Program Files\PhotoScape
[2012.08.01 01:52:14 | 000,000,000 | ---D | C] -- C:\Program Files\Defraggler
[2012.08.01 01:51:15 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Skype
[2012.08.01 01:51:09 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2012.08.01 01:51:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.08.01 01:51:09 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2012.08.01 01:51:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2012.08.01 01:50:58 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.08.01 01:42:26 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Steam
[2012.08.01 01:42:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2012.08.01 01:42:24 | 000,000,000 | ---D | C] -- C:\Program Files\Steam
[2012.08.01 01:41:09 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\.minecraft
[2012.08.01 01:33:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2012.08.01 01:33:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012.08.01 01:31:43 | 000,000,000 | ---D | C] -- C:\Windows\System32\Adobe
[2012.08.01 01:31:28 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Adobe
[2012.08.01 01:30:40 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2012.08.01 01:30:40 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2012.08.01 01:29:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Macromedia
[2012.08.01 01:29:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Macromedia
[2012.08.01 01:29:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Adobe
[2012.08.01 01:28:13 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed
[2012.08.01 01:28:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2012.08.01 01:25:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Mozilla
[2012.08.01 01:25:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Mozilla
[2012.08.01 01:25:37 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2012.08.01 01:25:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.08.01 01:25:36 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012.08.01 01:17:42 | 000,000,000 | -H-D | C] -- C:\Program Files\Temp
[2012.08.01 01:15:56 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\AMD
[2012.08.01 01:15:52 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\ATI
[2012.08.01 01:15:52 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\ATI
[2012.08.01 01:15:52 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2012.08.01 01:15:51 | 000,000,000 | ---D | C] -- C:\Program Files\AMD AVT
[2012.08.01 01:15:48 | 000,000,000 | ---D | C] -- C:\Program Files\AMD APP
[2012.08.01 01:15:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2012.08.01 01:15:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2012.08.01 01:14:58 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD
[2012.08.01 01:14:11 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2012.08.01 01:13:49 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2012.08.01 01:12:59 | 000,000,000 | ---D | C] -- C:\AMD
[2012.08.01 00:50:35 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2012.08.01 00:34:49 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Microsoft Games
[2012.08.01 00:13:48 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2012.08.01 00:13:45 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2012.08.01 00:02:30 | 000,000,000 | R--D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.08.01 00:02:30 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Searches
[2012.08.01 00:02:30 | 000,000,000 | R--D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.08.01 00:02:20 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Identities
[2012.08.01 00:02:18 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Contacts
[2012.08.01 00:02:09 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\VirtualStore
[2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Vorlagen
[2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\AppData\Local\Verlauf
[2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\AppData\Local\Temporary Internet Files
[2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Startmenü
[2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\SendTo
[2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Recent
[2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Netzwerkumgebung
[2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Lokale Einstellungen
[2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Druckumgebung
[2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Cookies
[2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\AppData\Local\Anwendungsdaten
[2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Anwendungsdaten
[2012.08.01 00:02:02 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Documents\Eigene Videos
[2012.08.01 00:02:02 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Documents\Eigene Musik
[2012.08.01 00:02:02 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Eigene Dateien
[2012.08.01 00:02:02 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Documents\Eigene Bilder
[2012.08.01 00:02:01 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Temp
[2012.08.01 00:02:01 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Microsoft
[2012.08.01 00:02:01 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Media Center Programs
[2012.08.01 00:02:00 | 000,000,000 | --SD | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft
[2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Videos
[2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Saved Games
[2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Pictures
[2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Music
[2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Links
[2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Favorites
[2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Downloads
[2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Documents
[2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Desktop
[2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012.08.01 00:02:00 | 000,000,000 | -H-D | C] -- C:\Users\DAVID\AppData
[2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Recovery
[2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Programme
[2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2012.07.31 23:54:18 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2012.07.31 23:51:27 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2012.07.31 23:51:05 | 000,000,000 | -HSD | C] -- C:\System Volume Information
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.30 01:30:19 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.30 01:24:53 | 010,652,120 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\DAVID\Desktop\mbam-setup-1.62.0.1300.exe
[2012.08.30 01:23:59 | 000,618,227 | ---- | M] () -- C:\Users\DAVID\Desktop\adwcleaner.exe
[2012.08.30 01:23:15 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.30 01:23:15 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.30 01:22:15 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\DAVID\Desktop\OTL.exe
[2012.08.30 01:18:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.30 01:18:09 | 2616,745,984 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.29 16:57:12 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000UA.job
[2012.08.29 16:54:23 | 004,503,728 | ---- | M] () -- C:\ProgramData\nud0repor.pad
[2012.08.29 16:54:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.29 00:56:00 | 000,000,928 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000UA.job
[2012.08.28 21:57:00 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000Core.job
[2012.08.28 17:46:19 | 000,001,887 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.08.28 14:42:34 | 000,265,640 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.08.28 14:17:59 | 000,707,062 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.08.28 14:17:59 | 000,660,658 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.08.28 14:17:59 | 000,411,572 | ---- | M] () -- C:\Windows\System32\perfh011.dat
[2012.08.28 14:17:59 | 000,152,548 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.08.28 14:17:59 | 000,124,744 | ---- | M] () -- C:\Windows\System32\perfc011.dat
[2012.08.28 14:17:59 | 000,124,744 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.08.28 13:56:46 | 000,007,958 | ---- | M] () -- C:\Windows\unins002.dat
[2012.08.28 13:56:37 | 000,709,719 | ---- | M] () -- C:\Windows\unins002.exe
[2012.08.28 13:52:49 | 000,011,299 | ---- | M] () -- C:\Windows\unins001.dat
[2012.08.28 13:52:26 | 001,199,175 | ---- | M] () -- C:\Windows\unins001.exe
[2012.08.28 13:47:37 | 000,010,922 | ---- | M] () -- C:\Windows\unins000.dat
[2012.08.28 13:47:28 | 001,187,609 | ---- | M] () -- C:\Windows\unins000.exe
[2012.08.28 01:08:58 | 000,011,264 | -H-- | M] () -- C:\Users\DAVID\Desktop\photothumb.db
[2012.08.27 17:53:30 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\PC SpeedUp Service Deactivator.job
[2012.08.25 23:35:13 | 000,000,764 | ---- | M] () -- C:\user.js
[2012.08.22 12:56:01 | 000,000,906 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000Core.job
[2012.08.22 12:01:11 | 000,002,453 | ---- | M] () -- C:\Users\DAVID\Desktop\Google Chrome.lnk
[2012.08.19 14:07:41 | 000,002,011 | ---- | M] () -- C:\Users\Public\Desktop\Microsoft LifeCam.lnk
[2012.08.13 12:21:03 | 000,000,000 | ---- | M] () -- C:\END
[2012.08.12 12:52:06 | 000,001,320 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
[2012.08.03 21:35:43 | 000,077,728 | ---- | M] () -- C:\Users\DAVID\Desktop\SharinganPictures.jpg
[2012.08.01 22:48:00 | 000,011,189 | -HS- | M] () -- C:\Users\DAVID\Desktop\Folder.jpg
[2012.08.01 22:48:00 | 000,002,348 | -HS- | M] () -- C:\Users\DAVID\Desktop\AlbumArtSmall.jpg
[2012.08.01 22:42:31 | 000,001,360 | ---- | M] () -- C:\Users\DAVID\Desktop\Free YouTube to MP3 Converter.lnk
[2012.08.01 19:59:17 | 000,141,988 | ---- | M] () -- C:\Windows\System32\perfi011.dat
[2012.08.01 19:59:17 | 000,031,548 | ---- | M] () -- C:\Windows\System32\perfd011.dat
[2012.08.01 17:50:57 | 000,001,288 | ---- | M] () -- C:\Users\Public\Desktop\Paint.NET.lnk
[2012.08.01 17:48:30 | 000,000,993 | ---- | M] () -- C:\Users\DAVID\Desktop\PhotoScape.lnk
[2012.08.01 16:47:02 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.08.01 01:51:09 | 000,002,503 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.08.01 01:42:30 | 000,000,875 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk
[2012.08.01 01:31:08 | 000,278,561 | ---- | M] () -- C:\Users\DAVID\Desktop\Minecraft.exe
[2012.08.01 01:25:38 | 000,001,092 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.07.31 23:55:20 | 000,057,050 | ---- | M] () -- C:\Windows\System32\license.rtf
[2012.07.31 23:53:46 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
 
========== Files Created - No Company Name ==========
 
[2012.08.30 01:30:19 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.30 01:23:52 | 000,618,227 | ---- | C] () -- C:\Users\DAVID\Desktop\adwcleaner.exe
[2012.08.28 17:46:19 | 004,503,728 | ---- | C] () -- C:\ProgramData\nud0repor.pad
[2012.08.28 17:46:19 | 000,001,887 | ---- | C] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.08.28 13:56:37 | 000,709,719 | ---- | C] () -- C:\Windows\unins002.exe
[2012.08.28 13:56:37 | 000,007,958 | ---- | C] () -- C:\Windows\unins002.dat
[2012.08.28 13:52:27 | 001,199,175 | ---- | C] () -- C:\Windows\unins001.exe
[2012.08.28 13:52:27 | 000,011,299 | ---- | C] () -- C:\Windows\unins001.dat
[2012.08.28 13:47:34 | 000,066,560 | ---- | C] () -- C:\Windows\System32\zlib1.dll
[2012.08.28 13:47:33 | 000,162,304 | ---- | C] () -- C:\Windows\System32\libpng13.dll
[2012.08.28 13:47:33 | 000,138,752 | ---- | C] () -- C:\Windows\System32\libpng15.dll
[2012.08.28 13:47:32 | 001,187,609 | ---- | C] () -- C:\Windows\unins000.exe
[2012.08.28 13:47:32 | 000,271,264 | ---- | C] () -- C:\Windows\System\vbrun100.dll
[2012.08.28 13:47:32 | 000,210,944 | ---- | C] () -- C:\Windows\System\msvcrt10.dll
[2012.08.28 13:47:32 | 000,010,922 | ---- | C] () -- C:\Windows\unins000.dat
[2012.08.22 20:23:50 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.19 14:07:41 | 000,002,011 | ---- | C] () -- C:\Users\Public\Desktop\Microsoft LifeCam.lnk
[2012.08.13 12:21:03 | 000,000,000 | ---- | C] () -- C:\END
[2012.08.12 21:48:36 | 000,002,453 | ---- | C] () -- C:\Users\DAVID\Desktop\Google Chrome.lnk
[2012.08.12 21:47:42 | 000,001,120 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000UA.job
[2012.08.12 21:47:41 | 000,001,068 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000Core.job
[2012.08.12 12:52:06 | 000,001,320 | ---- | C] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
[2012.08.05 19:50:36 | 000,000,928 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000UA.job
[2012.08.05 19:50:34 | 000,000,906 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000Core.job
[2012.08.04 18:20:49 | 000,000,764 | ---- | C] () -- C:\user.js
[2012.08.04 00:41:31 | 000,011,264 | -H-- | C] () -- C:\Users\DAVID\Desktop\photothumb.db
[2012.08.03 21:35:42 | 000,077,728 | ---- | C] () -- C:\Users\DAVID\Desktop\SharinganPictures.jpg
[2012.08.01 22:48:00 | 000,011,189 | -HS- | C] () -- C:\Users\DAVID\Desktop\Folder.jpg
[2012.08.01 22:48:00 | 000,002,348 | -HS- | C] () -- C:\Users\DAVID\Desktop\AlbumArtSmall.jpg
[2012.08.01 22:44:22 | 000,000,336 | ---- | C] () -- C:\Windows\tasks\PC SpeedUp Service Deactivator.job
[2012.08.01 22:42:31 | 000,001,360 | ---- | C] () -- C:\Users\DAVID\Desktop\Free YouTube to MP3 Converter.lnk
[2012.08.01 21:27:58 | 000,001,251 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk
[2012.08.01 21:27:43 | 000,001,320 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk
[2012.08.01 21:27:17 | 000,001,404 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
[2012.08.01 21:26:54 | 000,002,432 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2012.08.01 20:02:35 | 000,411,572 | ---- | C] () -- C:\Windows\System32\perfh011.dat
[2012.08.01 20:02:35 | 000,141,988 | ---- | C] () -- C:\Windows\System32\perfi011.dat
[2012.08.01 20:02:35 | 000,124,744 | ---- | C] () -- C:\Windows\System32\perfc011.dat
[2012.08.01 20:02:35 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd011.dat
[2012.08.01 17:50:57 | 000,001,300 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paint.NET.lnk
[2012.08.01 17:50:57 | 000,001,288 | ---- | C] () -- C:\Users\Public\Desktop\Paint.NET.lnk
[2012.08.01 17:48:30 | 000,000,993 | ---- | C] () -- C:\Users\DAVID\Desktop\PhotoScape.lnk
[2012.08.01 16:47:02 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.08.01 16:43:31 | 000,265,640 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.08.01 01:51:09 | 000,002,503 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.08.01 01:42:30 | 000,000,875 | ---- | C] () -- C:\Users\Public\Desktop\Steam.lnk
[2012.08.01 01:31:05 | 000,278,561 | ---- | C] () -- C:\Users\DAVID\Desktop\Minecraft.exe
[2012.08.01 01:30:50 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012.08.01 01:25:38 | 000,001,104 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.08.01 01:25:38 | 000,001,092 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.08.01 00:02:32 | 000,001,413 | ---- | C] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012.07.31 23:55:09 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012.07.31 23:55:01 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012.07.31 23:53:46 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.07.31 23:51:05 | 2616,745,984 | -HS- | C] () -- C:\hiberfil.sys
[2012.07.04 07:27:30 | 000,204,952 | ---- | C] () -- C:\Windows\System32\ativvsvl.dat
[2012.07.04 07:27:30 | 000,157,144 | ---- | C] () -- C:\Windows\System32\ativvsva.dat
[2012.07.04 02:32:18 | 000,159,232 | ---- | C] () -- C:\Windows\System32\clinfo.exe
[2012.04.18 19:39:06 | 000,028,672 | ---- | C] () -- C:\Windows\System32\kdbsdk32.dll
[2012.03.06 19:59:32 | 000,618,823 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\System32\atipblag.dat
[2011.06.10 06:34:52 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
 
========== LOP Check ==========
 
[2012.08.05 23:51:04 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\.minecraft
[2012.08.04 18:20:36 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Babylon
[2012.08.04 18:20:55 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\BabylonToolbar
[2012.08.11 01:27:32 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Downloaded Installations
[2012.08.01 22:43:16 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoft
[2012.08.01 22:42:36 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.08.28 14:57:48 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Kaiba Corporation
[2012.08.22 19:54:16 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Namco
[2012.08.01 22:42:55 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\OpenCandy
[2012.08.12 12:49:09 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\PhotoScape
[2012.08.04 18:20:33 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\YourFileDownloader
[2012.08.22 12:56:01 | 000,000,906 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000Core.job
[2012.08.29 00:56:00 | 000,000,928 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000UA.job
[2012.08.27 17:53:30 | 000,000,336 | ---- | M] () -- C:\Windows\Tasks\PC SpeedUp Service Deactivator.job
[2009.07.14 06:53:46 | 000,011,464 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.08.05 23:51:04 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\.minecraft
[2012.08.01 01:31:29 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Adobe
[2012.08.01 01:15:52 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\ATI
[2012.08.04 18:20:36 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Babylon
[2012.08.04 18:20:55 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\BabylonToolbar
[2012.08.11 01:27:32 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Downloaded Installations
[2012.08.01 22:43:16 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoft
[2012.08.01 22:42:36 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.08.01 00:02:20 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Identities
[2012.08.28 14:57:48 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Kaiba Corporation
[2012.08.01 01:29:23 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Macromedia
[2012.08.30 01:30:29 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Malwarebytes
[2009.07.14 10:56:41 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Media Center Programs
[2012.08.23 18:33:48 | 000,000,000 | --SD | M] -- C:\Users\DAVID\AppData\Roaming\Microsoft
[2012.08.01 01:25:51 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Mozilla
[2012.08.22 19:54:16 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Namco
[2012.08.01 22:42:55 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\OpenCandy
[2012.08.12 12:49:09 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\PhotoScape
[2012.08.29 16:55:21 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Skype
[2012.08.04 18:20:33 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\YourFileDownloader
 
< %APPDATA%\*.exe /s >
[2012.07.18 00:53:12 | 002,682,336 | ---- | M] (Speedchecker Limited                                        ) -- C:\Users\DAVID\AppData\Roaming\OpenCandy\FBDF2727D10F4AF39BF632C179D7C436\PCSU_SL_3.1.2.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2012.07.04 08:21:46 | 000,442,368 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\Windows\system32\ATIDEMGX.dll
 
< %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.* >
[2012.08.28 17:46:19 | 000,001,887 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.08.01 01:12:03 | 000,000,174 | -HS- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
[2012.08.12 12:52:06 | 000,001,320 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
 
< %APPDATA%\*AcroIEH*.* >
 
< %APPDATA%\*.exe >
 
< %APPDATA%\*.tmp >

< End of report >
         
Bedanke mich schon in voraus

habe bis jetzt mit KIS rescure disk so weit gereinigt das bis jetzt dises GVU nachricht nicht kommt aber möchte da noch sicher gehen das es 100 % weg ist

Code:
ATTFilter
OTL Extras logfile created on: 30.08.2012 01:38:52 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\DAVID\Desktop
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,41 Gb Available Physical Memory | 74,12% Memory free
6,50 Gb Paging File | 5,52 Gb Available in Paging File | 85,03% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 114,40 Gb Total Space | 79,37 Gb Free Space | 69,38% Space Free | Partition Type: NTFS
Drive D: | 37,25 Gb Total Space | 28,81 Gb Free Space | 77,35% Space Free | Partition Type: NTFS
 
Computer Name: DAVID-PC | User Name: DAVID | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0E71EA2A-8B7F-44D8-8BF6-E786EEFF3CB0}" = rport=139 | protocol=6 | dir=out | app=system | 
"{149F047B-0182-4C8A-8AD9-8D53AD19BCA5}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{1E4A8126-21E7-4A66-844B-CE091F092A9C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{20BB8D70-1BA9-4493-9AE4-394DEEA109C0}" = lport=137 | protocol=17 | dir=in | app=system | 
"{23CBCA6E-FFA4-4542-A31A-E7DA8A0B5E57}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{3EB90466-94D7-4C84-9E67-E2B543FC1746}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{4CC42362-AEF2-48ED-96EA-AED493B2A646}" = lport=139 | protocol=6 | dir=in | app=system | 
"{5C2EE4E7-237B-442C-B98B-5B350589E4A4}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{5C910D09-A4CD-4035-9970-F50D1A2DB00E}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{5CE22336-A521-4DF3-91C8-A818F791129E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{5F284DA7-2A5F-4E39-9A91-BF95C2BF2C1F}" = lport=445 | protocol=6 | dir=in | app=system | 
"{66F5CA14-2F22-4B1D-8672-0D42F7C2631D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{708934F4-548F-4E86-81A8-0C073AFE2CF5}" = lport=138 | protocol=17 | dir=in | app=system | 
"{8AE8E505-853A-4082-AE47-C4C9ABDC1C59}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{8C856EDD-D0D7-4D5E-98E8-D8ABBAB31B92}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{965A7ECA-0D43-4506-8A81-82D99525FB2F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{9F83B979-5581-49DB-9DAD-03D943C2FC1A}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{9FBE7D16-EC83-4288-82BA-60C4C3835CD2}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{AA09E96F-766D-406B-B1B7-F39C328043B8}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{AAD03F40-4B74-43C0-BE08-6B8DDD4216B2}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{BB3B8D84-E8EA-4E89-B688-E45737E7443D}" = rport=138 | protocol=17 | dir=out | app=system | 
"{BC8DCB34-5D31-4E42-B404-D0AB2ADE3754}" = rport=137 | protocol=17 | dir=out | app=system | 
"{E8DF50FD-C309-4330-9145-54B5146CCF17}" = rport=445 | protocol=6 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{083C5FAC-DAD1-4283-BEE4-01B85546D629}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe | 
"{09334953-6130-4C33-BEF4-37522D5EC0AA}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe | 
"{0D0C353A-9B05-430F-9839-68B61A895E73}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{140DB08D-7B93-4B98-8588-C4A330D7FAAB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{16E1E30C-F47B-46F4-A8C2-2FF7EABDCD8E}" = protocol=17 | dir=in | app=c:\program files\yourfiledownloader\downloader.exe | 
"{19CBCAF1-1303-4DA5-A7C5-4A2015FC722A}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{23FDA6C0-70F4-4D3B-B740-9AC834057F68}" = dir=in | app=c:\users\david\appdata\local\facebook\video\skype\facebookvideocalling.exe | 
"{31815D79-6899-428A-A694-DC9B66FEDC93}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe | 
"{31A28E47-7B53-4FCB-8B58-033642C70CAF}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 
"{33FE17F3-B1C8-4E55-BFC8-406300D27146}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{35A514BB-8BCA-4306-8D37-EC1DFBDCF23E}" = protocol=17 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe | 
"{40EC194A-03CC-4688-889A-A1D6E452C5D6}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe | 
"{4E8C3A26-EB18-447F-8E75-D167E70695A7}" = protocol=17 | dir=in | app=c:\program files\yourfiledownloader\yourfile.exe | 
"{50DA0AAD-A5B6-48A0-B21C-9F29D42D965B}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{6327EC05-F6A5-4025-89D6-34297766AE9E}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe | 
"{67D6085B-CFF6-4313-B33F-8B650203E900}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 
"{69056FC6-1269-4418-8261-F2C8E8408145}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{70E63EE3-766E-49CE-B22A-8D6923621658}" = dir=in | app=c:\program files\windows live\mesh\moe.exe | 
"{873194FD-056E-4D04-90E6-3526CA2825EC}" = protocol=6 | dir=in | app=c:\program files\yourfiledownloader\yourfile.exe | 
"{8E048679-6F15-4AF9-A88B-06CE7ED86931}" = protocol=17 | dir=in | app=c:\windows\system32\msiexec.exe | 
"{91F9AFE5-D8C4-473F-912A-21010047A646}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{9522901E-051E-4E00-BFB7-39CE84A7B37D}" = protocol=6 | dir=in | app=c:\windows\system32\msiexec.exe | 
"{96005A78-1D72-4607-8466-FCA88320F194}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{AD9A553A-12A4-48B1-B56D-098970CA379C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{AF3D6BFD-86FF-4C93-8236-8D6AE06D789A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{C2EEB483-43E2-47A9-B084-A534E041A589}" = protocol=6 | dir=out | app=system | 
"{CC3E5C06-8655-4886-8466-3612A3A220FC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{CC601D8A-1A0C-4883-9823-A690D441A357}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{D98AEB9C-BF75-4BA7-ADAF-2588CD60B15F}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe | 
"{DE746130-D62E-4762-A012-49ED6CA3A2BA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{E456DD15-2764-4CFB-877B-4AEF6B91F53A}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe | 
"{E48F1566-C455-46C0-B827-E992826E9B30}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe | 
"{E57D9A92-18EC-41A7-9D08-5DE119F0F85D}" = protocol=6 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe | 
"{E6DFA811-810B-45D8-AFE4-971AE03D699D}" = protocol=6 | dir=in | app=c:\program files\yourfiledownloader\downloader.exe | 
"{E6FAD79D-C4E2-44E6-8874-7913F9D1847B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{E7F5E5F2-9055-4284-AB73-992AA1797264}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{ECB4EFF2-712D-498D-AFE9-7B4E1FFE1030}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 
"{EE3B9250-94C2-43F7-B239-08C5F41BB1C4}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{F7430B27-4364-4527-B1A5-F31948E277B9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"TCP Query User{6CF77EF7-EE43-4464-B337-86A4B54A8AE2}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"UDP Query User{CAF25443-1149-46B9-A884-33C56C953AEB}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02602409-9189-4567-BC07-562605243B69}" = Windows Live Remote Client Resources
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{054C5EBD-1803-9B06-A201-63A1A8A5C365}" = CCC Help Danish
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0FB8CBBF-CFBA-B7C5-6433-4F5132783C31}" = CCC Help Portuguese
"{143412FA-840C-6158-599F-2B32D0861F80}" = Catalyst Control Center Graphics Previews Common
"{16FED766-CFB4-87B1-9591-4A394E4AE673}" = ccc-utility
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1D33871D-8470-7658-9AC6-27F8C77AA3AB}" = AMD Accelerated Video Transcoding
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1F6D1DB5-82B5-41A4-85A2-0A382C142A35}_is1" = Allgemeine Runtime Files (x86)
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20EA5B84-7055-65D9-7378-59750A15C6B5}" = CCC Help Russian
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{2680C5AE-EDC8-7A73-3D41-FCE9A2F22390}" = CCC Help German
"{26A24AE4-039D-4CA4-87B4-2F83217006FF}" = Java 7 Update 6
"{2D6E3D97-1FDF-4993-AC75-72F59EC445C5}" = Windows Live Family Safety
"{2D7F5276-5B18-A31A-3C39-3F537C12D310}" = AMD Drag and Drop Transcoding
"{32E879B3-F89C-5385-78C8-4DE7730C5FA0}" = AMD VISION Engine Control Center
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{336D0C35-8A85-403a-B9D2-65C292C39087}_is1" = Web Assistant 2.0.0.474
"{33D64034-5BC0-FF4F-6176-62ED61555CA8}" = CCC Help Thai
"{3406AF2D-25A4-F348-76C1-F2164AF6131F}" = AMD Fuel
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3A65A74A-5B6E-451A-92D8-50F1182BBE9A}" = Windows Live Remote Service Resources
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3CFAAB58-35C8-84C9-1391-8D4373714AFE}" = CCC Help Spanish
"{449CE12D-E2C7-4B97-B19E-55D163EA9435}" = Bing Bar
"{453FDDF1-BA65-8D13-2E6F-1740190BB5C4}" = CCC Help Greek
"{4728A95D-FD9B-CEE9-9609-BB01B5F82A0B}" = CCC Help Turkish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AFC194C-FEAD-B844-92C2-D0273872ECCF}" = CCC Help Dutch
"{529125EF-E3AC-4B74-97E6-F688A7C0F1BF}" = Paint.NET v3.5.10
"{5308F6BF-4660-926A-B611-0CBB32F44DD0}" = CCC Help Swedish
"{56E56B8C-6B2E-F4FD-2C82-BDC128BDC894}" = AMD Catalyst Install Manager
"{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}" = Microsoft LifeCam
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{69425AB7-75BF-25FC-EB4F-D2EAE9D82AA5}" = CCC Help Hungarian
"{6B00CD97-EADD-3AFC-A844-89EB4DA73461}" = Catalyst Control Center InstallProxy
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7683B745-6060-41FD-AA75-0BBB383FEAD4}" = SweetIM for Messenger 3.7
"{774C0434-9948-4DEE-A14E-69CDD316E36C}" = Internet Explorer Toolbar 4.6 by SweetPacks
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{79839E2D-82B1-6DF1-97A6-6737E4404407}" = CCC Help Japanese
"{7BB5E925-A3DD-48C2-9A82-017AF5982FFE}" = Facebook Messenger 2.1.4590.0
"{7C2D9B2C-D78C-EC0A-2337-612FD4799750}" = CCC Help Czech
"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159
"{7D9C2CBE-5941-0250-2922-804D0A506ED0}" = CCC Help Polish
"{83AA2913-C123-4146-85BD-AD8F93971D39}" = BabylonObjectInstaller
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{8729E65B-8C12-4A42-B1FE-E4DA7ED52855}_is1" = DirectX 9.0c Extra Files (x86)
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B57458E-1BB4-F08F-C534-8B3E3D541229}" = AMD Media Foundation Decoders
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{9057D097-0563-6FFB-CDC6-DB2B2C5D1014}" = CCC Help Italian
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{941A1864-A0D5-4EC0-933C-968F83A7D9E5}" = Dawn Of A New Era
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1.7
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA387C7F-7413-9C5A-DB71-70E406A8A92E}" = CCC Help French
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B00F5097-1F34-D3EA-4FB9-8DD2FAFF66F4}" = CCC Help Finnish
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B42129AB-E528-9CB4-7C8B-3BFE648F5CD8}" = CCC Help Norwegian
"{C1A27149-1897-8509-CBFC-2C96866C8AD6}" = CCC Help Korean
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DE54DD68-6E24-9B72-467A-DFEE00E6E9A8}" = CCC Help Chinese Traditional
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E9FDD18A-206A-9A43-AAE3-AB72EFFCD333}" = CCC Help Chinese Standard
"{ED524538-828E-1AD8-D0E1-E2E72C926EE0}" = CCC Help English
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F5A4F780-DF0C-444F-BA82-637CCF5C8052}" = Windows Live Family Safety
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FB697452-8CA4-46B4-98B1-165C922A2EF3}" = Update Manager for SweetPacks 1.0
"{FCFE800F-8F42-1AC9-895C-10389CB90D86}" = Catalyst Control Center Localization All
"{FDF7187F-3960-4BEC-916D-98C9A83E3A68}_is1" = DirectX for Managed Code
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"BabylonToolbar" = Babylon toolbar on IE
"CCleaner" = CCleaner
"Defraggler" = Defraggler
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.26.706
"incredibar" = Incredibar Toolbar  on IE
"M928366" = 
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"PCSU-SL_is1" = PC Beschleunigen - Vollständige Deinstallation
"PhotoScape" = PhotoScape
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"YourFileDownloader" = YourFileDownloader
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 24.08.2012 16:50:49 | Computer Name = DAVID-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_4_402_265.exe,
 Version: 11.4.402.265, Zeitstempel: 0x502bf384  Name des fehlerhaften Moduls: NPSWF32_11_4_402_265.dll,
 Version: 11.4.402.265, Zeitstempel: 0x502bf58e  Ausnahmecode: 0xc0000005  Fehleroffset:
 0x004caf42  ID des fehlerhaften Prozesses: 0x303c  Startzeit der fehlerhaften Anwendung:
 0x01cd823a230d3c84  Pfad der fehlerhaften Anwendung: C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll
Berichtskennung:
 628f035a-ee2d-11e1-93ee-001d9284e761
 
Error - 24.08.2012 16:51:39 | Computer Name = DAVID-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_4_402_265.exe,
 Version: 11.4.402.265, Zeitstempel: 0x502bf384  Name des fehlerhaften Moduls: NPSWF32_11_4_402_265.dll,
 Version: 11.4.402.265, Zeitstempel: 0x502bf58e  Ausnahmecode: 0xc0000005  Fehleroffset:
 0x001107f3  ID des fehlerhaften Prozesses: 0x2ac4  Startzeit der fehlerhaften Anwendung:
 0x01cd823a34dcfde1  Pfad der fehlerhaften Anwendung: C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll
Berichtskennung:
 7fe6d839-ee2d-11e1-93ee-001d9284e761
 
Error - 24.08.2012 16:51:53 | Computer Name = DAVID-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_4_402_265.exe,
 Version: 11.4.402.265, Zeitstempel: 0x502bf384  Name des fehlerhaften Moduls: NPSWF32_11_4_402_265.dll,
 Version: 11.4.402.265, Zeitstempel: 0x502bf58e  Ausnahmecode: 0xc0000005  Fehleroffset:
 0x0005d8eb  ID des fehlerhaften Prozesses: 0x2e04  Startzeit der fehlerhaften Anwendung:
 0x01cd823a49b708e1  Pfad der fehlerhaften Anwendung: C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll
Berichtskennung:
 8882e018-ee2d-11e1-93ee-001d9284e761
 
Error - 28.08.2012 07:45:22 | Computer Name = DAVID-PC | Source = MsiInstaller | ID = 1013
Description = 
 
Error - 28.08.2012 07:49:33 | Computer Name = DAVID-PC | Source = MsiInstaller | ID = 1013
Description = 
 
Error - 28.08.2012 07:52:24 | Computer Name = DAVID-PC | Source = MsiInstaller | ID = 1013
Description = 
 
Error - 28.08.2012 07:56:30 | Computer Name = DAVID-PC | Source = MsiInstaller | ID = 1013
Description = 
 
Error - 29.08.2012 10:51:06 | Computer Name = DAVID-PC | Source = Windows Search Service | ID = 7040
Description = 
 
Error - 29.08.2012 10:51:06 | Computer Name = DAVID-PC | Source = Windows Search Service | ID = 7042
Description = 
 
Error - 29.08.2012 19:28:35 | Computer Name = DAVID-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.59.1 kann nicht mehr unter Windows ausgeführt
 werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 2c4    Startzeit: 
01cd863d2dffbe71    Endzeit: 16    Anwendungspfad: C:\Users\DAVID\Desktop\OTL.exe    Berichts-ID:
 32a28b9c-f231-11e1-b658-001d9284e761  
 
[ System Events ]
Error - 29.08.2012 19:38:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "\Device\HarddiskVolume3" den Befehl "chkdsk" aus.
 
Error - 29.08.2012 19:38:42 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "\Device\HarddiskVolume3" den Befehl "chkdsk" aus.
 
Error - 29.08.2012 19:39:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "\Device\HarddiskVolume3" den Befehl "chkdsk" aus.
 
Error - 29.08.2012 19:40:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "D:" den Befehl "chkdsk" aus.
 
Error - 29.08.2012 19:41:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "\Device\HarddiskVolume3" den Befehl "chkdsk" aus.
 
Error - 29.08.2012 19:42:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "\Device\HarddiskVolume3" den Befehl "chkdsk" aus.
 
Error - 29.08.2012 19:43:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "D:" den Befehl "chkdsk" aus.
 
Error - 29.08.2012 19:44:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "D:" den Befehl "chkdsk" aus.
 
Error - 29.08.2012 19:45:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "D:" den Befehl "chkdsk" aus.
 
Error - 29.08.2012 19:46:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "D:" den Befehl "chkdsk" aus.
 
 
< End of report >
         
und noch denn bericht von
malwarebytes:

Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.29.10

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
DAVID :: DAVID-PC [Administrator]

Schutz: Aktiviert

30.08.2012 02:15:32
mbam-log-2012-08-30 (02-15-32).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 182237
Laufzeit: 3 Minute(n), 13 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

Alt 30.08.2012, 10:44   #2
NinjaB
 
GVU Trojaner - Standard

GVU Trojaner



könnt ihr da weiter helfen (ich hoffe ich habe das so gut geschiltert mein problem mit den gvu trojaner ansondsten sry bin keiner dern jeden tag in chat oder in forum sind )

habe ich bis jetzt alles gepostet was man braucht oder fehlt da noch was ?
__________________


Alt 31.08.2012, 19:59   #3
t'john
/// Helfer-Team
 
GVU Trojaner - Standard

GVU Trojaner





Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
  • Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.


Code:
ATTFilter
:OTL

SRV - [2012.07.29 11:23:14 | 000,188,760 | ---- | M] () [Auto | Running] -- C:\Programme\Web Assistant\ExtensionUpdaterService.exe -- (Web Assistant Updater) 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6} 
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&crg=3.16010003&st=12&q={searchTerms}&barid={02010704-9E70-4432-A75F-0CAEB55238B6} 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredibar.com/mb178?a=6OyM8En1pg&i=26 
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.) 
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} 
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=112555&tt=010812_nich_3112_7&babsrc=SP_ss&mntrId=60755749000000000000001d9284e761 
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredibar.com/mb178/?search={searchTerms}&loc=IB_DS&a=6OyM8En1pg&i=26 
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&crg=3.16010003&st=12&q={searchTerms}&barid={02010704-9E70-4432-A75F-0CAEB55238B6} 
IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
FF - prefs.js..browser.search.defaultenginename: "MyStart Search" 
FF - prefs.js..browser.search.defaulturl: "" 
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)" 
FF - prefs.js..browser.search.selectedEngine: "Google" 
FF - prefs.js..browser.startup.homepage: "http://www.hlportal.de/" 
FF - prefs.js..keyword.URL: "http://mystart.incredibar.com/mb178/?loc=IB_DS&a=6OyM8En1pg&&i=26&search=" 
FF - prefs.js..network.proxy.type: 0 
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Search the web (Babylon)" 
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Google" 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012.08.25 23:35:09 | 000,000,000 | ---D | M] 
CHR - homepage: http://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6} 
CHR - default_search_provider: MyStart Search (Enabled) 
CHR - default_search_provider: search_url = http://mystart.incredibar.com/mb178/?loc=IB_DS&search={searchTerms}&a=6OyM8En1pg&i=26 
CHR - Extension: Web Assistant = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.474_0\ 
CHR - Extension: SweetIM for Facebook = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\Copy of 
CHR - Extension: SweetIM for Facebook = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\ 
CHR - Extension: New tab for Chrome\u2122 = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg\1.0.0_0\ 
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\bh\BabylonToolbar.dll (Babylon BHO) 
O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Programme\Web Assistant\Extension32.dll () 
O2 - BHO: (incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Programme\incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (Montera Technologeis LTD) 
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation) 
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) 
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarTlbr.dll (Babylon Ltd.) 
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) 
O3 - HKLM\..\Toolbar: (incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Programme\incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD) 
O3 - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) 
O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.) 
O4 - HKLM..\Run: [Sweetpacks Communicator] C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.) 
O4 - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000..\Run: [PCSpeedUp] C:\Programme\PC Beschleunigen\PCSUNotifier.exe () 
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) 
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) 
O4 - Startup: C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\DAVID\AppData\Local\Facebook\Messenger\2.1.4590.0\FacebookMessenger.exe (Facebook) 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation) 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] 


[2012.08.13 12:21:07 | 000,000,000 | ---D | C] -- C:\ProgramData\SweetIM 
[2012.08.04 18:20:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon 
[2012.08.01 22:44:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Beschleunigen 
[2012.08.01 22:42:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft 

[2012.08.29 16:54:23 | 004,503,728 | ---- | M] () -- C:\ProgramData\nud0repor.pad 
[2012.08.28 17:46:19 | 000,001,887 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk 

[2012.07.18 00:53:12 | 002,682,336 | ---- | M] (Speedchecker Limited ) -- C:\Users\DAVID\AppData\Roaming\OpenCandy\FBDF2727D10F4AF39BF632C179D7C436\PCSU_SL_3.1.2.exe 
[2012.08.05 14:07:33 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com 
[2012.08.25 23:35:07 | 000,002,203 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\searchplugins\MyStart Search.xml 
[2012.08.25 23:35:09 | 000,000,000 | ---D | M] (Web Assistant) -- C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX 
[2012.08.25 23:35:17 | 000,000,000 | ---D | C] -- C:\Program Files\Perion 
[2012.08.25 23:35:12 | 000,000,000 | ---D | C] -- C:\Program Files\incredibar.com 
[2012.08.25 23:35:09 | 000,000,000 | ---D | C] -- C:\Program Files\Web Assistant 
[2012.08.25 23:35:13 | 000,000,764 | ---- | M] () -- C:\user.js 
[2012.08.13 12:21:03 | 000,000,000 | ---- | M] () -- C:\END 
[2012.08.04 18:20:54 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\BabylonToolbar 
[2012.08.04 18:20:49 | 000,000,000 | ---D | C] -- C:\Program Files\BabylonToolbar 
[2012.08.04 18:20:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Babylon 
[2012.08.04 18:20:33 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\YourFileDownloader 
[2012.08.04 18:20:33 | 000,000,000 | ---D | C] -- C:\Program Files\YourFileDownloader 
[2012.08.28 13:45:52 | 000,000,000 | ---D | C] -- C:\Windows\System32\URTTEMP 


:Files

C:\Users\DAVID\AppData\Local\{*}
C:\ProgramData\*.exe
C:\ProgramData\TEMP
C:\Users\DAVID\AppData\Local\Temp\*.exe
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
%SystemRoot%\System32\*.tmp
%SystemRoot%\SysWOW64\*.tmp
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
         
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________
__________________

Alt 02.09.2012, 12:22   #4
NinjaB
 
GVU Trojaner - Standard

GVU Trojaner



so sry aber wahr gestern total müde das ich jetzt erst das gemacht habe hier den text datei von OTL

Code:
ATTFilter
All processes killed
========== OTL ==========
Service Web Assistant Updater stopped successfully!
Service Web Assistant Updater deleted successfully!
C:\Programme\Web Assistant\ExtensionUpdaterService.exe moved successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C360-6118-11DC-9C72-001320C79847}\ not found.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}\ deleted successfully.
C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll moved successfully.
HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}\ not found.
Registry key HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C360-6118-11DC-9C72-001320C79847}\ not found.
HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: "MyStart Search" removed from browser.search.defaultenginename
Prefs.js: "" removed from browser.search.defaulturl
Prefs.js: "Search the web (Babylon)" removed from browser.search.order.1
Prefs.js: "Google" removed from browser.search.selectedEngine
Prefs.js: "hxxp://www.hlportal.de/" removed from browser.startup.homepage
Prefs.js: "hxxp://mystart.incredibar.com/mb178/?loc=IB_DS&a=6OyM8En1pg&&i=26&search=" removed from keyword.URL
Prefs.js: 0 removed from network.proxy.type
Prefs.js: "Search the web (Babylon)" removed from sweetim.toolbar.previous.browser.search.defaultenginename
Prefs.js: "Google" removed from sweetim.toolbar.previous.browser.search.selectedEngine
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}\ deleted successfully.
C:\Program Files\Web Assistant\Firefox\defaults\preferences folder moved successfully.
C:\Program Files\Web Assistant\Firefox\defaults folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\skin folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\locale\en-US folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\locale folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\content\resources folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\content\libraries folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\content folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome folder moved successfully.
C:\Program Files\Web Assistant\Firefox folder moved successfully.
Use Chrome's Settings page to change the HomePage.
Use Chrome's Settings page to remove the default_search_provider items.
Use Chrome's Settings page to remove the default_search_provider items.
C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.474_0\resources folder moved successfully.
C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.474_0\libraries folder moved successfully.
C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.474_0 folder moved successfully.
File C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\Copy of not found.
C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0 folder moved successfully.
C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg\1.0.0_0\Plugins folder moved successfully.
C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg\1.0.0_0 folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\bh\BabylonToolbar.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}\ not found.
C:\Programme\Web Assistant\Extension32.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}\ deleted successfully.
C:\Programme\incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}\ deleted successfully.
C:\Programme\Windows Live\Companion\companioncore.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}\ deleted successfully.
C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ deleted successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarTlbr.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ deleted successfully.
File C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{F9639E4A-801B-4843-AEE3-03D9DA199E77} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F9639E4A-801B-4843-AEE3-03D9DA199E77}\ deleted successfully.
C:\Programme\incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll moved successfully.
Registry value HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
File C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SweetIM deleted successfully.
C:\Programme\SweetIM\Messenger\SweetIM.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Sweetpacks Communicator deleted successfully.
C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Windows\CurrentVersion\Run\\PCSpeedUp deleted successfully.
C:\Programme\PC Beschleunigen\PCSUNotifier.exe moved successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
File move failed. C:\Windows\System32\mctadmin.exe scheduled to be moved on reboot.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
File move failed. C:\Windows\System32\mctadmin.exe scheduled to be moved on reboot.
C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk moved successfully.
C:\Users\DAVID\AppData\Local\Facebook\Messenger\2.1.4590.0\FacebookMessenger.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{0000036B-C524-4050-81A0-243669A86B9F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0000036B-C524-4050-81A0-243669A86B9F}\ not found.
File C:\Programme\Windows Live\Companion\companioncore.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
C:\ProgramData\SweetIM\Messenger\update folder moved successfully.
C:\ProgramData\SweetIM\Messenger\logs folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\packages\FailDialog folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\packages folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\contentdb folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\Default\400 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\Default\200 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\Default\100 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\Default folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\100\default folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\100\bar0168 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\100\bar0104 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\100 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data folder moved successfully.
C:\ProgramData\SweetIM\Messenger\conf\users\wandererdavidssj8_90@live.de folder moved successfully.
C:\ProgramData\SweetIM\Messenger\conf\users folder moved successfully.
C:\ProgramData\SweetIM\Messenger\conf folder moved successfully.
C:\ProgramData\SweetIM\Messenger folder moved successfully.
C:\ProgramData\SweetIM\Communicator\Logs folder moved successfully.
C:\ProgramData\SweetIM\Communicator\conf folder moved successfully.
C:\ProgramData\SweetIM\Communicator folder moved successfully.
C:\ProgramData\SweetIM folder moved successfully.
C:\ProgramData\Babylon folder moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Beschleunigen folder moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft\Tools folder moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft\Programs folder moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft folder moved successfully.
C:\ProgramData\nud0repor.pad moved successfully.
C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk moved successfully.
C:\Users\DAVID\AppData\Roaming\OpenCandy\FBDF2727D10F4AF39BF632C179D7C436\PCSU_SL_3.1.2.exe moved successfully.
C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio folder moved successfully.
C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs folder moved successfully.
C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com\content\imgs folder moved successfully.
C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com\content folder moved successfully.
C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com\components folder moved successfully.
C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com folder moved successfully.
C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\searchplugins\MyStart Search.xml moved successfully.
Folder C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX\ not found.
C:\Program Files\Perion\NewTab folder moved successfully.
C:\Program Files\Perion folder moved successfully.
C:\Program Files\incredibar.com\incredibar\1.5.11.14\bh folder moved successfully.
C:\Program Files\incredibar.com\incredibar\1.5.11.14 folder moved successfully.
C:\Program Files\incredibar.com\incredibar folder moved successfully.
C:\Program Files\incredibar.com folder moved successfully.
C:\Program Files\Web Assistant\resources folder moved successfully.
C:\Program Files\Web Assistant\libraries folder moved successfully.
C:\Program Files\Web Assistant folder moved successfully.
C:\user.js moved successfully.
C:\END moved successfully.
C:\Users\DAVID\AppData\Roaming\BabylonToolbar\Shared folder moved successfully.
C:\Users\DAVID\AppData\Roaming\BabylonToolbar\IE folder moved successfully.
C:\Users\DAVID\AppData\Roaming\BabylonToolbar\FF folder moved successfully.
C:\Users\DAVID\AppData\Roaming\BabylonToolbar\CR folder moved successfully.
C:\Users\DAVID\AppData\Roaming\BabylonToolbar folder moved successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\bh folder moved successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1 folder moved successfully.
C:\Programme\BabylonToolbar\BabylonToolbar folder moved successfully.
C:\Users\DAVID\AppData\Roaming\Babylon folder moved successfully.
C:\Users\DAVID\AppData\Roaming\YourFileDownloader folder moved successfully.
C:\Program Files\YourFileDownloader folder moved successfully.
C:\Windows\System32\URTTEMP folder moved successfully.
========== FILES ==========
C:\Users\DAVID\AppData\Local\{02139779-AC82-4FD4-BEC4-1E7CE7D291F8} folder moved successfully.
C:\Users\DAVID\AppData\Local\{05D54603-FF7E-4972-A537-E4E99B176E79} folder moved successfully.
C:\Users\DAVID\AppData\Local\{0AC293C2-380F-4FC8-973B-D1DA57F894E3} folder moved successfully.
C:\Users\DAVID\AppData\Local\{0C079B8E-8EC4-414A-8962-97BE5F46FC49} folder moved successfully.
C:\Users\DAVID\AppData\Local\{1422C04D-9D74-4483-865B-52C45E21E570} folder moved successfully.
C:\Users\DAVID\AppData\Local\{14ED5BCA-91C1-465B-B5A0-C136A6C95416} folder moved successfully.
C:\Users\DAVID\AppData\Local\{17BFBFA2-3B8A-4DCD-990B-5E34AB8589D3} folder moved successfully.
C:\Users\DAVID\AppData\Local\{1863F3F9-C4EE-4E4E-BE72-6B42E973A38A} folder moved successfully.
C:\Users\DAVID\AppData\Local\{1912FD8E-4F8C-4DD2-9ABE-B6337B08A99F} folder moved successfully.
C:\Users\DAVID\AppData\Local\{199BBFA7-03AB-4B30-B7B2-0F36BB5F406E} folder moved successfully.
C:\Users\DAVID\AppData\Local\{1BCE4FB6-C611-48A9-ADB4-A4BE3F99FFB9} folder moved successfully.
C:\Users\DAVID\AppData\Local\{1C986E0F-39FE-404D-9C06-AFFF63788D27} folder moved successfully.
C:\Users\DAVID\AppData\Local\{1ED976BA-9880-4615-8287-38FE7E3D7F83} folder moved successfully.
C:\Users\DAVID\AppData\Local\{1F2267B3-DCE0-4DC8-B3A4-E0D9A0B5E061} folder moved successfully.
C:\Users\DAVID\AppData\Local\{235318B8-F279-4CA9-A52E-A5CC759CE37E} folder moved successfully.
C:\Users\DAVID\AppData\Local\{2666C542-9294-44C6-989C-A3AA218411CB} folder moved successfully.
C:\Users\DAVID\AppData\Local\{269AA1F6-34B6-4809-BE3C-DC44F4FA75D4} folder moved successfully.
C:\Users\DAVID\AppData\Local\{297A7543-3CE9-4971-9F13-1548882E53F0} folder moved successfully.
C:\Users\DAVID\AppData\Local\{2AC7E57D-A98C-41F3-BFB1-4D4DB3863B53} folder moved successfully.
C:\Users\DAVID\AppData\Local\{2B2E21DA-51F9-4B37-9117-063A6EF4E3CE} folder moved successfully.
C:\Users\DAVID\AppData\Local\{310F73D9-E60F-483F-9B61-8BC8AF9494B2} folder moved successfully.
C:\Users\DAVID\AppData\Local\{3B1172AC-8B45-4ED4-9572-266D3B87A182} folder moved successfully.
C:\Users\DAVID\AppData\Local\{3DE389B4-21C6-4EF5-8BF2-2125B738FB7E} folder moved successfully.
C:\Users\DAVID\AppData\Local\{3EA14EC2-49DA-4ABF-9973-41A45A6A36E4} folder moved successfully.
C:\Users\DAVID\AppData\Local\{408FFAD5-F2FA-4003-87C0-B5BE3EE339A7} folder moved successfully.
C:\Users\DAVID\AppData\Local\{44362EDA-AF1C-463A-803F-03AB0D7903B8} folder moved successfully.
C:\Users\DAVID\AppData\Local\{456EA81D-AF2B-416A-B8E4-331D321D94CD} folder moved successfully.
C:\Users\DAVID\AppData\Local\{4838BC28-92D9-4830-8577-0213983EC707} folder moved successfully.
C:\Users\DAVID\AppData\Local\{49BB09EF-F59F-48F5-9CF2-C1A95C8E6203} folder moved successfully.
C:\Users\DAVID\AppData\Local\{52C7D846-D01A-4CAB-804B-471650C994F3} folder moved successfully.
C:\Users\DAVID\AppData\Local\{5429EB52-19E3-43D6-BCC3-B199799BB7AD} folder moved successfully.
C:\Users\DAVID\AppData\Local\{5647895B-9C4B-409E-A38C-2772D698418F} folder moved successfully.
C:\Users\DAVID\AppData\Local\{5A3141BA-7C90-404A-BDCD-C519CC469776} folder moved successfully.
C:\Users\DAVID\AppData\Local\{660D6C36-EB57-4749-99B8-EC6A1731ECF9} folder moved successfully.
C:\Users\DAVID\AppData\Local\{69187003-FC8F-4047-A90E-97A4608E6069} folder moved successfully.
C:\Users\DAVID\AppData\Local\{74C5C7E0-7B28-40F1-B457-603587B130DD} folder moved successfully.
C:\Users\DAVID\AppData\Local\{7A4C2557-182F-48B5-9824-24BC1977C34B} folder moved successfully.
C:\Users\DAVID\AppData\Local\{81CC2B07-26AC-448A-936F-B214C29D51AB} folder moved successfully.
C:\Users\DAVID\AppData\Local\{840B3278-5D66-4516-ADD9-0AC97A23CB30} folder moved successfully.
C:\Users\DAVID\AppData\Local\{8C8178A6-3AF8-4CC6-BCE1-F66F1883CE6C} folder moved successfully.
C:\Users\DAVID\AppData\Local\{8D27366A-EF92-4DEA-A76E-40514405ADBE} folder moved successfully.
C:\Users\DAVID\AppData\Local\{8E243A93-5D51-411F-A2A3-5B43441F3E19} folder moved successfully.
C:\Users\DAVID\AppData\Local\{8FB349F9-71F5-4C01-8982-5A562376DAAF} folder moved successfully.
C:\Users\DAVID\AppData\Local\{90C325E5-C120-49B6-B17F-51BC89180147} folder moved successfully.
C:\Users\DAVID\AppData\Local\{9CD59B95-DBD1-4F4B-821E-1643F6892142} folder moved successfully.
C:\Users\DAVID\AppData\Local\{9F2A31F6-DBF8-45BA-AE38-8DC41891BECB} folder moved successfully.
C:\Users\DAVID\AppData\Local\{A3BDA7CD-7DC8-4F42-B547-D0FE664CC038} folder moved successfully.
C:\Users\DAVID\AppData\Local\{A5C05416-0D11-4151-97E2-EC046BE23852} folder moved successfully.
C:\Users\DAVID\AppData\Local\{A6B5B453-2E78-4CDB-8B52-B99E543F0188} folder moved successfully.
C:\Users\DAVID\AppData\Local\{A8A3BA5A-B6F5-47A7-A155-714F8EA8AC8D} folder moved successfully.
C:\Users\DAVID\AppData\Local\{AA70E4C7-3EA6-4479-AAFD-4B32DC075A42} folder moved successfully.
C:\Users\DAVID\AppData\Local\{B0C8A4DA-2EAB-4BB2-9709-E04AFFC4CE21} folder moved successfully.
C:\Users\DAVID\AppData\Local\{B4EF47E7-3879-4F1C-91B6-F28AEAF05972} folder moved successfully.
C:\Users\DAVID\AppData\Local\{B7698B4A-3A96-4D69-BBCE-612004A05FD7} folder moved successfully.
C:\Users\DAVID\AppData\Local\{B7EF1C98-97A8-4FAF-83EC-E773C8EB479C} folder moved successfully.
C:\Users\DAVID\AppData\Local\{BD0C36FC-4345-475D-8E00-7B2CB1546E34} folder moved successfully.
C:\Users\DAVID\AppData\Local\{C1E37549-7EB1-4C8E-93A5-8FE0C663A06C} folder moved successfully.
C:\Users\DAVID\AppData\Local\{C59EEA8A-D61E-4067-B523-B362207F253B} folder moved successfully.
C:\Users\DAVID\AppData\Local\{C6697D36-273A-4462-A68B-BC4711B63CA9} folder moved successfully.
C:\Users\DAVID\AppData\Local\{C7B2F9FE-30DF-4F25-8D34-DF7D1876D825} folder moved successfully.
C:\Users\DAVID\AppData\Local\{CBDA15B1-0953-4E03-9631-24B4ECF4DC67} folder moved successfully.
C:\Users\DAVID\AppData\Local\{D5D78E76-B6C4-43ED-A7E9-4E0226747904} folder moved successfully.
C:\Users\DAVID\AppData\Local\{DDDEBA05-4446-4E17-9086-4A17F993C423} folder moved successfully.
C:\Users\DAVID\AppData\Local\{E02D56C4-A005-431F-9758-88F30D4BFD59} folder moved successfully.
C:\Users\DAVID\AppData\Local\{F5F71426-9B07-440E-8A74-893D43DB5AC5} folder moved successfully.
C:\Users\DAVID\AppData\Local\{F5FF8639-8AAA-4099-B3B3-3AE8D854DB48} folder moved successfully.
C:\Users\DAVID\AppData\Local\{FAD0800A-D4C8-472E-BCBE-AD056320F233} folder moved successfully.
C:\Users\DAVID\AppData\Local\{FDEFC916-94F8-402F-BF07-85166C54D94D} folder moved successfully.
C:\Users\DAVID\AppData\Local\{FF041113-94D8-4843-B1B9-CD21598ADF43} folder moved successfully.
File\Folder C:\ProgramData\*.exe not found.
File\Folder C:\ProgramData\TEMP not found.
C:\Users\DAVID\AppData\Local\Temp\GoogleUpdateSetup.exe2282d5c moved successfully.
C:\Users\DAVID\AppData\Local\Temp\ICReinstall_Pokemon_Chaos_Black_downloader.exe moved successfully.
C:\Users\DAVID\AppData\Local\Temp\IminentSetup.exe moved successfully.
C:\Users\DAVID\AppData\Local\Temp\incredibar_installer.exe moved successfully.
C:\Users\DAVID\AppData\Local\Temp\install_flashplayer11x32_mssd_aih.exe moved successfully.
C:\Users\DAVID\AppData\Local\Temp\IZArcSetup.exe moved successfully.
C:\Users\DAVID\AppData\Local\Temp\PacmanSDM.exe moved successfully.
C:\Users\DAVID\AppData\Local\Temp\SIMEEIInstaller.exe moved successfully.
C:\Users\DAVID\AppData\Local\Temp\toolbar9954531.exe moved successfully.
C:\Users\DAVID\AppData\Local\Temp\UpdateCheckerSetup.exe moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
File/Folder C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
File/Folder C:\Windows\System32\*.tmp not found.
File/Folder C:\Windows\SysWOW64\*.tmp not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\DAVID\Desktop\die datai\cmd.bat deleted successfully.
C:\Users\DAVID\Desktop\die datai\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: DAVID
->Temp folder emptied: 255660006 bytes
->Temporary Internet Files folder emptied: 10055328 bytes
->FireFox cache emptied: 572717017 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 11063 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 68910 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 800,00 mb
 
 
OTL by OldTimer - Version 3.2.59.1 log created on 09022012_131700

Files\Folders moved on Reboot...
File move failed. C:\Windows\System32\mctadmin.exe scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         

Alt 03.09.2012, 18:35   #5
t'john
/// Helfer-Team
 
GVU Trojaner - Standard

GVU Trojaner



Sehr gut!

Wie laeuft der Rechner?

1. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

__________________
Mfg, t'john
Das TB unterstützen

Alt 05.09.2012, 14:43   #6
NinjaB
 
GVU Trojaner - Standard

GVU Trojaner



So das erste ist

malwarebytes txt:

Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.09.05.06

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
DAVID :: DAVID-PC [Administrator]

Schutz: Deaktiviert

05.09.2012 14:47:11
mbam-log-2012-09-05 (14-47-11).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 349696
Laufzeit: 45 Minute(n), 53 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

AdwCleaner.txt:

Code:
ATTFilter
# AdwCleaner v2.000 - Datei am 09/05/2012 um 15:41:47 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Ultimate  (32 bits)
# Benutzer : DAVID - DAVID-PC
# Normaler Modus : Normal
# Ausgeführt unter : C:\Users\DAVID\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gefunden : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
Datei Gefunden : C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
Datei Gefunden : C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\searchplugins\SweetIm.xml
Ordner Gefunden : C:\Program Files\BabylonToolbar
Ordner Gefunden : C:\Program Files\SweetIM
Ordner Gefunden : C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Ordner Gefunden : C:\Users\DAVID\AppData\LocalLow\BabylonToolbar
Ordner Gefunden : C:\Users\DAVID\AppData\LocalLow\SweetIM
Ordner Gefunden : C:\Users\DAVID\AppData\Roaming\OpenCandy
Ordner Gefunden : C:\Windows\Installer\{FB697452-8CA4-46B4-98B1-165C922A2EF3}

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\BabylonToolbar
Schlüssel Gefunden : HKCU\Software\IM
Schlüssel Gefunden : HKCU\Software\ImInstaller
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403a-B9D2-65C292C39087}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403a-B9D2-65C292C39087}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Schlüssel Gefunden : HKCU\Software\SweetIm
Schlüssel Gefunden : HKLM\Software\Babylon
Schlüssel Gefunden : HKLM\Software\BabylonToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\b
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\bbylnApp.appCore
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{291BCCC1-6890-484A-89D3-318C928DAC1B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{C01315C7-B4E2-4864-B43D-5FAFC414D179}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{C1545464-C77C-4130-A572-1C619E2895FE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{ED0E67AD-926C-4008-87E5-03CF72AA2A7E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{EF7FEC6D-451B-4452-9D26-7E10C6B5DB6E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\I
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Incredibar.dskBnd
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Incredibar.dskBnd.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IncredibarApp.appCore
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IncredibarApp.appCore.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\sim-packages
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.sweetie
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{48C9C8B0-A546-46C1-A81F-47A31E623E9D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{74C36554-31F0-49DD-8857-ED6A64DF45BE}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{83AA2913-C123-4146-85BD-AD8F93971D39}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FB697452-8CA4-46B4-98B1-165C922A2EF3}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BabylonToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\incredibar
Schlüssel Gefunden : HKLM\Software\SweetIm
Schlüssel Gefunden : HKLM\Software\Web Assistant

***** [Internet Browser] *****

-\\ Internet Explorer v8.0.7600.16385

[HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.babylon.com/?affID=112555&tt=010812_nich_3112_7&babsrc=NT_ss&mntrId=60755749000000000000001d9284e761

-\\ Mozilla Firefox v14.0.1 (de)

Profilname : default 
Datei : C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\prefs.js

Gefunden : user_pref("browser.newtab.url", "hxxp://mystart.incredibar.com/mb178?a=6OyM8En1pg&loc=FF_NT");
Gefunden : user_pref("extensions.BabylonToolbar.admin", false);
Gefunden : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Gefunden : user_pref("extensions.BabylonToolbar.babExt", "");
Gefunden : user_pref("extensions.BabylonToolbar.babTrack", "affID=112555&tt=010812_nich_3112_7");
Gefunden : user_pref("extensions.BabylonToolbar.cntry", "DE");
Gefunden : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Gefunden : user_pref("extensions.BabylonToolbar.envrmnt", "production");
Gefunden : user_pref("extensions.BabylonToolbar.excTlbr", false);
Gefunden : user_pref("extensions.BabylonToolbar.hdrMd5", "4A3191D57F4FBBFE86C7B05893D431CE");
Gefunden : user_pref("extensions.BabylonToolbar.hmpg", false);
Gefunden : user_pref("extensions.BabylonToolbar.id", "60755749000000000000001d9284e761");
Gefunden : user_pref("extensions.BabylonToolbar.instlDay", "15556");
Gefunden : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Gefunden : user_pref("extensions.BabylonToolbar.isdcmntcmplt", true);
Gefunden : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.29.118:20:49");
Gefunden : user_pref("extensions.BabylonToolbar.mntrvrsn", "1.3.0");
Gefunden : user_pref("extensions.BabylonToolbar.newTab", true);
Gefunden : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Gefunden : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Gefunden : user_pref("extensions.BabylonToolbar.sg", "none");
Gefunden : user_pref("extensions.BabylonToolbar.smplGrp", "none");
Gefunden : user_pref("extensions.BabylonToolbar.srcExt", "ss");
Gefunden : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Gefunden : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://www.google.com/search?babsrc=TB_ggl&q=");
Gefunden : user_pref("extensions.BabylonToolbar.vrsn", "1.5.29.1");
Gefunden : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.29.118:20:49");
Gefunden : user_pref("extensions.BabylonToolbar.vrsni", "1.5.29.1");
Gefunden : user_pref("extensions.BabylonToolbar_i.babExt", "");
Gefunden : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112555&tt=010812_nich_3112_7");
Gefunden : user_pref("extensions.BabylonToolbar_i.newTab", true);
Gefunden : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=112555&tt=01081[...]
Gefunden : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Gefunden : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Gefunden : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.29.118:20:49");
Gefunden : user_pref("extensions.incredibar.admin", false);
Gefunden : user_pref("extensions.incredibar.aflt", "orgnl");
Gefunden : user_pref("extensions.incredibar.cntry", "DE");
Gefunden : user_pref("extensions.incredibar.dfltLng", "");
Gefunden : user_pref("extensions.incredibar.dfltSrch", false);
Gefunden : user_pref("extensions.incredibar.did", "10643");
Gefunden : user_pref("extensions.incredibar.envrmnt", "production");
Gefunden : user_pref("extensions.incredibar.excTlbr", false);
Gefunden : user_pref("extensions.incredibar.hdrMd5", "164F659628301C9E9D3BA03A1C6C3542");
Gefunden : user_pref("extensions.incredibar.hmpg", false);
Gefunden : user_pref("extensions.incredibar.id", "60755749000000000000001d9284e761");
Gefunden : user_pref("extensions.incredibar.installerproductid", "26");
Gefunden : user_pref("extensions.incredibar.instlDay", "15577");
Gefunden : user_pref("extensions.incredibar.instlRef", "");
Gefunden : user_pref("extensions.incredibar.isDcmntCmplt", true);
Gefunden : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1423:35:13");
Gefunden : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Gefunden : user_pref("extensions.incredibar.newTab", false);
Gefunden : user_pref("extensions.incredibar.noFFXTlbr", false);
Gefunden : user_pref("extensions.incredibar.ppd", "1");
Gefunden : user_pref("extensions.incredibar.prdct", "incredibar");
Gefunden : user_pref("extensions.incredibar.productid", "26");
Gefunden : user_pref("extensions.incredibar.prtnrId", "Incredibar");
Gefunden : user_pref("extensions.incredibar.sg", "none");
Gefunden : user_pref("extensions.incredibar.smplGrp", "none");
Gefunden : user_pref("extensions.incredibar.tlbrId", "base");
Gefunden : user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6OyM8En1pg&loc=IB_T[...]
Gefunden : user_pref("extensions.incredibar.upn2", "6OyM8En1pg");
Gefunden : user_pref("extensions.incredibar.upn2n", "92261993790348266");
Gefunden : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Gefunden : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1423:35:13");
Gefunden : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Gefunden : user_pref("extensions.incredibar_i.aflt", "orgnl");
Gefunden : user_pref("extensions.incredibar_i.dfltLng", "");
Gefunden : user_pref("extensions.incredibar_i.did", "10643");
Gefunden : user_pref("extensions.incredibar_i.excTlbr", false);
Gefunden : user_pref("extensions.incredibar_i.id", "60755749000000000000001d9284e761");
Gefunden : user_pref("extensions.incredibar_i.installerproductid", "26");
Gefunden : user_pref("extensions.incredibar_i.instlDay", "15577");
Gefunden : user_pref("extensions.incredibar_i.instlRef", "");
Gefunden : user_pref("extensions.incredibar_i.ms_url_id", "");
Gefunden : user_pref("extensions.incredibar_i.newTab", false);
Gefunden : user_pref("extensions.incredibar_i.ppd", "1");
Gefunden : user_pref("extensions.incredibar_i.prdct", "incredibar");
Gefunden : user_pref("extensions.incredibar_i.productid", "26");
Gefunden : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Gefunden : user_pref("extensions.incredibar_i.smplGrp", "none");
Gefunden : user_pref("extensions.incredibar_i.tlbrId", "base");
Gefunden : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6OyM8En1pg&loc=IB[...]
Gefunden : user_pref("extensions.incredibar_i.upn2", "6OyM8En1pg");
Gefunden : user_pref("extensions.incredibar_i.upn2n", "92261993790348266");
Gefunden : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Gefunden : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1423:35:13");
Gefunden : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Gefunden : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Gefunden : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www.hlportal.de/");
Gefunden : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={020[...]
Gefunden : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_referrer", "hxxp://us.yhs4.search.y[...]
Gefunden : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_temp_referer", "hxxp://us.yhs4.sear[...]
Gefunden : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]

-\\ Google Chrome v21.0.1180.89

Datei : C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Preferences

Gefunden [l.8] : homepage = "hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6}",
Gefunden [l.12] : urls_to_restore_on_startup = [ "hxxp://mystart.incredibar.com/mb178?a=6OyM8En1pg&i=26" ]
Gefunden [l.41] : icon_url = "hxxp://mystart.incredibar.com/mb178/favicon.ico",
Gefunden [l.44] : keyword = "mystart.incredibar.com/mb178",
Gefunden [l.47] : search_url = "hxxp://mystart.incredibar.com/mb178/?loc=IB_DS&search={searchTerms}&a=6OyM8En1pg&i=26",
Gefunden [l.1200] : homepage = "hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6}",
Gefunden [l.1548] : urls_to_restore_on_startup = [ "hxxp://mystart.incredibar.com/mb178?a=6OyM8En1pg&i=26" ]

*************************

AdwCleaner[R1].txt - [24060 octets] - [30/08/2012 01:29:21]
AdwCleaner[R4].txt - [21237 octets] - [05/09/2012 15:41:47]

########## EOF - C:\AdwCleaner[R4].txt - [21298 octets] ##########
         

Alt 06.09.2012, 02:34   #7
t'john
/// Helfer-Team
 
GVU Trojaner - Standard

GVU Trojaner



Sehr gut!


  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.




danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________
Mfg, t'john
Das TB unterstützen

Alt 06.09.2012, 07:04   #8
NinjaB
 
GVU Trojaner - Standard

GVU Trojaner



SO hier die 2 logs

1adwcleaner:

Code:
ATTFilter
# AdwCleaner v2.000 - Datei am 09/06/2012 um 07:14:51 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Ultimate  (32 bits)
# Benutzer : DAVID - DAVID-PC
# Normaler Modus : Normal
# Ausgeführt unter : C:\Users\DAVID\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
Datei Gelöscht : C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
Datei Gelöscht : C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\searchplugins\SweetIm.xml
Ordner Gelöscht : C:\Program Files\BabylonToolbar
Ordner Gelöscht : C:\Program Files\SweetIM
Ordner Gelöscht : C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Ordner Gelöscht : C:\Users\DAVID\AppData\LocalLow\BabylonToolbar
Ordner Gelöscht : C:\Users\DAVID\AppData\LocalLow\SweetIM
Ordner Gelöscht : C:\Users\DAVID\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Windows\Installer\{FB697452-8CA4-46B4-98B1-165C922A2EF3}

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\BabylonToolbar
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403a-B9D2-65C292C39087}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403a-B9D2-65C292C39087}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Schlüssel Gelöscht : HKCU\Software\SweetIm
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\BabylonToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\b
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylnApp.appCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{291BCCC1-6890-484A-89D3-318C928DAC1B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C01315C7-B4E2-4864-B43D-5FAFC414D179}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C1545464-C77C-4130-A572-1C619E2895FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ED0E67AD-926C-4008-87E5-03CF72AA2A7E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EF7FEC6D-451B-4452-9D26-7E10C6B5DB6E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\I
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Incredibar.dskBnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Incredibar.dskBnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IncredibarApp.appCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IncredibarApp.appCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\sim-packages
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.sweetie
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{48C9C8B0-A546-46C1-A81F-47A31E623E9D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{74C36554-31F0-49DD-8857-ED6A64DF45BE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{83AA2913-C123-4146-85BD-AD8F93971D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FB697452-8CA4-46B4-98B1-165C922A2EF3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BabylonToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\incredibar
Schlüssel Gelöscht : HKLM\Software\SweetIm
Schlüssel Gelöscht : HKLM\Software\Web Assistant

***** [Internet Browser] *****

-\\ Internet Explorer v8.0.7600.16385

Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.babylon.com/?affID=112555&tt=010812_nich_3112_7&babsrc=NT_ss&mntrId=60755749000000000000001d9284e761 --> hxxp://www.google.com

-\\ Mozilla Firefox v14.0.1 (de)

Profilname : default 
Datei : C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\prefs.js

C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\user.js ... Gelöscht !

Gelöscht : user_pref("browser.newtab.url", "hxxp://mystart.incredibar.com/mb178?a=6OyM8En1pg&loc=FF_NT");
Gelöscht : user_pref("extensions.BabylonToolbar.admin", false);
Gelöscht : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Gelöscht : user_pref("extensions.BabylonToolbar.babExt", "");
Gelöscht : user_pref("extensions.BabylonToolbar.babTrack", "affID=112555&tt=010812_nich_3112_7");
Gelöscht : user_pref("extensions.BabylonToolbar.cntry", "DE");
Gelöscht : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Gelöscht : user_pref("extensions.BabylonToolbar.envrmnt", "production");
Gelöscht : user_pref("extensions.BabylonToolbar.excTlbr", false);
Gelöscht : user_pref("extensions.BabylonToolbar.hdrMd5", "4A3191D57F4FBBFE86C7B05893D431CE");
Gelöscht : user_pref("extensions.BabylonToolbar.hmpg", false);
Gelöscht : user_pref("extensions.BabylonToolbar.id", "60755749000000000000001d9284e761");
Gelöscht : user_pref("extensions.BabylonToolbar.instlDay", "15556");
Gelöscht : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Gelöscht : user_pref("extensions.BabylonToolbar.isdcmntcmplt", true);
Gelöscht : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.29.118:20:49");
Gelöscht : user_pref("extensions.BabylonToolbar.mntrvrsn", "1.3.0");
Gelöscht : user_pref("extensions.BabylonToolbar.newTab", true);
Gelöscht : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Gelöscht : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Gelöscht : user_pref("extensions.BabylonToolbar.sg", "none");
Gelöscht : user_pref("extensions.BabylonToolbar.smplGrp", "none");
Gelöscht : user_pref("extensions.BabylonToolbar.srcExt", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://www.google.com/search?babsrc=TB_ggl&q=");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsn", "1.5.29.1");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.29.118:20:49");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsni", "1.5.29.1");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babExt", "");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112555&tt=010812_nich_3112_7");
Gelöscht : user_pref("extensions.BabylonToolbar_i.newTab", true);
Gelöscht : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=112555&tt=01081[...]
Gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Gelöscht : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.29.118:20:49");
Gelöscht : user_pref("extensions.incredibar.admin", false);
Gelöscht : user_pref("extensions.incredibar.aflt", "orgnl");
Gelöscht : user_pref("extensions.incredibar.cntry", "DE");
Gelöscht : user_pref("extensions.incredibar.dfltLng", "");
Gelöscht : user_pref("extensions.incredibar.dfltSrch", false);
Gelöscht : user_pref("extensions.incredibar.did", "10643");
Gelöscht : user_pref("extensions.incredibar.envrmnt", "production");
Gelöscht : user_pref("extensions.incredibar.excTlbr", false);
Gelöscht : user_pref("extensions.incredibar.hdrMd5", "164F659628301C9E9D3BA03A1C6C3542");
Gelöscht : user_pref("extensions.incredibar.hmpg", false);
Gelöscht : user_pref("extensions.incredibar.id", "60755749000000000000001d9284e761");
Gelöscht : user_pref("extensions.incredibar.installerproductid", "26");
Gelöscht : user_pref("extensions.incredibar.instlDay", "15577");
Gelöscht : user_pref("extensions.incredibar.instlRef", "");
Gelöscht : user_pref("extensions.incredibar.isDcmntCmplt", true);
Gelöscht : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1423:35:13");
Gelöscht : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Gelöscht : user_pref("extensions.incredibar.newTab", false);
Gelöscht : user_pref("extensions.incredibar.noFFXTlbr", false);
Gelöscht : user_pref("extensions.incredibar.ppd", "1");
Gelöscht : user_pref("extensions.incredibar.prdct", "incredibar");
Gelöscht : user_pref("extensions.incredibar.productid", "26");
Gelöscht : user_pref("extensions.incredibar.prtnrId", "Incredibar");
Gelöscht : user_pref("extensions.incredibar.sg", "none");
Gelöscht : user_pref("extensions.incredibar.smplGrp", "none");
Gelöscht : user_pref("extensions.incredibar.tlbrId", "base");
Gelöscht : user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6OyM8En1pg&loc=IB_T[...]
Gelöscht : user_pref("extensions.incredibar.upn2", "6OyM8En1pg");
Gelöscht : user_pref("extensions.incredibar.upn2n", "92261993790348266");
Gelöscht : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Gelöscht : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1423:35:13");
Gelöscht : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Gelöscht : user_pref("extensions.incredibar_i.aflt", "orgnl");
Gelöscht : user_pref("extensions.incredibar_i.dfltLng", "");
Gelöscht : user_pref("extensions.incredibar_i.did", "10643");
Gelöscht : user_pref("extensions.incredibar_i.excTlbr", false);
Gelöscht : user_pref("extensions.incredibar_i.id", "60755749000000000000001d9284e761");
Gelöscht : user_pref("extensions.incredibar_i.installerproductid", "26");
Gelöscht : user_pref("extensions.incredibar_i.instlDay", "15577");
Gelöscht : user_pref("extensions.incredibar_i.instlRef", "");
Gelöscht : user_pref("extensions.incredibar_i.ms_url_id", "");
Gelöscht : user_pref("extensions.incredibar_i.newTab", false);
Gelöscht : user_pref("extensions.incredibar_i.ppd", "1");
Gelöscht : user_pref("extensions.incredibar_i.prdct", "incredibar");
Gelöscht : user_pref("extensions.incredibar_i.productid", "26");
Gelöscht : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Gelöscht : user_pref("extensions.incredibar_i.smplGrp", "none");
Gelöscht : user_pref("extensions.incredibar_i.tlbrId", "base");
Gelöscht : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6OyM8En1pg&loc=IB[...]
Gelöscht : user_pref("extensions.incredibar_i.upn2", "6OyM8En1pg");
Gelöscht : user_pref("extensions.incredibar_i.upn2n", "92261993790348266");
Gelöscht : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Gelöscht : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1423:35:13");
Gelöscht : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Gelöscht : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Gelöscht : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Gelöscht : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www.hlportal.de/");
Gelöscht : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={020[...]
Gelöscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_referrer", "hxxp://us.yhs4.search.y[...]
Gelöscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_temp_referer", "hxxp://us.yhs4.sear[...]
Gelöscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]

-\\ Google Chrome v21.0.1180.89

Datei : C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Preferences

Gelöscht [l.8] : homepage = "hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6}",
Gelöscht [l.12] : urls_to_restore_on_startup = [ "hxxp://mystart.incredibar.com/mb178?a=6OyM8En1pg&i=26" ]
Gelöscht [l.41] : icon_url = "hxxp://mystart.incredibar.com/mb178/favicon.ico",
Gelöscht [l.44] : keyword = "mystart.incredibar.com/mb178",
Gelöscht [l.47] : search_url = "hxxp://mystart.incredibar.com/mb178/?loc=IB_DS&search={searchTerms}&a=6OyM8En1pg&i=26",
Gelöscht [l.1227] : homepage = "hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6}",
Gelöscht [l.1575] : urls_to_restore_on_startup = [ "hxxp://mystart.incredibar.com/mb178?a=6OyM8En1pg&i=26" ]

*************************

AdwCleaner[R1].txt - [24060 octets] - [30/08/2012 01:29:21]
AdwCleaner[R4].txt - [21368 octets] - [05/09/2012 15:41:47]
AdwCleaner[R5].txt - [21429 octets] - [06/09/2012 07:11:02]
AdwCleaner[S1].txt - [21985 octets] - [06/09/2012 07:14:51]

########## EOF - C:\AdwCleaner[S1].txt - [22046 octets] ##########
         

2Emsisoft Anti-Malware:

Code:
ATTFilter
Emsisoft Anti-Malware - Version 6.0
Letztes Update: 06.09.2012 07:33:49

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	06.09.2012 07:34:14

C:\_OTL\MovedFiles\09022012_131700\C_Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarApp.dll 	gefunden: Riskware.Win32.Toolbar.Babylon.AMN!E1
C:\_OTL\MovedFiles\09022012_131700\C_Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarsrv.exe 	gefunden: Riskware.Win32.Toolbar.Babylon.AMN!E1

Gescannt	596268
Gefunden	2

Scan Ende:	06.09.2012 08:02:31
Scan Zeit:	0:28:17
         

Alt 06.09.2012, 18:09   #9
t'john
/// Helfer-Team
 
GVU Trojaner - Standard

GVU Trojaner



Sehr gut!



Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

  • Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
  • Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
  • Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.
Los geht's

  • Lade und starte Eset Smartinstaller
  • Haken setzen bei YES, I accept the Terms of Use.
  • Klick auf Start.
  • Haken setzen bei Remove found threads und Scan archives.
  • Klick auf Start.
  • Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Finish drücken.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset
__________________
Mfg, t'john
Das TB unterstützen

Alt 06.09.2012, 21:00   #10
NinjaB
 
GVU Trojaner - Standard

GVU Trojaner



habe grade gesehen das der virus wieder da ist es kommt wieder den gvu bild wass soll ich jetzt tuhen ? wieder alles neu machen oder wie ???

Alt 07.09.2012, 14:39   #11
t'john
/// Helfer-Team
 
GVU Trojaner - Standard

GVU Trojaner



Nicht mit dem Rechner rumsurfen!
Er ist noch garnicht abgesichert!

1. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
__________________
Mfg, t'john
Das TB unterstützen

Alt 08.09.2012, 10:19   #12
NinjaB
 
GVU Trojaner - Standard

GVU Trojaner



so hier die log
werde mein bruter noch mal sagen müssen danke noch mals ^^


[/CODE] Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.09.08.02

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
DAVID :: DAVID-PC [Administrator]

Schutz: Deaktiviert

08.09.2012 10:40:30
mbam-log-2012-09-08 (10-40-30).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 325949
Laufzeit: 36 Minute(n), 44 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
[/CODE]

Geändert von NinjaB (08.09.2012 um 10:24 Uhr)

Alt 09.09.2012, 02:09   #13
t'john
/// Helfer-Team
 
GVU Trojaner - Standard

GVU Trojaner



ESET: http://www.trojaner-board.de/123045-...tml#post910095
__________________
Mfg, t'john
Das TB unterstützen

Alt 09.09.2012, 15:25   #14
NinjaB
 
GVU Trojaner - Standard

GVU Trojaner



hier die log von eset

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=9ce524c8a2d9c04ca1d80d280770e642
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-09 01:39:08
# local_time=2012-09-09 03:39:08 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT 
# compatibility_mode=5893 16776573 100 94 81702 98824688 0 0
# compatibility_mode=8192 67108863 100 0 106 106 0 0
# scanned=151648
# found=5
# cleaned=5
# scan_time=4450
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\6b64a084-36e89541	a variant of Win32/Kryptik.ALNU trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Users\DAVID\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\33c1867f-451266d8	a variant of Java/Exploit.CVE-2012-4681.O trojan (deleted - quarantined)	00000000000000000000000000000000	C
C:\Users\DAVID\Desktop\Neuer Ordner (2)\IZArcInstall.exe	a variant of Win32/Somoto.A application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\_OTL\MovedFiles\09022012_131700\C_Users\DAVID\AppData\Local\Temp\ICReinstall_Pokemon_Chaos_Black_downloader.exe	a variant of Win32/InstallCore.AF application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Neuer Ordner (3)\Neuer Ordner (2)\IZArcInstall.exe	a variant of Win32/Somoto.A application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
         
ich habe da neustart gemacht und jetzt ist windows kaput habe ich da was falsches gemacht oder richtig habe alles nach den anweisung von dir gemacht ?

Alt 09.09.2012, 22:30   #15
t'john
/// Helfer-Team
 
GVU Trojaner - Standard

GVU Trojaner



Kaputt?

Was heisst das?
__________________
Mfg, t'john
Das TB unterstützen

Antwort

Themen zu GVU Trojaner
4d36e972-e325-11ce-bfc1-08002be10318, adobe, autorun, babylon toolbar, babylontoolbar, bho, bingbar, c:\windows\system32\cmd.exe, converter, defender, explorer, firefox, flash player, format, gereinigt, google, incredibar toolbar, install.exe, kaspersky, langs, limited.com/facebook, logfile, mozilla, mp3, msiexec.exe, msiinstaller, msvcrt, musik, neue version, nvidia, object, plug-in, programme, registry, rundll, scan, search the web, software, speedchecker, sweetim, trojaner, windows, winlogon.exe, wrapper




Zum Thema GVU Trojaner - Hallo ICh hoffe ich habe da alles richtig gemacht bin zum ersten mal hier ^^ naja zurück zu meinen prob. nehmlich mein bruter hat den gvu trojaner und jetzt stadt - GVU Trojaner...
Archiv
Du betrachtest: GVU Trojaner auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.