Hallo zusammen!

Ich haben mir den oben genannten Trojaner heute eingefangen und stieß dabei auf euch. Mein Netbook kann ich nur noch im abgesicherten Modus nutzen und besitze keinen anderen aktiven Computer.

Wird Windows normal gestartet, wird der Bildschirm nach einigen Sekunden komplett (ohne Internetverbindung). Ist das Netbook jedoch am Netz, kommt die Meldung von "Bundesamt für Sicherheit in der Informationstechnik". Es geht gar nicht´s mehr, auch kein Taskmanager, sowie auch die Startleiste gänzlich verschwunden ist.

Ich haben bei euch schon ein wenig nachgelesen und mir das Programm "OTL" heruntergeladen und das Netbook scannen lassen. Ich kopiere das Ergebnis mal hier rein:

OTL logfile created on: 24.01.2013 14:27:34 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Pascal\Desktop
Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,99 Gb Total Physical Memory | 1,49 Gb Available Physical Memory | 74,86% Memory free
3,98 Gb Paging File | 3,52 Gb Available in Paging File | 88,45% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 215,79 Gb Total Space | 36,21 Gb Free Space | 16,78% Space Free | Partition Type: NTFS
Drive D: | 4,00 Gb Total Space | 3,89 Gb Free Space | 97,41% Space Free | Partition Type: FAT32

Computer Name: PASCAL-PC | User Name: Pascal | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Pascal\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Opera\opera.exe (Opera Software)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()


========== Services (SafeList) ==========

SRV - (SpeedBoosterSvc) -- C:\Program Files\Common Files\OptimalSuite Common\BoostService.exe File not found
SRV - (McAfee SiteAdvisor Service) -- c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe File not found
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AVGIDSAgent) -- C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (TeamViewer7) -- C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (SkypeUpdate) -- C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (ALDITALKVerbindungsassistent_Service) -- C:\Program Files\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Service.exe ()
SRV - (Sony PC Companion) -- C:\Program Files\Sony\Sony PC Companion\PCCService.exe (Avanquest Software)
SRV - (FsUsbExService) -- C:\Windows\System32\FsUsbExService.Exe (Teruten)
SRV - (DsiWMIService) -- C:\Program Files\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (ePowerSvc) -- C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
SRV - (IAStorDataMgrSvc) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (MWLService) -- C:\Program Files\EgisTec MyWinLocker\x86\MWLService.exe (Egis Technology Inc.)
SRV - (RS_Service) -- C:\Program Files\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
SRV - (Updater Service) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer Group)
SRV - (GREGService) -- C:\Program Files\Acer\Registration\GREGsvc.exe (Acer Incorporated)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (L1C) -- system32\DRIVERS\L1C62x86.sys File not found
DRV - (huawei_enumerator) -- system32\DRIVERS\ew_jubusenum.sys File not found
DRV - (ewusbmbb) -- system32\DRIVERS\ewusbwwan.sys File not found
DRV - (dgderdrv) -- System32\drivers\dgderdrv.sys File not found
DRV - (AVGIDSDriver) -- C:\Windows\System32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSHX) -- C:\Windows\System32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) -- C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) -- C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) -- C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avglogx) -- C:\Windows\System32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) -- C:\Windows\System32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgrkx86) -- C:\Windows\System32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (ggsemc) -- C:\Windows\System32\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)
DRV - (ggflt) -- C:\Windows\System32\drivers\ggflt.sys (Sony Ericsson Mobile Communications)
DRV - (ewusbnet) -- C:\Windows\System32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (ew_hwusbdev) -- C:\Windows\System32\drivers\ew_hwusbdev.sys (Huawei Technologies Co., Ltd.)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (FsUsbExDisk) -- C:\Windows\System32\FsUsbExDisk.Sys ()
DRV - (EUCR) -- C:\Windows\System32\drivers\EUCR6SK.sys (ENE Technology Inc.)
DRV - (NETw5s32) -- C:\Windows\System32\drivers\NETw5s32.sys (Intel Corporation)
DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (mwlPSDVDisk) -- C:\Windows\System32\drivers\mwlPSDVDisk.sys (Egis Technology Inc.)
DRV - (mwlPSDNServ) -- C:\Windows\System32\drivers\mwlPSDNserv.sys (Egis Technology Inc.)
DRV - (mwlPSDFilter) -- C:\Windows\System32\drivers\mwlPSDFilter.sys (Egis Technology Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=2937&q={searchTerms}


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\.DEFAULT\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-18\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\..\URLSearchHook: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - No CLSID value found
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - No CLSID value found
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\..\URLSearchHook: {dc84d6f4-abf5-441d-bdef-65f3f4d7aabe} - No CLSID value found
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = hxxp://blekko.com/ws/?source=c3348dd4&tbp=rbox&toolbarid=blekkotb_031&u=ABDE1ADAD6F511965478764FC75773D0&q={searchTerms}
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7PRFA_de
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=2937&q={searchTerms}
IE - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Web Search"
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "Web Search"
FF - prefs.js..browser.search.useDBForOrder: false
FF - prefs.js..browser.startup.homepage: "hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937"
FF - prefs.js..keyword.URL: "hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q="


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.03 06:40:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.08.25 17:09:36 | 000,000,000 | ---D | M]

[2011.01.23 14:11:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pascal\AppData\Roaming\mozilla\Extensions
[2012.12.15 19:02:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pascal\AppData\Roaming\mozilla\Firefox\Profiles\2cm1wc0l.default\extensions
[2011.09.13 12:18:50 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\Pascal\AppData\Roaming\mozilla\Firefox\Profiles\2cm1wc0l.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2012.06.02 21:49:20 | 000,000,000 | ---D | M] (BittorrentBar_DE Community Toolbar) -- C:\Users\Pascal\AppData\Roaming\mozilla\Firefox\Profiles\2cm1wc0l.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}
[2012.06.02 09:22:02 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Pascal\AppData\Roaming\mozilla\Firefox\Profiles\2cm1wc0l.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.03.31 15:47:29 | 000,000,000 | ---D | M] (United States English Spellchecker) -- C:\Users\Pascal\AppData\Roaming\mozilla\Firefox\Profiles\2cm1wc0l.default\extensions\en-US@dictionaries.addons.mozilla.org
[2012.05.13 10:54:04 | 001,184,804 | ---- | M] () (No name found) -- C:\Users\Pascal\AppData\Roaming\mozilla\firefox\profiles\2cm1wc0l.default\extensions\testpilot@labs.mozilla.com.xpi
[2012.12.15 19:02:39 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\Pascal\AppData\Roaming\mozilla\firefox\profiles\2cm1wc0l.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.12.01 09:06:28 | 000,003,269 | ---- | M] () -- C:\Users\Pascal\AppData\Roaming\mozilla\firefox\profiles\2cm1wc0l.default\searchplugins\Web Search.xml
[2012.05.13 10:58:37 | 000,002,533 | ---- | M] () -- C:\Users\Pascal\AppData\Roaming\mozilla\firefox\profiles\2cm1wc0l.default\searchplugins\wikipedia-de---go.xml
[2012.03.11 15:45:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012.02.16 15:55:53 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.16 12:02:53 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.16 11:48:01 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.16 12:02:53 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.16 12:02:53 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.05.31 12:35:25 | 000,002,134 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\search.xml
[2012.12.01 09:06:28 | 000,003,269 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Web Search.xml
[2012.02.16 12:02:53 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.16 12:02:53 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] C:\Program Files\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [iPatchData] C:\Program Files\Acer\Updater\iUpdate.exe (Insyde Software Corp.)
O4 - HKLM..\Run: [iSyncData] C:\Program Files\Acer\Android Manager\iSync.exe (Insyde Software Corp.)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [mwlDaemon] C:\Program Files\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [SuiteTray] C:\Program Files\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O4 - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000..\Run: [svñhîst] C:\Users\Pascal\wgsdgsdgdsgsd.exe (Softspecialists)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Pascal\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.7.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{16E88DF1-40AC-4CF2-8F97-4519DB78D4E1}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5A713C53-FB40-44DE-9F81-92D070741BCF}: NameServer = 8.26.56.26,156.154.70.22
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C99021B6-0704-476A-BCF5-4555495DADB0}: DhcpNameServer = 192.168.42.129
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{0383cbd9-6b53-11e1-8f6e-001e101fa1f5}\Shell - "" = AutoRun
O33 - MountPoints2\{0383cbd9-6b53-11e1-8f6e-001e101fa1f5}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{0383cbdf-6b53-11e1-8f6e-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{0383cbdf-6b53-11e1-8f6e-1c750831ec56}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{17ea48a7-7ab6-11e1-87f3-0026c7c00c48}\Shell - "" = AutoRun
O33 - MountPoints2\{17ea48a7-7ab6-11e1-87f3-0026c7c00c48}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{17ea48d0-7ab6-11e1-87f3-0026c7c00c48}\Shell - "" = AutoRun
O33 - MountPoints2\{17ea48d0-7ab6-11e1-87f3-0026c7c00c48}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{17ea48da-7ab6-11e1-87f3-0026c7c00c48}\Shell - "" = AutoRun
O33 - MountPoints2\{17ea48da-7ab6-11e1-87f3-0026c7c00c48}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{17ea48e8-7ab6-11e1-87f3-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{17ea48e8-7ab6-11e1-87f3-1c750831ec56}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{17ea4924-7ab6-11e1-87f3-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{17ea4924-7ab6-11e1-87f3-1c750831ec56}\Shell\AutoRun\command - "" = E:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{17ea493d-7ab6-11e1-87f3-001e101f79c9}\Shell - "" = AutoRun
O33 - MountPoints2\{17ea493d-7ab6-11e1-87f3-001e101f79c9}\Shell\AutoRun\command - "" = E:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{339ee3b9-d844-11e1-a0c3-c9fdf352b271}\Shell - "" = AutoRun
O33 - MountPoints2\{339ee3b9-d844-11e1-a0c3-c9fdf352b271}\Shell\AutoRun\command - "" = G:\Startme.exe
O33 - MountPoints2\{4283b95b-8262-11e1-8e9c-001e101f9843}\Shell - "" = AutoRun
O33 - MountPoints2\{4283b95b-8262-11e1-8e9c-001e101f9843}\Shell\AutoRun\command - "" = E:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{717c7ea7-9a0a-11e1-a1d2-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{717c7ea7-9a0a-11e1-a1d2-1c750831ec56}\Shell\AutoRun\command - "" = G:\Install.exe
O33 - MountPoints2\{b292b25f-a29e-11e1-8f0a-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{b292b25f-a29e-11e1-8f0a-1c750831ec56}\Shell\AutoRun\command - "" = E:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{b4b52000-6843-11e1-86aa-001e101f7f74}\Shell - "" = AutoRun
O33 - MountPoints2\{b4b52000-6843-11e1-86aa-001e101f7f74}\Shell\AutoRun\command - "" = G:\LGAutoRun.exe
O33 - MountPoints2\{b8f2874e-8596-11e1-a25e-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{b8f2874e-8596-11e1-a25e-1c750831ec56}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{b8f2875f-8596-11e1-a25e-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{b8f2875f-8596-11e1-a25e-1c750831ec56}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{bd0a315d-8acd-11e1-a1fa-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{bd0a315d-8acd-11e1-a1fa-1c750831ec56}\Shell\AutoRun\command - "" = E:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{c9500a86-fafb-11e0-a2cf-0026c7c00c48}\Shell - "" = AutoRun
O33 - MountPoints2\{c9500a86-fafb-11e0-a2cf-0026c7c00c48}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{c9500a95-fafb-11e0-a2cf-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{c9500a95-fafb-11e0-a2cf-1c750831ec56}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{d0b0d723-7a9a-11e1-b552-001e101f82a7}\Shell - "" = AutoRun
O33 - MountPoints2\{d0b0d723-7a9a-11e1-b552-001e101f82a7}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{d0b0d759-7a9a-11e1-b552-001e101f82a7}\Shell - "" = AutoRun
O33 - MountPoints2\{d0b0d759-7a9a-11e1-b552-001e101f82a7}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{d0b0d764-7a9a-11e1-b552-001e101f82a7}\Shell - "" = AutoRun
O33 - MountPoints2\{d0b0d764-7a9a-11e1-b552-001e101f82a7}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{d8f041b1-8400-11e1-a067-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{d8f041b1-8400-11e1-a067-1c750831ec56}\Shell\AutoRun\command - "" = E:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{d8f041bd-8400-11e1-a067-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{d8f041bd-8400-11e1-a067-1c750831ec56}\Shell\AutoRun\command - "" = E:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{efdfaf40-7bb5-11e1-ba04-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{efdfaf40-7bb5-11e1-ba04-1c750831ec56}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{efdfb03a-7bb5-11e1-ba04-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{efdfb03a-7bb5-11e1-ba04-1c750831ec56}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\Install.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found


CREATERESTOREPOINT
Unable to start System Restore Service. Error code 1084

========== Files/Folders - Created Within 30 Days ==========

[2013.01.24 14:21:46 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Pascal\Desktop\OTL.exe
[2013.01.24 14:18:41 | 000,000,000 | ---D | C] -- C:\Users\Pascal\Desktop\OTL
[2013.01.24 14:18:01 | 000,000,000 | ---D | C] -- C:\Program Files\sweetpacks bundle uninstaller
[2013.01.24 12:03:45 | 000,054,784 | RHS- | C] (Softspecialists) -- C:\Users\Pascal\wgsdgsdgdsgsd.exe
[2013.01.19 03:52:46 | 000,000,000 | ---D | C] -- C:\Users\Pascal\Documents\Adobe
[2013.01.16 17:00:43 | 000,000,000 | ---D | C] -- C:\Users\Pascal\AppData\Roaming\Logitech
[2013.01.16 17:00:43 | 000,000,000 | ---D | C] -- C:\Users\Pascal\AppData\Roaming\Logishrd
[2013.01.14 21:52:11 | 000,000,000 | ---D | C] -- C:\Users\Pascal\AppData\Local\{7BF7736F-1732-423A-BBB4-938519760E60}
[2013.01.14 18:24:09 | 000,000,000 | ---D | C] -- C:\Users\Pascal\Desktop\Adobe
[2013.01.14 00:04:16 | 000,000,000 | ---D | C] -- C:\Users\Pascal\AppData\Local\{A4DEB98D-C5BD-4E4E-963E-4B6AFB210CA6}
[2013.01.13 23:49:03 | 000,000,000 | ---D | C] -- C:\Users\Pascal\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2013.01.13 23:48:51 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe Download Assistant
[2013.01.09 10:45:51 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\System32\oflc-nz.rs
[2013.01.09 10:45:50 | 002,576,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gameux.dll
[2013.01.09 10:45:50 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\System32\fpb.rs
[2013.01.09 10:45:50 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\System32\pegibbfc.rs
[2013.01.09 10:45:50 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\System32\csrr.rs
[2013.01.09 10:45:50 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\System32\cob-au.rs
[2013.01.09 10:45:50 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\System32\usk.rs
[2013.01.09 10:45:50 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\System32\grb.rs
[2013.01.09 10:45:50 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\System32\pegi-pt.rs
[2013.01.09 10:45:50 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\System32\pegi.rs
[2013.01.09 10:45:50 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\System32\djctq.rs
[2013.01.09 10:45:49 | 000,308,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wpc.dll
[2013.01.09 10:45:49 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\System32\esrb.rs
[2013.01.09 10:45:48 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\System32\cero.rs
[2013.01.09 10:45:48 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\System32\oflc.rs
[2013.01.09 10:45:48 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\System32\pegi-fi.rs
[2013.01.09 10:45:30 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.01.09 10:45:10 | 000,271,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
[2013.01.09 10:45:10 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2013.01.09 10:45:09 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2013.01.09 10:45:08 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2013.01.09 10:45:08 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2013.01.09 10:45:08 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2013.01.09 10:45:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.01.09 10:45:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2013.01.09 10:45:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2013.01.09 10:45:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2013.01.09 10:45:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2013.01.09 10:45:07 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2013.01.09 10:45:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2013.01.09 08:55:46 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2013.01.09 08:55:45 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
[2013.01.09 08:50:30 | 000,000,000 | ---D | C] -- C:\Users\Pascal\AppData\Local\{66731F0C-8D9F-45D7-B298-5A4D0639F9B4}
[2013.01.08 17:07:38 | 000,000,000 | ---D | C] -- C:\Users\Pascal\AppData\Local\{39523E63-7013-4631-A176-9670BAE0BAF5}
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013.01.24 14:21:46 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Pascal\Desktop\OTL.exe
[2013.01.24 14:18:11 | 000,001,985 | ---- | M] () -- C:\Users\Pascal\Desktop\Continue SweetIM installation.lnk
[2013.01.24 14:16:43 | 000,235,696 | ---- | M] () -- C:\Users\Pascal\Desktop\zipper_V.6190383.exe
[2013.01.24 14:12:54 | 000,011,580 | ---- | M] () -- C:\Users\Pascal\Desktop\OTL.7z
[2013.01.24 13:58:18 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2013.01.24 13:58:06 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.01.24 13:57:54 | 1602,035,712 | -HS- | M] () -- C:\hiberfil.sys
[2013.01.24 13:51:28 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.01.24 12:30:48 | 000,009,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.01.24 12:30:48 | 000,009,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.01.24 12:03:45 | 000,054,784 | RHS- | M] (Softspecialists) -- C:\Users\Pascal\wgsdgsdgdsgsd.exe
[2013.01.24 11:56:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.01.24 11:07:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.01.21 11:00:00 | 000,000,193 | ---- | M] () -- C:\Users\Pascal\AppData\Roaming\SamsungLiveUpdateConfig.ini
[2013.01.18 01:57:55 | 000,591,708 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.01.18 01:57:55 | 000,559,668 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.01.18 01:57:55 | 000,112,420 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.01.18 01:57:55 | 000,091,554 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.01.14 18:33:19 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\Lightroom 4.3.lnk
[2013.01.13 23:48:52 | 000,000,965 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Download Assistant.lnk
[2013.01.12 07:09:33 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.01.12 07:09:33 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.01.10 03:32:45 | 000,283,440 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013.01.24 14:18:00 | 000,001,985 | ---- | C] () -- C:\Users\Pascal\Desktop\Continue SweetIM installation.lnk
[2013.01.24 14:16:43 | 000,235,696 | ---- | C] () -- C:\Users\Pascal\Desktop\zipper_V.6190383.exe
[2013.01.24 14:12:54 | 000,011,580 | ---- | C] () -- C:\Users\Pascal\Desktop\OTL.7z
[2013.01.14 18:33:19 | 000,002,031 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Lightroom 4.3.lnk
[2013.01.14 18:33:19 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\Lightroom 4.3.lnk
[2013.01.13 23:48:52 | 000,000,977 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Download Assistant.lnk
[2013.01.13 23:48:52 | 000,000,965 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Download Assistant.lnk
[2012.12.01 09:07:00 | 000,015,432 | ---- | C] () -- C:\Windows\Launcher.exe
[2012.04.28 17:56:11 | 000,007,661 | ---- | C] () -- C:\Users\Pascal\AppData\Roaming\.freeciv-client-rc-2.3
[2012.04.15 09:27:24 | 000,000,054 | ---- | C] () -- C:\Windows\winlemm.ini
[2011.11.28 15:17:10 | 000,000,064 | ---- | C] () -- C:\Windows\GPlrLanc.dat
[2011.10.31 08:04:12 | 000,000,143 | ---- | C] () -- C:\Users\Pascal\AppData\Roaming\default.rss
[2011.10.31 08:02:30 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2011.10.29 19:41:19 | 000,000,193 | ---- | C] () -- C:\Users\Pascal\AppData\Roaming\SamsungLiveUpdateConfig.ini
[2011.10.24 21:38:38 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2011.10.24 21:38:38 | 000,110,080 | ---- | C] () -- C:\Windows\System32\advd.dll
[2011.10.24 21:38:38 | 000,023,040 | ---- | C] () -- C:\Windows\System32\auth.dll
[2011.10.24 21:28:21 | 000,000,170 | ---- | C] () -- C:\Windows\wininit.ini
[2011.03.08 13:41:04 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2011.03.08 13:41:04 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2011.03.08 13:41:04 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2011.03.08 13:41:04 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2010.09.17 08:19:26 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe

========== ZeroAccess Check ==========

[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012.04.28 15:54:39 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\.freeciv
[2012.09.10 23:04:02 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\ALDITALKVerbindungsassistent
[2011.01.12 14:10:38 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\AppBooster
[2012.12.15 07:26:07 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\AVG
[2012.12.15 07:11:37 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\AVG2013
[2011.01.02 22:25:37 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\Azureus
[2012.03.11 15:35:59 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\Bytemobile
[2013.01.13 23:49:03 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2011.11.16 08:34:50 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\concept design
[2012.06.30 07:27:19 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\DVDVideoSoft
[2012.06.02 09:21:59 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.02.27 19:19:45 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\eSobi
[2012.09.22 15:12:13 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\Firestorm
[2012.03.30 20:17:45 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\HCM Updater
[2011.09.19 12:47:50 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\IrfanView
[2012.04.21 08:00:39 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\Liteon
[2012.01.26 13:31:35 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\NetSpeedMonitor
[2012.05.05 08:02:56 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\OpenCandy
[2011.01.19 12:15:57 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\OpenOffice.org
[2011.12.19 08:17:49 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\Opera
[2011.09.19 12:31:37 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\Samsung
[2012.09.22 01:28:24 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\SecondLife
[2012.08.02 15:24:24 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\Sony
[2012.06.24 22:16:03 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\Synaptics
[2012.04.14 22:21:17 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\Temp
[2012.12.15 07:06:43 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\TuneUp Software
[2011.09.27 13:57:10 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\Unity
[2012.04.06 13:02:23 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\Vodafone
[2011.04.10 03:59:29 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\Windows Live Writer

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*. >
[2012.12.15 07:05:18 | 000,000,000 | -H-D | M] -- C:\$AVG
[2010.12.29 15:37:24 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2010.11.13 02:42:59 | 000,000,000 | ---D | M] -- C:\book
[2013.01.14 18:34:07 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2012.09.27 15:48:14 | 000,000,000 | ---D | M] -- C:\Crash
[2012.06.03 13:27:39 | 000,000,000 | ---D | M] -- C:\DESKTOP
[2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2010.12.29 15:34:24 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2010.09.17 07:58:43 | 000,000,000 | ---D | M] -- C:\Intel
[2010.12.29 15:37:07 | 000,000,000 | -H-D | M] -- C:\OEM
[2009.07.14 03:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2013.01.24 14:18:01 | 000,000,000 | ---D | M] -- C:\Program Files
[2012.12.15 07:25:09 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2010.12.29 15:34:24 | 000,000,000 | -HSD | M] -- C:\Programme
[2010.12.29 15:34:24 | 000,000,000 | -HSD | M] -- C:\Recovery
[2013.01.20 19:00:33 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.07.01 15:10:29 | 000,000,000 | ---D | M] -- C:\TEMP
[2010.12.29 15:34:36 | 000,000,000 | R--D | M] -- C:\Users
[2013.01.24 13:06:40 | 000,000,000 | ---D | M] -- C:\Windows

< %PROGRAMFILES%\*.exe >

< %LOCALAPPDATA%\*.exe >

< %systemroot%\*. /mp /s >

< C:\Windows\system32\*.tsp >
[2009.07.14 02:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp
[2009.07.14 02:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp
[2009.07.14 02:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp
[2009.07.14 02:14:11 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp
[2010.11.20 13:16:53 | 000,281,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp
[2009.07.14 05:53:46 | 000,032,630 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2009.07.14 05:53:47 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2011.04.10 09:43:46 | 000,001,094 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[2011.04.10 09:43:49 | 000,001,098 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
[2012.04.20 05:08:08 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

< MD5 for: AGP440.SYS >
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

< MD5 for: EXPLORER.EXE >
[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2010.07.14 12:01:28 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2010.02.04 10:56:31 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2010.02.04 10:56:31 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2010.07.14 12:01:28 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

< MD5 for: IASTOR.SYS >
[2010.06.08 18:23:34 | 000,435,736 | ---- | M] (Intel Corporation) MD5=D80AA0907748D7CC8EFAB3773F32629B -- C:\Windows\System32\drivers\iaStor.sys
[2010.06.08 18:23:34 | 000,435,736 | ---- | M] (Intel Corporation) MD5=D80AA0907748D7CC8EFAB3773F32629B -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_20f8d1b2e876a71d\iaStor.sys

< MD5 for: IASTORV.SYS >
[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 06:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011.03.11 06:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 06:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 06:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

< MD5 for: SCECLI.DLL >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll

< MD5 for: USER32.DLL >
[2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll

< MD5 for: USERINIT.EXE >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010.07.14 12:01:28 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2010.07.14 12:01:28 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

< MD5 for: WS2IFSL.SYS >
[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >

< %systemroot%\system32\*.dll /lockedfiles >

< %USERPROFILE%\*.* >
[2013.01.24 14:54:22 | 003,145,728 | -HS- | M] () -- C:\Users\Pascal\NTUSER.DAT
[2013.01.24 14:54:22 | 000,262,144 | -HS- | M] () -- C:\Users\Pascal\ntuser.dat.LOG1
[2010.12.29 15:34:39 | 000,000,000 | -HS- | M] () -- C:\Users\Pascal\ntuser.dat.LOG2
[2010.12.29 18:21:19 | 000,065,536 | -HS- | M] () -- C:\Users\Pascal\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf
[2010.12.29 18:21:19 | 000,524,288 | -HS- | M] () -- C:\Users\Pascal\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
[2010.12.29 18:21:19 | 000,524,288 | -HS- | M] () -- C:\Users\Pascal\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
[2010.12.29 15:34:40 | 000,000,020 | -HS- | M] () -- C:\Users\Pascal\ntuser.ini
[2013.01.24 12:03:45 | 000,054,784 | RHS- | M] (Softspecialists) -- C:\Users\Pascal\wgsdgsdgdsgsd.exe

< %USERPROFILE%\Local Settings\Temp\*.exe >

< %USERPROFILE%\Local Settings\Temp\*.dll >

< %USERPROFILE%\Application Data\*.exe >

< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

========== Alternate Data Streams ==========

@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:93EB7685
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:E36F5B57
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:4D066AD2
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:E3C56885

< End of report >


Ich hoffe, Ihr könnt damit etwas anfangen und mir helfen.

Vielen Dank im voraus schon einmal und ich wünsche euch allen noch einen schönen restlichen Donnerstag!

Beste Grüße,
Pascal.

hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKU\S-1-5-21-2139574245-4269568481-2588610662-1000..\Run: [svñhîst] C:\Users\Pascal\wgsdgsdgdsgsd.exe (Softspecialists)
O33 - MountPoints2\{0383cbd9-6b53-11e1-8f6e-001e101fa1f5}\Shell - "" = AutoRun
O33 - MountPoints2\{0383cbd9-6b53-11e1-8f6e-001e101fa1f5}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{0383cbdf-6b53-11e1-8f6e-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{0383cbdf-6b53-11e1-8f6e-1c750831ec56}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{17ea48a7-7ab6-11e1-87f3-0026c7c00c48}\Shell - "" = AutoRun
O33 - MountPoints2\{17ea48a7-7ab6-11e1-87f3-0026c7c00c48}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{17ea48d0-7ab6-11e1-87f3-0026c7c00c48}\Shell - "" = AutoRun
O33 - MountPoints2\{17ea48d0-7ab6-11e1-87f3-0026c7c00c48}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{17ea48da-7ab6-11e1-87f3-0026c7c00c48}\Shell - "" = AutoRun
O33 - MountPoints2\{17ea48da-7ab6-11e1-87f3-0026c7c00c48}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{17ea48e8-7ab6-11e1-87f3-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{17ea48e8-7ab6-11e1-87f3-1c750831ec56}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{17ea4924-7ab6-11e1-87f3-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{17ea4924-7ab6-11e1-87f3-1c750831ec56}\Shell\AutoRun\command - "" = E:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{17ea493d-7ab6-11e1-87f3-001e101f79c9}\Shell - "" = AutoRun
O33 - MountPoints2\{17ea493d-7ab6-11e1-87f3-001e101f79c9}\Shell\AutoRun\command - "" = E:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{339ee3b9-d844-11e1-a0c3-c9fdf352b271}\Shell - "" = AutoRun
O33 - MountPoints2\{339ee3b9-d844-11e1-a0c3-c9fdf352b271}\Shell\AutoRun\command - "" = G:\Startme.exe
O33 - MountPoints2\{4283b95b-8262-11e1-8e9c-001e101f9843}\Shell - "" = AutoRun
O33 - MountPoints2\{4283b95b-8262-11e1-8e9c-001e101f9843}\Shell\AutoRun\command - "" = E:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{717c7ea7-9a0a-11e1-a1d2-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{717c7ea7-9a0a-11e1-a1d2-1c750831ec56}\Shell\AutoRun\command - "" = G:\Install.exe
O33 - MountPoints2\{b292b25f-a29e-11e1-8f0a-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{b292b25f-a29e-11e1-8f0a-1c750831ec56}\Shell\AutoRun\command - "" = E:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{b4b52000-6843-11e1-86aa-001e101f7f74}\Shell - "" = AutoRun
O33 - MountPoints2\{b4b52000-6843-11e1-86aa-001e101f7f74}\Shell\AutoRun\command - "" = G:\LGAutoRun.exe
O33 - MountPoints2\{b8f2874e-8596-11e1-a25e-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{b8f2874e-8596-11e1-a25e-1c750831ec56}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{b8f2875f-8596-11e1-a25e-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{b8f2875f-8596-11e1-a25e-1c750831ec56}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{bd0a315d-8acd-11e1-a1fa-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{bd0a315d-8acd-11e1-a1fa-1c750831ec56}\Shell\AutoRun\command - "" = E:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{c9500a86-fafb-11e0-a2cf-0026c7c00c48}\Shell - "" = AutoRun
O33 - MountPoints2\{c9500a86-fafb-11e0-a2cf-0026c7c00c48}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{c9500a95-fafb-11e0-a2cf-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{c9500a95-fafb-11e0-a2cf-1c750831ec56}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{d0b0d723-7a9a-11e1-b552-001e101f82a7}\Shell - "" = AutoRun
O33 - MountPoints2\{d0b0d723-7a9a-11e1-b552-001e101f82a7}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{d0b0d759-7a9a-11e1-b552-001e101f82a7}\Shell - "" = AutoRun
O33 - MountPoints2\{d0b0d759-7a9a-11e1-b552-001e101f82a7}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{d0b0d764-7a9a-11e1-b552-001e101f82a7}\Shell - "" = AutoRun
O33 - MountPoints2\{d0b0d764-7a9a-11e1-b552-001e101f82a7}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{d8f041b1-8400-11e1-a067-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{d8f041b1-8400-11e1-a067-1c750831ec56}\Shell\AutoRun\command - "" = E:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{d8f041bd-8400-11e1-a067-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{d8f041bd-8400-11e1-a067-1c750831ec56}\Shell\AutoRun\command - "" = E:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{efdfaf40-7bb5-11e1-ba04-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{efdfaf40-7bb5-11e1-ba04-1c750831ec56}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{efdfb03a-7bb5-11e1-ba04-1c750831ec56}\Shell - "" = AutoRun
O33 - MountPoints2\{efdfb03a-7bb5-11e1-ba04-1c750831ec56}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\Install.exe
 :Files
:Commands
[EMPTYFLASH] 
[emptytemp]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die + E Taste.

• Öffne dein Systemlaufwerk ( meistens C: )
• Suche nun
  folgenden Ordner: _OTL und öffne diesen.
• Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
• 
  Dies wird eine Movedfiles.zip Datei in _OTL erstellen
• Lade diese bitte in unseren Uploadchannel
  hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

Super! Alles wieder in Ordnung. Vielen vielen Dank!
Der Upload hat ebenfalls gut gefunzt!

Also nochmal riesigen Dank für die so schnelle Hilfe!

danke
download tdss killer:
http://www.trojaner-board.de/82358-t...entfernen.html
Klicke auf Change parameters
• Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system
• Klick auf OK und anschließend auf Start scan
- bei funden erst mal immer skip wählen, log posten
c: öffnen, tdsskiller-datum-version.txt öffnen, Inhalt posten

Es gab 3 Funde, nach dem Scan. Weiter bin ich noch nicht. Kannst Du mir (Leihe in solchen Sachen) genauer erklären, wie ich vorzugehen habe?

Danke Dir Markus!

das log posten, wie es in der letzten Zeile steht bitte

Guten Morgen

Unsigned file
Service: FsUsbExDisk
Suspicious object, medium risk

Unsigned file
Sevice: FsUsbExService
Suspicious object, medium risk

Unsigned file
Service: WajamUpdater
Suspicious objekt, medium risk

log komplett posten, danke
nun zum dritten mal.

Markus, mehr ist da nicht, nach dem Scan, nur noch:

Suspicious objects were found

Duration: 00:01:00
Processed: 430 objects, details
Found: 3 threats
Neutralized: 0 threats
Quarantined: 0 objekts

Den "Report" kann ich leider nicht kopieren, zumindest nicht mit rechtsklick.

poste doch bitte das log, wie ichs in der letzten zeile nach der tdss killer anleitung geschrieben hab