Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 29.08.2010, 13:18   #1
Sashinho
 
Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet - Standard

Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet



Wie der Kollege am 16.08. habe ich genau das selbe Problem und hoffe das es sich ganuso lösen lässt. HijackThis, CCCleaner, Combofix etc. alles ist vorbereitet. Was als errstes ? HJT Logfile ? Sobald er ans Internet geht direkt alles geblockt und automatischer Neustart. Gestern noch Antimalware Doctor, den habe ich wegbekommen. Trotzdem noch AV Security Suite etc...

Vielen Dank schon mal....

Greetz Sashinho

OTL LOGFILEOTL Logfile:
Code:
ATTFilter
OTL logfile created on: 29.08.2010 13:04:02 - Run 1
OTL by OldTimer - Version 3.2.11.0     Folder = C:\Users\Sashinho\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 56,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 298,09 Gb Total Space | 54,49 Gb Free Space | 18,28% Space Free | Partition Type: NTFS
Drive D: | 298,09 Gb Total Space | 28,34 Gb Free Space | 9,51% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 981,05 Mb Total Space | 844,29 Mb Free Space | 86,06% Space Free | Partition Type: FAT32
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: SASHINHO-PC
Current User Name: Sashinho
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Sashinho\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\svc2.exe ()
PRC - C:\Programme\Common Files\Steam\SteamService.exe (Valve Corporation)
PRC - D:\Gamez\Steam\steam.exe (Valve Corporation)
PRC - C:\Programme\Tunngle\TnglCtrl.exe (Tunngle.net GmbH)
PRC - C:\Programme\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Programme\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
PRC - C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
PRC - C:\Programme\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Programme\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Programme\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Acer\Acer PowerSmart Manager\ePowerTray.exe (Acer Incorporated)
PRC - C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe (Acer Incorporated)
PRC - C:\Programme\Acer\Acer PowerSmart Manager\ePowerEvent.exe (Acer Incorporated)
PRC - C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)
PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
PRC - C:\Programme\Acer Bio Protection\BASVC.exe (Egis Technology Inc.)
PRC - C:\Programme\Acer Bio Protection\PdtWzd.exe (Egis Technology Inc.)
PRC - C:\Programme\Acer Bio Protection\CompPtcVUI.exe (Egis Technology Inc.)
PRC - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation)
PRC - C:\Programme\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
PRC - C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Programme\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
PRC - C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
PRC - C:\Programme\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
PRC - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Programme\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Programme\EgisTec Egis Software Update\EgisUpdate.exe (EgisTec Inc.)
PRC - C:\Programme\EgisTec\MyWinLocker 3\x86\MWLService.exe (EgisTec Inc.)
PRC - C:\Programme\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (EgisTec Inc.)
PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
PRC - C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
PRC - C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
PRC - C:\Programme\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Windows\PLFSetI.exe ()
PRC - C:\Programme\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Programme\Brother\ControlCenter3\BrccMCtl.exe (Brother Industries, Ltd.)
PRC - C:\Programme\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
PRC - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
PRC - C:\Windows\System32\spool\drivers\w32x86\3\E_FATIBIE.EXE (SEIKO EPSON CORPORATION)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Sashinho\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Programme\Acer\Acer PowerSmart Manager\SysHook.dll (Acer Incorporated)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (Akamai) -- c:\Programme\Common Files\Akamai\rswin_3745.dll ()
SRV - (TunngleService) -- C:\Programme\Tunngle\TnglCtrl.exe (Tunngle.net GmbH)
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (McComponentHostService) -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (TuneUp.Defrag) -- C:\Windows\System32\TuneUpDefragService.exe (TuneUp Software GmbH)
SRV - (GoogleDesktopManager-110309-193829) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (NTI IScheduleSvc) -- C:\Programme\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (ePowerSvc) -- C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe (Acer Incorporated)
SRV - (CLHNService) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
SRV - (IGBASVC) -- C:\Programme\Acer Bio Protection\BASVC.exe (Egis Technology Inc.)
SRV - (btwdins) -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV - (wlidsvc) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (RS_Service) -- C:\Programme\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (MWLService) -- C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe ()
SRV - (EvtEng) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV - (RegSrvc) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV - (NTISchedulerSvc) -- C:\Programme\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (NewTech Infosystems, Inc.)
SRV - (NTIBackupSvc) -- C:\Programme\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (StarWindServiceAE) -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (GarenaPEngine) -- C:\Users\Sashinho\AppData\Local\Temp\YDLFAEB.tmp File not found
DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (ElbyCDIO) -- C:\Windows\System32\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (AnyDVD) -- C:\Windows\System32\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - (tap0901t) TAP-Win32 Adapter V9 (Tunngle) -- C:\Windows\System32\drivers\tap0901t.sys (Tunngle.net)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (FPSensor) EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys) -- C:\Windows\System32\drivers\FPSensor.sys (Egistec)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (VClone) -- C:\Windows\System32\drivers\VClone.sys (Elaborate Bytes AG)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (JMCR) -- C:\Windows\System32\drivers\jmcr.sys (JMicron Technology Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (NTIDrvr) -- C:\Windows\System32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (UBHelper) -- C:\Windows\System32\drivers\UBHelper.sys (NewTech Infosystems Corporation)
DRV - (btwavdt) -- C:\Windows\System32\drivers\btwavdt.sys (Broadcom Corporation.)
DRV - (btwaudio) -- C:\Windows\System32\drivers\btwaudio.sys (Broadcom Corporation.)
DRV - (btusbflt) -- C:\Windows\System32\drivers\btusbflt.sys (Broadcom Corporation.)
DRV - (btwl2cap) -- C:\Windows\System32\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV - (btwrchid) -- C:\Windows\System32\drivers\btwrchid.sys (Broadcom Corporation.)
DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- C:\Programme\Acer Arcade Deluxe\PlayMovie\000.fcl (CyberLink Corp.)
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics Incorporated)
DRV - (RTHDMIAzAudService) -- C:\Windows\System32\drivers\RtHDMIV.sys (Realtek Semiconductor Corp.)
DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (mwlPSDVDisk) -- C:\Windows\System32\drivers\mwlPSDVDisk.sys (Egis Incorporated.)
DRV - (mwlPSDFilter) -- C:\Windows\System32\drivers\mwlPSDFilter.sys (Egis Incorporated.)
DRV - (mwlPSDNServ) -- C:\Windows\System32\drivers\mwlPSDNserv.sys (Egis Incorporated.)
DRV - (k57nd60x) Broadcom NetLink (TM) -- C:\Windows\System32\drivers\k57nd60x.sys (Broadcom Corporation)
DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (AlfaFF) -- C:\Windows\system32\drivers\AlfaFF.sys (Alfa Corporation)
DRV - (Ltn_stk7770P) -- C:\Windows\System32\drivers\Ltn_stk7770P.sys (LITEON)
DRV - (int15) -- C:\Windows\System32\drivers\int15.sys ()
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (winbondcir) -- C:\Windows\System32\drivers\winbondcir.sys (Winbond Electronics Corporation)
DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (BrSerIf) -- C:\Windows\System32\drivers\BrSerIf.sys (Brother Industries Ltd.)
DRV - (DKbFltr) -- C:\Windows\System32\drivers\DKbFltr.sys (Dritek System Inc.)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\agrsm.sys (Agere Systems)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (BrUsbSer) -- C:\Windows\System32\drivers\BrUsbSer.sys (Brother Industries Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0909&m=1zy9bbr0tn5
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0909&m=1zy9bbr0tn5
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0909&m=1zy9bbr0tn5
IE - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]
IE - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.07.30 12:07:13 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.08.07 22:21:56 | 000,000,000 | ---D | M]
 
[2009.12.10 13:11:37 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\mozilla\Extensions
[2010.08.29 11:45:37 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\mozilla\Firefox\Profiles\cn2dlidy.default\extensions
[2010.07.01 14:03:36 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Sashinho\AppData\Roaming\mozilla\Firefox\Profiles\cn2dlidy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.04.16 13:40:10 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\mozilla\Firefox\Profiles\cn2dlidy.default\extensions\youtube2mp3@mondayx.de
[2010.08.07 21:04:08 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.07.30 12:07:10 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.07.30 12:07:10 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.07.30 12:07:10 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.07.30 12:07:10 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.07.30 12:07:10 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe (Acer Incorporated)
O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe (EgisTec Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [ Malwarebytes Anti-Malware  (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mwlDaemon] C:\Programme\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (EgisTec Inc.)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [PPort11reminder] C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [VirtualCloneDrive] C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O4 - HKLM..\Run: [VitaKeyPdtWzd] C:\Program Files\Acer Bio Protection\PdtWzd.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)
O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [borobororb.exe] C:\borobororb.exe\borobororb.exe ()
O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [cfxadpei] C:\Users\Sashinho\AppData\Local\nujxtecya\vsyghrvshdw.exe ()
O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [EPSON Stylus DX6000 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE (SEIKO EPSON CORPORATION)
O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [NetLog2] C:\Windows\svc2.exe ()
O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [ProductReg] C:\Programme\Acer\WR_PopUp\ProductReg.exe (Acer)
O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [Steam] D:\Gamez\Steam\Steam.exe (Valve Corporation)
O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Programme\Acer Bio Protection\PwdBank.exe (Egis Technology Inc.)
O9 - Extra 'Tools' menuitem : Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Programme\Acer Bio Protection\PwdBank.exe (Egis Technology Inc.)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Acer\Acer VCM\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Sashinho\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Sashinho\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{9176068f-0a6d-11df-832d-00059a3c7800}\Shell - "" = AutoRun
O33 - MountPoints2\{9176068f-0a6d-11df-832d-00059a3c7800}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found
O33 - MountPoints2\{c3910696-e56b-11de-bf5a-00269e390614}\Shell - "" = AutoRun
O33 - MountPoints2\{c3910696-e56b-11de-bf5a-00269e390614}\Shell\AutoRun\command - "" = F:\SetupLauncher.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software GmbH)
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (hxxp://www.mp3dev.org/)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.29 13:02:12 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\Sashinho\Desktop\OTL.exe
[2010.08.28 23:49:21 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\nujxtecya
[2010.08.28 23:48:56 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\Windows
[2010.08.28 23:48:54 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\Windows Server
[2010.08.28 23:48:48 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Roaming\8449B8C6538A9C2D177E52971C84C46B
[2010.08.28 23:44:04 | 000,000,000 | ---D | C] -- C:\Programme\NVIDIA Corporation
[2010.08.28 23:31:17 | 000,000,000 | ---D | C] -- C:\Programme\DAEMON Tools Lite
[2010.08.28 23:27:06 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\2K Games
[2010.08.28 18:21:30 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Desktop\Diktus 2010 5
[2010.08.26 13:46:26 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Desktop\Phx_data
[2010.08.25 19:08:22 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\76561197961688521
[2010.08.25 10:47:25 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Steam
[2010.08.24 13:14:52 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\119614890734724340
[2010.08.24 13:14:41 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\119611678099186932
[2010.08.24 11:59:22 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Documents\Tunngle
[2010.08.24 11:59:22 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Roaming\Tunngle
[2010.08.24 11:59:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Tunngle
[2010.08.24 11:59:11 | 000,027,136 | ---- | C] (Tunngle.net) -- C:\Windows\System32\drivers\tap0901t.sys
[2010.08.24 11:59:10 | 000,000,000 | ---D | C] -- C:\Programme\Tunngle
[2010.08.24 11:42:34 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Documents\Square Enix
[2010.08.24 11:42:21 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\119614890733675764
[2010.08.24 11:42:10 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\119611678098138356
[2010.08.24 11:41:05 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Documents\Alcohol 120%
[2010.08.24 11:36:11 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Adobe AIR
[2010.08.22 20:01:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2010.08.22 19:16:06 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\Electronic_Arts_Inc
[2010.08.17 17:13:23 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Documents\StarCraft II
[2010.08.17 17:13:23 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Blizzard Entertainment
[2010.08.17 17:13:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment
[2010.08.17 12:24:32 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\id Software
[2010.08.11 20:38:21 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Desktop\DSI
[2010.08.07 23:01:35 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\Microsoft Games
[2010.08.07 21:13:40 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Roaming\DivX
[2010.08.07 21:13:23 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\PX Storage Engine
[2010.08.07 21:13:08 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\DivX Shared
[2010.08.07 21:11:29 | 000,000,000 | ---D | C] -- C:\Programme\DivX
[2010.08.07 21:09:58 | 000,000,000 | ---D | C] -- C:\ProgramData\DivX
[2010.08.05 20:09:55 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Documents\Singularity
[2010.08.05 20:07:41 | 000,000,000 | ---D | C] -- C:\Windows\E10DB5DAE57640EAA7FC1CB2A7B283A6.TMP
[2010.08.04 11:58:27 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Roaming\bizarre creations
[2010.08.03 21:09:21 | 001,228,416 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Sashinho\Desktop\MasterCollection_CS5_LS4.exe
[2010.08.03 21:09:07 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Akamai
[2010.07.31 11:21:36 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Documents\Command and Conquer 4
[2010.07.31 11:20:49 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Roaming\Command and Conquer 4
[2010.07.31 10:33:20 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\Cadenza
[2010.07.31 10:32:54 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft XNA
[2010.07.30 19:43:06 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\Activision
[2010.07.30 19:16:18 | 000,000,000 | ---D | C] -- C:\Programme\Elaborate Bytes
[2010.07.30 19:10:34 | 000,000,000 | ---D | C] -- C:\Programme\Alcohol Soft
[2010.07.30 19:10:18 | 000,000,000 | ---D | C] -- C:\Programme\Franzis
[2010.07.30 14:34:51 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Roaming\InstallShield Installation Information
[2010.07.30 14:34:38 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_39.dll
[2010.07.30 14:34:38 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_39.dll
[2010.07.30 14:34:36 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_39.dll
[2010.07.30 14:34:30 | 000,000,000 | ---D | C] -- C:\Windows\D56B0E274A3E46C9B5C1D93D580C099C.TMP
[2010.07.30 14:17:25 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Documents\Flock
[2009.04.04 01:32:18 | 000,049,152 | ---- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll
[6 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[6 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.29 13:05:23 | 000,783,360 | ---- | M] () -- C:\Windows\System32\drivers\hzicoziy.sys
[2010.08.29 13:03:51 | 002,883,584 | -HS- | M] () -- C:\Users\Sashinho\NTUSER.DAT
[2010.08.29 12:52:06 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Sashinho\Desktop\OTL.exe
[2010.08.29 12:46:17 | 000,232,406 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010.08.29 12:46:04 | 000,232,406 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010.08.29 12:46:03 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.08.29 12:46:00 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.08.29 12:46:00 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.08.29 12:45:58 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.08.29 12:45:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.08.29 12:45:52 | 3209,240,576 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.29 12:45:07 | 000,524,288 | -HS- | M] () -- C:\Users\Sashinho\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010.08.29 12:45:07 | 000,065,536 | -HS- | M] () -- C:\Users\Sashinho\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.08.29 12:37:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.08.29 12:22:03 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010.08.29 12:22:03 | 000,000,000 | ---- | M] () -- C:\Windows\System32\Access.dat
[2010.08.29 11:25:09 | 002,990,566 | -H-- | M] () -- C:\Users\Sashinho\AppData\Local\IconCache.db
[2010.08.29 09:56:59 | 226,463,978 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010.08.29 09:52:00 | 000,000,910 | ---- | M] () -- C:\Users\Sashinho\Desktop\mbam - Verknüpfung.lnk
[2010.08.29 05:08:30 | 001,418,806 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.08.29 05:08:30 | 000,618,442 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.08.29 05:08:30 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.08.29 05:08:30 | 000,122,842 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.08.29 05:08:30 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.08.28 23:49:17 | 000,212,347 | ---- | M] () -- C:\Windows\svc2.exe
[2010.08.28 23:49:06 | 000,030,000 | ---- | M] () -- C:\Windows\System32\e882l9zh.dll
[2010.08.28 23:48:57 | 000,030,000 | ---- | M] () -- C:\Windows\System32\l2nmqs7t.dll
[2010.08.28 23:48:57 | 000,030,000 | ---- | M] () -- C:\Windows\System32\dyun6g.dll
[2010.08.28 23:48:55 | 000,030,000 | ---- | M] () -- C:\Windows\System32\tmoaufm.dll
[2010.08.28 01:06:48 | 000,000,396 | ---- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job
[2010.08.27 19:17:49 | 000,008,484 | ---- | M] () -- C:\Users\Sashinho\AppData\Local\d3d9caps.dat
[2010.08.27 01:57:49 | 000,104,056 | ---- | M] () -- C:\Users\Sashinho\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.08.27 01:57:32 | 000,382,928 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.08.26 14:00:16 | 000,000,535 | ---- | M] () -- C:\Users\Sashinho\Desktop\Phx_settings.ini
[2010.08.25 14:21:41 | 000,107,520 | ---- | M] () -- C:\Users\Sashinho\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.08.25 12:10:42 | 000,000,584 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk
[2010.08.25 10:47:05 | 000,109,080 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\Windows\System32\OpenAL32.dll
[2010.08.24 11:59:12 | 000,000,742 | ---- | M] () -- C:\Users\Public\Desktop\Tunngle beta.lnk
[2010.08.24 11:23:32 | 000,800,768 | ---- | M] () -- C:\Users\Sashinho\Desktop\Hausarbeit Fitnessmarkt Sascha Mendner 415730.doc
[2010.08.24 11:13:52 | 000,000,788 | ---- | M] () -- C:\Users\Sashinho\Desktop\Kane & Lynch 2.lnk
[2010.08.24 10:41:34 | 000,145,168 | ---- | M] () -- C:\Users\Sashinho\Desktop\Hausarbeit Fitnessmarkt Sascha Mendner 415730.docx
[2010.08.23 14:39:42 | 000,024,433 | ---- | M] () -- C:\Users\Sashinho\Desktop\1.gif
[2010.08.23 14:39:21 | 000,007,848 | ---- | M] () -- C:\Users\Sashinho\Desktop\porter`s 5 forces.gif
[2010.08.22 19:09:22 | 000,000,719 | ---- | M] () -- C:\Users\Sashinho\Desktop\CNC4.lnk
[2010.08.18 10:04:28 | 000,000,162 | -H-- | M] () -- C:\Users\Sashinho\Desktop\~$usarbeit Fitnessmarkt Sascha Mendner 415730.docx
[2010.08.17 11:51:23 | 000,049,800 | ---- | M] () -- C:\Users\Sashinho\Desktop\hausprospekt_2007_shelby.pdf
[2010.08.16 12:04:10 | 000,069,362 | ---- | M] () -- C:\Users\Sashinho\Desktop\Nischenmanagement Teil 2.pdf
[2010.08.16 10:35:31 | 000,000,733 | ---- | M] () -- C:\Users\Sashinho\Desktop\Wolfenstein.lnk
[2010.08.12 21:17:47 | 000,630,572 | ---- | M] () -- C:\Users\Sashinho\Desktop\Erfolgsfaktoren_von_Fitnessstudios_Basisreport.pdf
[2010.08.12 16:18:18 | 000,009,425 | ---- | M] () -- C:\Users\Sashinho\Documents\saruschka0810.nra
[2010.08.06 12:03:57 | 001,331,999 | ---- | M] () -- C:\Users\Sashinho\Desktop\DE_CBT_NL_Fit_1_2010_D.pdf
[2010.08.06 10:46:08 | 000,254,946 | ---- | M] () -- C:\Users\Sashinho\Desktop\SparkStudie_FitnessBranche.pdf
[2010.08.06 10:45:45 | 001,499,713 | ---- | M] () -- C:\Users\Sashinho\Desktop\BR_707_07_Fitnesscenter.pdf
[2010.08.04 21:06:42 | 4096,798,902 | ---- | M] () -- C:\Users\Sashinho\Desktop\MasterCollection_CS5_LS4.7z
[2010.08.04 19:12:12 | 000,138,464 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2010.08.04 19:09:55 | 001,228,416 | ---- | M] (Adobe Systems Incorporated) -- C:\Users\Sashinho\Desktop\MasterCollection_CS5_LS4.exe
[2010.08.01 12:34:17 | 000,000,681 | ---- | M] () -- C:\Users\Sashinho\Desktop\AssassinsCreedIIGame.exe.lnk
[2010.07.31 17:57:35 | 000,000,442 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2010.07.31 17:11:20 | 000,001,800 | ---- | M] () -- C:\WirelessDiagLog.csv
[2010.07.30 21:33:25 | 000,000,619 | ---- | M] () -- C:\Users\Sashinho\Desktop\Sol Survivor.lnk
[2010.07.30 19:43:03 | 000,000,677 | ---- | M] () -- C:\Users\Sashinho\Desktop\Call Of Duty - World At War.lnk
[2010.07.30 18:28:42 | 000,000,776 | ---- | M] () -- C:\Users\Sashinho\Desktop\AlienBreed-Impact.exe.lnk
[2010.07.30 14:55:53 | 000,001,906 | ---- | M] () -- C:\Users\Public\Desktop\FLOCK!.lnk
[6 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[6 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.08.29 11:57:20 | 3209,240,576 | -HS- | C] () -- C:\hiberfil.sys
[2010.08.29 09:52:00 | 000,000,910 | ---- | C] () -- C:\Users\Sashinho\Desktop\mbam - Verknüpfung.lnk
[2010.08.28 23:49:45 | 000,783,360 | ---- | C] () -- C:\Windows\System32\drivers\hzicoziy.sys
[2010.08.28 23:49:21 | 000,212,347 | ---- | C] () -- C:\Windows\svc2.exe
[2010.08.28 23:49:06 | 000,030,000 | ---- | C] () -- C:\Windows\System32\e882l9zh.dll
[2010.08.28 23:48:57 | 000,030,000 | ---- | C] () -- C:\Windows\System32\l2nmqs7t.dll
[2010.08.28 23:48:57 | 000,030,000 | ---- | C] () -- C:\Windows\System32\dyun6g.dll
[2010.08.28 23:48:55 | 000,030,000 | ---- | C] () -- C:\Windows\System32\tmoaufm.dll
[2010.08.26 13:46:26 | 000,000,535 | ---- | C] () -- C:\Users\Sashinho\Desktop\Phx_settings.ini
[2010.08.26 13:41:15 | 008,578,951 | ---- | C] ($t@t!c_V()!D) -- C:\Users\Sashinho\Desktop\Phoenix.exe
[2010.08.25 10:47:25 | 000,000,584 | ---- | C] () -- C:\Users\Public\Desktop\Steam.lnk
[2010.08.24 12:35:08 | 000,000,000 | ---- | C] () -- C:\Windows\System32\Access.dat
[2010.08.24 11:59:12 | 000,000,742 | ---- | C] () -- C:\Users\Public\Desktop\Tunngle beta.lnk
[2010.08.24 11:13:19 | 000,000,788 | ---- | C] () -- C:\Users\Sashinho\Desktop\Kane & Lynch 2.lnk
[2010.08.23 14:39:42 | 000,024,433 | ---- | C] () -- C:\Users\Sashinho\Desktop\1.gif
[2010.08.23 14:39:20 | 000,007,848 | ---- | C] () -- C:\Users\Sashinho\Desktop\porter`s 5 forces.gif
[2010.08.22 19:09:08 | 000,000,719 | ---- | C] () -- C:\Users\Sashinho\Desktop\CNC4.lnk
[2010.08.18 10:04:28 | 000,000,162 | -H-- | C] () -- C:\Users\Sashinho\Desktop\~$usarbeit Fitnessmarkt Sascha Mendner 415730.docx
[2010.08.17 12:41:58 | 000,800,768 | ---- | C] () -- C:\Users\Sashinho\Desktop\Hausarbeit Fitnessmarkt Sascha Mendner 415730.doc
[2010.08.17 11:51:23 | 000,049,800 | ---- | C] () -- C:\Users\Sashinho\Desktop\hausprospekt_2007_shelby.pdf
[2010.08.16 12:04:10 | 000,069,362 | ---- | C] () -- C:\Users\Sashinho\Desktop\Nischenmanagement Teil 2.pdf
[2010.08.16 10:35:31 | 000,000,733 | ---- | C] () -- C:\Users\Sashinho\Desktop\Wolfenstein.lnk
[2010.08.12 22:12:24 | 006,486,315 | ---- | C] () -- C:\Users\Sashinho\Desktop\HandbookStrategicManagement.pdf
[2010.08.12 21:17:47 | 000,630,572 | ---- | C] () -- C:\Users\Sashinho\Desktop\Erfolgsfaktoren_von_Fitnessstudios_Basisreport.pdf
[2010.08.12 16:18:18 | 000,009,425 | ---- | C] () -- C:\Users\Sashinho\Documents\saruschka0810.nra
[2010.08.09 16:52:32 | 000,145,168 | ---- | C] () -- C:\Users\Sashinho\Desktop\Hausarbeit Fitnessmarkt Sascha Mendner 415730.docx
[2010.08.06 12:03:57 | 001,331,999 | ---- | C] () -- C:\Users\Sashinho\Desktop\DE_CBT_NL_Fit_1_2010_D.pdf
[2010.08.06 10:46:08 | 000,254,946 | ---- | C] () -- C:\Users\Sashinho\Desktop\SparkStudie_FitnessBranche.pdf
[2010.08.06 10:45:45 | 001,499,713 | ---- | C] () -- C:\Users\Sashinho\Desktop\BR_707_07_Fitnesscenter.pdf
[2010.08.03 21:09:21 | 4096,798,902 | ---- | C] () -- C:\Users\Sashinho\Desktop\MasterCollection_CS5_LS4.7z
[2010.08.01 12:34:01 | 000,000,681 | ---- | C] () -- C:\Users\Sashinho\Desktop\AssassinsCreedIIGame.exe.lnk
[2010.07.31 17:03:38 | 000,001,800 | ---- | C] () -- C:\WirelessDiagLog.csv
[2010.07.30 21:33:07 | 000,000,619 | ---- | C] () -- C:\Users\Sashinho\Desktop\Sol Survivor.lnk
[2010.07.30 19:42:36 | 000,000,677 | ---- | C] () -- C:\Users\Sashinho\Desktop\Call Of Duty - World At War.lnk
[2010.07.30 18:28:09 | 000,000,776 | ---- | C] () -- C:\Users\Sashinho\Desktop\AlienBreed-Impact.exe.lnk
[2010.07.30 14:55:53 | 000,001,906 | ---- | C] () -- C:\Users\Public\Desktop\FLOCK!.lnk
[2010.03.29 20:15:47 | 000,232,406 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010.03.29 20:15:37 | 000,232,406 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010.03.16 15:17:08 | 000,010,298 | -HS- | C] () -- C:\Users\Sashinho\AppData\Local\nSVDb4q65iE
[2010.02.26 12:21:29 | 000,000,416 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010.02.26 12:20:34 | 000,000,212 | ---- | C] () -- C:\Windows\Brpfx04a.ini
[2010.02.26 12:20:34 | 000,000,093 | ---- | C] () -- C:\Windows\brpcfx.ini
[2010.02.26 12:18:47 | 000,000,114 | ---- | C] () -- C:\Windows\System32\BRLMW03A.INI
[2010.02.26 12:18:25 | 000,000,066 | ---- | C] () -- C:\Windows\Brfaxrx.ini
[2010.02.26 12:18:24 | 000,106,496 | ---- | C] () -- C:\Windows\System32\BrMuSNMP.dll
[2010.02.26 12:17:26 | 000,031,664 | ---- | C] () -- C:\Windows\maxlink.ini
[2010.02.07 21:24:29 | 000,000,809 | ---- | C] () -- C:\Windows\NTIWVEDT.INI
[2010.01.23 00:12:07 | 000,000,146 | ---- | C] () -- C:\Users\Sashinho\AppData\Roaming\default.pls
[2010.01.23 00:11:03 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2009.12.26 03:29:31 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2009.12.26 03:29:31 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2009.12.26 03:29:29 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2009.12.26 03:29:29 | 000,881,664 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2009.12.26 03:29:29 | 000,205,824 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2009.12.26 03:29:28 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009.12.26 03:29:28 | 000,000,547 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll.manifest
[2009.12.25 13:57:39 | 000,000,002 | ---- | C] () -- C:\Users\Sashinho\AppData\Roaming\ceville_console_history.txt
[2009.12.24 11:29:01 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009.12.24 10:15:54 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.12.10 14:44:31 | 000,008,484 | ---- | C] () -- C:\Users\Sashinho\AppData\Local\d3d9caps.dat
[2009.12.10 13:59:38 | 000,138,464 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009.12.10 13:59:38 | 000,138,056 | ---- | C] () -- C:\Users\Sashinho\AppData\Roaming\PnkBstrK.sys
[2009.12.10 11:08:50 | 000,691,696 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
[2009.12.10 11:00:01 | 000,107,520 | ---- | C] () -- C:\Users\Sashinho\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.11.06 11:58:04 | 000,178,975 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2009.09.14 20:31:50 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2009.09.14 20:31:50 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2009.09.14 18:13:54 | 000,007,260 | ---- | C] () -- C:\ProgramData\ArcadeDeluxe2.log
[2009.09.14 18:07:12 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll
[2009.09.14 18:07:12 | 000,000,036 | ---- | C] () -- C:\Windows\PidList.ini
[2009.01.13 12:29:00 | 000,197,408 | ---- | C] () -- C:\Windows\System32\vpnapi.dll
[2008.09.11 14:01:00 | 000,081,920 | ---- | C] () -- C:\Windows\System32\INT15.dll
[2008.09.09 11:38:48 | 000,097,792 | ---- | C] () -- C:\Windows\System32\INT15_64.dll
[2008.09.09 11:38:48 | 000,015,656 | ---- | C] () -- C:\Windows\System32\drivers\int15_64.sys
[2008.05.21 20:46:08 | 000,118,784 | ---- | C] () -- C:\Windows\System32\VMC3KAPI.dll
[2008.03.12 13:52:34 | 000,069,632 | ---- | C] () -- C:\Windows\System32\drivers\int15.sys
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2004.01.26 18:15:29 | 000,233,472 | R--- | C] () -- C:\Users\Sashinho\AppData\Roaming\MafiaSetup.exe
 
========== LOP Check ==========
 
[2009.04.03 18:00:02 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\Acer GameZone Console
[2009.04.03 18:00:02 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\Acer GameZone Console
[2009.04.03 18:00:02 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\Acer GameZone Console
[2010.01.06 14:29:35 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\cmw
[2010.01.06 12:28:40 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\PowerCinema
[2010.08.29 02:56:13 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\8449B8C6538A9C2D177E52971C84C46B
[2010.01.21 15:06:27 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Acer
[2009.04.03 18:00:02 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Acer GameZone Console
[2009.12.25 14:42:46 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Ankh
[2009.12.25 15:02:42 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Ankh - Heart of Osiris
[2010.02.02 15:10:22 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Any Video Converter
[2010.03.29 02:41:26 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Bioshock2
[2010.08.04 11:58:27 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\bizarre creations
[2010.03.15 18:37:04 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Braid
[2010.07.31 11:49:15 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Command and Conquer 4
[2009.12.14 11:47:34 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\DAEMON Tools Lite
[2010.06.21 14:25:03 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\DiskAid
[2010.02.04 14:11:42 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Leadertech
[2010.08.16 10:36:37 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\MudTV
[2009.12.24 20:00:38 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\PowerCinema
[2009.12.24 19:55:42 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\SoftDMA
[2010.06.20 18:52:34 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Summer Athletics 2008
[2009.12.28 21:11:09 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\TuneUp Software
[2010.08.25 14:23:24 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Tunngle
[2010.03.16 15:05:51 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Ubisoft
[2010.06.21 07:35:28 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\VOWSoft
[2010.08.28 01:06:48 | 000,000,396 | ---- | M] () -- C:\Windows\Tasks\1-Klick-Wartung.job
[2010.08.29 12:22:03 | 000,032,544 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.08.29 02:56:13 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\8449B8C6538A9C2D177E52971C84C46B
[2010.01.21 15:06:27 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Acer
[2009.04.03 18:00:02 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Acer GameZone Console
[2010.08.24 11:36:54 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Adobe
[2009.12.25 14:42:46 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Ankh
[2009.12.25 15:02:42 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Ankh - Heart of Osiris
[2010.02.02 15:10:22 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Any Video Converter
[2009.12.27 01:28:52 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Apple Computer
[2010.03.29 02:41:26 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Bioshock2
[2010.08.04 11:58:27 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\bizarre creations
[2010.03.15 18:37:04 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Braid
[2010.07.31 11:49:15 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Command and Conquer 4
[2009.12.24 19:55:41 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\CyberLink
[2009.12.14 11:47:34 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\DAEMON Tools Lite
[2010.06.21 14:25:03 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\DiskAid
[2010.08.07 21:19:03 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\DivX
[2010.07.07 09:39:15 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\dvdcss
[2009.12.10 11:06:48 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Google
[2009.12.09 17:08:29 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Identities
[2010.07.30 14:34:51 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\InstallShield Installation Information
[2010.04.01 23:41:15 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Intel
[2010.02.04 14:11:42 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Leadertech
[2009.12.09 17:08:54 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Macromedia
[2010.03.16 15:40:33 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Malwarebytes
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Media Center Programs
[2009.12.30 17:01:36 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Media Player Classic
[2010.07.31 17:03:52 | 000,000,000 | --SD | M] -- C:\Users\Sashinho\AppData\Roaming\Microsoft
[2010.01.22 02:09:05 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Microsoft Games
[2009.12.10 13:11:37 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Mozilla
[2010.08.16 10:36:37 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\MudTV
[2010.01.20 22:37:08 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Nero
[2009.12.24 20:00:38 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\PowerCinema
[2009.12.10 14:39:35 | 000,000,000 | RH-D | M] -- C:\Users\Sashinho\AppData\Roaming\SecuROM
[2009.12.24 19:55:42 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\SoftDMA
[2010.06.20 18:52:34 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Summer Athletics 2008
[2009.12.28 21:11:09 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\TuneUp Software
[2010.08.25 14:23:24 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Tunngle
[2010.03.16 15:05:51 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Ubisoft
[2010.08.17 22:42:33 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\vlc
[2010.06.21 07:35:28 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\VOWSoft
[2009.12.10 13:35:46 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2004.01.26 18:15:29 | 000,233,472 | R--- | M] () -- C:\Users\Sashinho\AppData\Roaming\MafiaSetup.exe
[2010.07.30 14:30:48 | 000,331,776 | ---- | M] (Epic Games             ) -- C:\Users\Sashinho\AppData\Roaming\InstallShield Installation Information\{6530FDAA-5B1F-4830-95BB-650E9804D239}\setup.exe
[2010.08.24 11:37:39 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Sashinho\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2010.02.26 12:17:53 | 000,010,134 | R--- | M] () -- C:\Users\Sashinho\AppData\Roaming\Microsoft\Installer\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}\ARPPRODUCTICON.exe
 
< %SYSTEMDRIVE%\*.exe >
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.11.06 15:00:11 | 000,019,720 | ---- | M] (Microsoft Corporation) MD5=23B446FC5141012161DF4C550275BCD4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_6be1d3ca\atapi.sys
[2008.11.06 15:00:11 | 000,019,720 | ---- | M] (Microsoft Corporation) MD5=23B446FC5141012161DF4C550275BCD4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22303_none_ddc4c98f3aa4b4b9\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2009.06.04 18:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009.02.11 17:11:50 | 000,329,752 | ---- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_ea118ff5\iaStor.sys
[2009.06.04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2009.06.04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\drivers\iaStor.sys
[2009.06.04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_0813ee45\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.21 04:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010.08.29 13:18:49 | 000,783,360 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\hzicoziy.sys
[2009.12.10 11:08:50 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\sptd.sys
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.04.11 08:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2009.04.11 08:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
[6 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:4F636E25
< End of report >
         
--- --- ---


Combofix Logfile:
Code:
ATTFilter
ComboFix 10-08-28.02 - Sashinho 29.08.2010  13:59:05.1.8 - x86
ausgeführt von:: c:\users\Sashinho\Desktop\ComboFix.exe
.
 
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
 
C:\borobororb.exe
c:\borobororb.exe\borobororb.exe
c:\borobororb.exe\config.bin
C:\DFR9D76.tmp
c:\users\Sashinho\AppData\Local\nujxtecya
c:\users\Sashinho\AppData\Local\nujxtecya\vsyghrvshdw.exe
c:\users\Sashinho\AppData\Local\Windows Server
c:\users\Sashinho\AppData\Local\Windows Server\admin.txt
c:\users\Sashinho\AppData\Local\Windows Server\flags.ini
c:\users\Sashinho\AppData\Local\Windows Server\hlp.dat
c:\users\Sashinho\AppData\Local\Windows Server\server.dat
c:\users\Sashinho\AppData\Local\Windows Server\uses32.dat
c:\users\Sashinho\AppData\Roaming\8449B8C6538A9C2D177E52971C84C46B
c:\users\Sashinho\AppData\Roaming\8449B8C6538A9C2D177E52971C84C46B\enemies-names.txt
c:\users\Sashinho\AppData\Roaming\8449B8C6538A9C2D177E52971C84C46B\local.ini
c:\users\Sashinho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor
c:\users\Sashinho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor\Antimalware Doctor.lnk
c:\users\Sashinho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor\Uninstall.lnk
c:\users\Sashinho\AppData\Roaming\Microsoft\Windows\Templates\memory.tmp
c:\windows\svc2.exe
c:\windows\system32\dyun6g.dll
c:\windows\system32\e882l9zh.dll
c:\windows\system32\l2nmqs7t.dll
c:\windows\system32\tmoaufm.dll
D:\install.exe
 
.
(((((((((((((((((((((((   Dateien erstellt von 2010-07-28 bis 2010-08-29  ))))))))))))))))))))))))))))))
.
 
2010-08-29 12:10 . 2010-08-29 12:13    --------    d-----w-    c:\users\Sashinho\AppData\Local\temp
2010-08-29 11:26 . 2010-08-29 11:26    --------    d-----w-    c:\program files\CCleaner
2010-08-28 21:48 . 2010-08-29 10:46    --------    d-----w-    c:\users\Sashinho\AppData\Local\Windows
2010-08-28 21:44 . 2010-08-28 21:44    --------    d-----w-    c:\program files\NVIDIA Corporation
2010-08-28 21:31 . 2010-08-28 21:31    --------    d-----w-    c:\program files\DAEMON Tools Lite
2010-08-28 21:27 . 2010-08-28 21:27    --------    d-----w-    c:\users\Sashinho\AppData\Local\2K Games
2010-08-25 17:08 . 2010-08-25 17:08    --------    d-----w-    c:\users\Sashinho\AppData\Local\76561197961688521
2010-08-25 08:47 . 2010-08-25 09:49    --------    d-----w-    c:\program files\Common Files\Steam
2010-08-24 11:14 . 2010-08-24 11:14    --------    d-----w-    c:\users\Sashinho\AppData\Local\119614890734724340
2010-08-24 11:14 . 2010-08-24 11:14    --------    d-----w-    c:\users\Sashinho\AppData\Local\119611678099186932
2010-08-24 10:35 . 2010-08-29 12:11    0    ----a-w-    c:\windows\system32\Access.dat
2010-08-24 09:59 . 2010-08-25 12:23    --------    d-----w-    c:\programdata\Tunngle
2010-08-24 09:59 . 2010-08-25 12:23    --------    d-----w-    c:\users\Sashinho\AppData\Roaming\Tunngle
2010-08-24 09:59 . 2009-09-16 06:02    27136    ----a-w-    c:\windows\system32\drivers\tap0901t.sys
2010-08-24 09:59 . 2010-08-24 10:01    --------    d-----w-    c:\program files\Tunngle
2010-08-24 09:42 . 2010-08-24 09:42    --------    d-----w-    c:\users\Sashinho\AppData\Local\119614890733675764
2010-08-24 09:42 . 2010-08-24 09:42    --------    d-----w-    c:\users\Sashinho\AppData\Local\119611678098138356
2010-08-24 09:36 . 2010-08-24 09:37    --------    d-----w-    c:\program files\Common Files\Adobe AIR
2010-08-22 18:01 . 2010-08-24 09:37    --------    d-----w-    c:\programdata\Electronic Arts
2010-08-22 17:16 . 2010-08-22 17:16    --------    d-----w-    c:\users\Sashinho\AppData\Local\Electronic_Arts_Inc
2010-08-17 15:13 . 2010-08-24 18:43    --------    d-----w-    c:\program files\Common Files\Blizzard Entertainment
2010-08-17 15:13 . 2010-08-17 15:32    --------    d-----w-    c:\programdata\Blizzard Entertainment
2010-08-17 10:24 . 2010-08-17 10:24    --------    d-----w-    c:\users\Sashinho\AppData\Local\id Software
2010-08-07 21:01 . 2010-08-07 21:02    --------    d-----w-    c:\users\Sashinho\AppData\Local\Microsoft Games
2010-08-07 19:13 . 2010-08-07 19:19    --------    d-----w-    c:\users\Sashinho\AppData\Roaming\DivX
2010-08-07 19:13 . 2010-08-07 19:13    --------    d-----w-    c:\program files\Common Files\PX Storage Engine
2010-08-07 19:13 . 2010-08-07 19:13    --------    d-----w-    c:\program files\Common Files\DivX Shared
2010-08-07 19:11 . 2010-08-07 19:13    --------    d-----w-    c:\program files\DivX
2010-08-07 19:09 . 2010-08-07 19:13    --------    d-----w-    c:\programdata\DivX
2010-08-05 18:07 . 2010-08-05 18:07    --------    d-----w-    c:\windows\E10DB5DAE57640EAA7FC1CB2A7B283A6.TMP
2010-08-04 09:58 . 2010-08-04 09:58    --------    d-----w-    c:\users\Sashinho\AppData\Roaming\bizarre creations
2010-08-03 19:09 . 2010-08-29 12:12    --------    d-----w-    c:\program files\Common Files\Akamai
2010-07-31 09:20 . 2010-07-31 09:49    --------    d-----w-    c:\users\Sashinho\AppData\Roaming\Command and Conquer 4
2010-07-31 08:33 . 2010-07-31 08:33    --------    d-----w-    c:\users\Sashinho\AppData\Local\Cadenza
2010-07-31 08:32 . 2010-07-31 08:32    --------    d-----w-    c:\program files\Microsoft XNA
2010-07-30 17:43 . 2010-07-30 17:43    --------    d-----w-    c:\users\Sashinho\AppData\Local\Activision
2010-07-30 17:16 . 2010-07-30 17:16    --------    d-----w-    c:\program files\Elaborate Bytes
2010-07-30 17:10 . 2010-07-30 17:10    --------    d-----w-    c:\program files\Alcohol Soft
2010-07-30 17:10 . 2010-07-30 17:10    --------    d-----w-    c:\program files\Franzis
2010-07-30 12:34 . 2010-07-30 12:34    --------    d-----w-    c:\users\Sashinho\AppData\Roaming\InstallShield Installation Information
2010-07-30 12:34 . 2008-07-12 06:18    467984    ----a-w-    c:\windows\system32\d3dx10_39.dll
2010-07-30 12:34 . 2008-07-12 06:18    1493528    ----a-w-    c:\windows\system32\D3DCompiler_39.dll
2010-07-30 12:34 . 2008-07-12 06:18    3851784    ----a-w-    c:\windows\system32\D3DX9_39.dll
2010-07-30 12:34 . 2010-07-30 12:34    --------    d-----w-    c:\windows\D56B0E274A3E46C9B5C1D93D580C099C.TMP
 
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-29 12:12 . 2010-03-29 18:15    232406    ----a-w-    c:\programdata\nvModes.dat
2010-08-29 12:11 . 2010-01-22 11:41    12    ----a-w-    c:\windows\bthservsdp.dat
2010-08-29 11:28 . 2009-12-30 15:01    --------    d-----w-    c:\users\Sashinho\AppData\Roaming\Media Player Classic
2010-08-29 03:08 . 2008-01-21 07:15    618442    ----a-w-    c:\windows\system32\perfh007.dat
2010-08-29 03:08 . 2008-01-21 07:15    122842    ----a-w-    c:\windows\system32\perfc007.dat
2010-08-28 22:44 . 2010-03-16 13:40    --------    d-----w-    c:\program files\Malwarebytes' Anti-Malware
2010-08-27 17:17 . 2009-12-10 12:44    8484    ----a-w-    c:\users\Sashinho\AppData\Local\d3d9caps.dat
2010-08-26 23:57 . 2009-12-09 15:08    104056    ----a-w-    c:\users\Sashinho\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-25 12:30 . 2009-12-24 07:51    --------    d-----w-    c:\program files\JDownloader
2010-08-25 08:47 . 2010-01-10 12:49    109080    ----a-w-    c:\windows\system32\OpenAL32.dll
2010-08-24 14:25 . 2010-08-24 13:59    47364    ----a-w-    c:\programdata\Blizzard Entertainment\Battle.net\Cache\Download\Scan.dll
2010-08-24 09:37 . 2009-09-14 18:24    --------    d-----w-    c:\program files\Ubisoft
2010-08-24 09:37 . 2009-04-03 15:38    --------    d--h--w-    c:\program files\InstallShield Installation Information
2010-08-24 09:37 . 2010-08-24 09:47    53632    ----a-w-    c:\users\Sashinho\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-08-24 09:37 . 2010-08-24 09:36    53632    ----a-w-    c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-08-17 20:42 . 2009-12-15 10:10    --------    d-----w-    c:\users\Sashinho\AppData\Roaming\vlc
2010-08-16 08:36 . 2010-03-13 11:13    --------    d-----w-    c:\users\Sashinho\AppData\Roaming\MudTV
2010-08-16 08:30 . 2009-04-03 15:59    --------    d-----w-    c:\program files\Acer GameZone
2010-08-07 19:14 . 2010-08-07 19:14    57344    ----a-w-    c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-08-05 18:07 . 2009-12-10 11:32    --------    d-----w-    c:\program files\Common Files\Wise Installation Wizard
2010-08-04 17:12 . 2009-12-10 11:59    138464    ----a-w-    c:\windows\system32\drivers\PnkBstrK.sys
2010-08-04 17:12 . 2009-12-10 11:59    111928    ----a-w-    c:\windows\system32\PnkBstrB.exe
2010-07-30 12:30 . 2010-07-30 12:34    331776    ----a-w-    c:\users\Sashinho\AppData\Roaming\InstallShield Installation Information\{6530FDAA-5B1F-4830-95BB-650E9804D239}\setup.exe
2010-07-30 12:30 . 2010-07-30 12:34    2010726    ----a-w-    c:\users\Sashinho\AppData\Roaming\InstallShield Installation Information\{6530FDAA-5B1F-4830-95BB-650E9804D239}\ISSetup.dll
2010-07-29 13:09 . 2010-07-29 13:09    --------    d-----w-    c:\programdata\BCR
2010-07-29 13:01 . 2010-01-10 12:49    --------    d-----w-    c:\program files\OpenAL
2010-07-07 07:39 . 2009-12-24 19:29    --------    d-----w-    c:\users\Sashinho\AppData\Roaming\dvdcss
2010-07-05 13:02 . 2010-06-29 21:45    --------    d-----w-    c:\program files\McAfee Security Scan
2010-07-01 12:04 . 2010-07-01 12:04    501936    ----a-w-    c:\programdata\Google\Google Toolbar\Update\gtb741A.tmp.exe
2010-06-18 14:22 . 2010-06-18 14:22    72504    ----a-w-    c:\programdata\Apple Computer\Installer Cache\iTunes 9.2.0.61\SetupAdmin.exe
2010-06-18 14:18 . 2010-06-18 14:18    71992    ----a-w-    c:\programdata\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe
2010-06-10 18:17 . 2010-06-21 08:06    1115424    ----a-w-    c:\windows\system32\libeay32.dll
2009-12-11 20:30 . 2009-12-11 20:30    119808    ----a-w-    c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
 
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-10-27 10:05    40496    ----a-w-    c:\program files\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" [2008-11-17 135168]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-12-12 1840424]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-14 68856]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-09-18 205976]
"Steam"="d:\gamez\Steam\Steam.exe" [2010-08-25 1242448]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"BackupManagerTray"="c:\program files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-06-05 253696]
"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-04-15 440864]
"EgisTecLiveUpdate"="c:\program files\EgisTec Egis Software Update\EgisUpdate.exe" [2008-10-27 199464]
"mwlDaemon"="c:\program files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2008-10-27 346672]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-05-06 7227936]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-02-27 1434920]
"PLFSetI"="c:\windows\PLFSetI.exe" [2008-07-29 200704]
"VitaKeyPdtWzd"="c:\program files\Acer Bio Protection\PdtWzd.exe" [2009-04-13 3553792]
"LManager"="c:\program files\Launch Manager\LManager.exe" [2009-03-05 805384]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-04-13 156968]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2009-04-13 202024]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-03-05 173288]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-05-06 1833504]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-12-02 2221352]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2009-02-10 745472]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-10-30 77824]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-26 13814376]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
" Malwarebytes Anti-Malware  (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
 
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2009-4-3 565248]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-4-13 791840]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
VPN Client.lnk - c:\windows\Installer\{F3C1DE9E-5E16-4BA9-B854-7B53A45E3579}\Icon3E5562ED7.ico [2009-12-10 6144]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer9"=wdmaud.drv
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" /background
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
"RGSC"=d:\gamez\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe /silent
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
 
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):91,d9,92,87,7b,84,ca,01
 
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-29 135664]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-04-20 43688]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-20 29472]
R3 GarenaPEngine;GarenaPEngine;c:\users\Sashinho\AppData\Local\Temp\YDLFAEB.tmp [x]
R3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2009-12-11 30192]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2009-05-18 119256]
R3 Ltn_stk7770P;PCTV LITEON based TV tuner TT1280DA device;c:\windows\system32\DRIVERS\Ltn_stk7770P.sys [2008-06-25 596096]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-04-29 38224]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-09-23 50424]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2009-12-10 691696]
S0 AlfaFF;AlfaFF;c:\windows\system32\drivers\AlfaFF.sys [2008-07-10 42608]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};Power Control [2009/09/14 18:15];c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [2009-03-05 15:46 87536]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-21 21504]
S2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2009-04-14 75048]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2009-04-15 703008]
S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [2009-09-14 26928]
S2 IGBASVC;EgisTec Service;c:\program files\Acer Bio Protection\BASVC.exe [2009-04-13 3441152]
S2 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2008-10-09 19504]
S2 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2008-10-09 16432]
S2 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2008-10-09 59952]
S2 MWLService;MyWinLocker Service;c:\program files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2008-10-27 306736]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-06-05 62208]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-09-23 144632]
S2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [2009-02-05 237568]
S2 TunngleService;TunngleService;c:\program files\Tunngle\TnglCtrl.exe [2010-07-06 716024]
S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2008-09-03 223232]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-11-17 3668480]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-27 66080]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-16 27136]
S3 winbondcir;Winbond IR Transceiver;c:\windows\system32\DRIVERS\winbondcir.sys [2007-03-28 43008]
 
 
--- Andere Dienste/Treiber im Speicher ---
 
*Deregistered* - hzicoziy
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation    REG_MULTI_SZ       FontCache
bthsvcs    REG_MULTI_SZ       BthServ
Akamai    REG_MULTI_SZ       Akamai
 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners
 
2010-08-27 c:\windows\Tasks\1-Klick-Wartung.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2007-12-14 12:17]
 
2010-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-29 17:40]
 
2010-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-29 17:40]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0909&m=1zy9bbr0tn5
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:6522
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: {1E403D09-641B-4015-87DC-CE44C720E441} = 213.168.112.60,194.8.194.60
FF - ProfilePath - c:\users\Sashinho\AppData\Roaming\Mozilla\Firefox\Profiles\cn2dlidy.default\
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
 
---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); 
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size",  4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
 
HKCU-Run-borobororb.exe - c:\borobororb.exe\borobororb.exe
HKCU-Run-cfxadpei - c:\users\Sashinho\AppData\Local\nujxtecya\vsyghrvshdw.exe
HKCU-Run-NetLog2 - c:\windows\svc2.exe
 
 
 
**************************************************************************
Scanne versteckte Prozesse... 
 
Scanne versteckte Autostarteinträge... 
 
Scanne versteckte Dateien... 
 
Scan erfolgreich abgeschlossen
versteckte Dateien: 
 
**************************************************************************
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\GarenaPEngine]
"ImagePath"="\??\c:\users\Sashinho\AppData\Local\Temp\YDLFAEB.tmp"
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\hzicoziy]
 
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
 
[HKEY_USERS\S-1-5-21-1239136018-1507258121-1134437384-1000\Software\SecuROM\License information*]
"datasecu"=hex:9a,6b,ae,17,cd,c0,c9,9c,33,2c,20,bc,83,6f,c9,59,c9,a9,e5,16,68,
   4b,76,d5,e6,c9,7e,4d,f2,c0,a8,04,15,95,29,7e,43,ad,c4,e2,57,b2,1a,64,2e,ee,\
"rkeysecu"=hex:9f,ca,16,75,83,0a,d6,fd,d2,a5,ab,cb,c1,0d,12,f7
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 
- - - - - - - > 'Explorer.exe'(2560)
c:\program files\EgisTec\MyWinLocker 3\x86\psdprotect.dll
c:\program files\EgisTec\MyWinLocker 3\x86\sysenv.dll
c:\program files\EgisTec\MyWinLocker 3\x86\mwlUI.dll
c:\program files\EgisTec\MyWinLocker 3\x86\GDIExtendCtrl.dll
c:\program files\EgisTec\MyWinLocker 3\x86\mwlOP.dll
c:\program files\EgisTec\MyWinLocker 3\x86\CryptoAPI.dll
c:\program files\EgisTec\MyWinLocker 3\x86\ShowErrMsg.dll
c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll
c:\program files\Common Files\Nero\Lib\MediaLibraryNSE.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\WLANExt.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\windows\system32\nvvsvc.exe
c:\program files\EgisTec\MyWinLocker 3\x86\MWLService.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\Acer Bio Protection\CompPtcVUI.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conime.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Windows Media Player\wmplayer.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-08-29  14:21:24 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-08-29 12:21
 
Vor Suchlauf: 10 Verzeichnis(se), 61.703.335.936 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 61.061.079.040 Bytes frei
 
- - End Of File - - 39F1B42C52A8111016CF9C8F6E823E5A
         
--- --- ---


Der GMAER Scan ist unterwegs, aber kann mir denn keiner helfen ??? Aus den obigen logs lässt sich doch schon bestimmt was erkennen, oder noch nicht ?!?!? Bin seit 2 Tagen mit dieser Plage dran und muss dringend für die Hausarbeit weitermachen, also bitte helft mir schnell !!!

Danke

Sascha

So, hier noch der GMER SCAN !!! Bitte helft mir schnell...!!!

GMER Logfile:
Code:
ATTFilter
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-08-29 15:04:28
Windows 6.0.6002 Service Pack 2
Running: 1jdl0u97.exe; Driver: C:\Users\Sashinho\AppData\Local\Temp\aglyrkow.sys
 
 
---- Kernel code sections - GMER 1.0.15 ----
 
?               System32\Drivers\hzicoziy.sys                                                                                                                 Ein an das System angeschlossenes Gerät funktioniert nicht. !
.text           C:\Windows\system32\DRIVERS\atksgt.sys                                                                                                        section is writeable [0xA1722300, 0x3B6D8, 0xE8000020]
.text           C:\Windows\system32\DRIVERS\lirsgt.sys                                                                                                        section is writeable [0xA171B300, 0x1BEE, 0xE8000020]
.text           C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl                                                                                         section is writeable [0xA42FB000, 0x2892, 0xE8000020]
.vmp2           C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl                                                                                         entry point in ".vmp2" section [0xA431E050]
?               C:\ComboFix\catchme.sys                                                                                                                       Das System kann den angegebenen Pfad nicht finden. !
?               C:\Windows\system32\Drivers\PROCEXP113.SYS                                                                                                    Das System kann die angegebene Datei nicht finden. !
 
---- User code sections - GMER 1.0.15 ----
 
.text           C:\Windows\Explorer.exe[2560] SHELL32.dll!SHGetFolderPathAndSubDirW + 81C9                                                                    767BB364 4 Bytes  [B0, 22, 00, 10] {MOV AL, 0x22; ADD [EAX], DL}
.text           C:\Program Files\Tunngle\TnglCtrl.exe[3288] ntdll.dll!DbgBreakPoint                                                                           777E8B2E 1 Byte  [90]
 
---- User IAT/EAT - GMER 1.0.15 ----
 
IAT             C:\Windows\Explorer.exe[2560] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread]                                                   [10002480] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/EgisTec Inc.)
IAT             C:\Windows\Explorer.exe[2560] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibraryAndExitThread]                                       [10001DA0] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/EgisTec Inc.)
IAT             C:\Windows\Explorer.exe[2560] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress]                                                 [100027D0] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/EgisTec Inc.)
IAT             C:\Windows\Explorer.exe[2560] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA]                                                   [10001290] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/EgisTec Inc.)
IAT             C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2604] @ C:\Windows\system32\SHELL32.dll [USER32.dll!ExitWindowsEx]  [016B1210] C:\Program Files\NewTech Infosystems\Acer Backup Manager\Pehook.dll (Backup Manager Module/NewTech Infosystems, Inc.)
 
---- Devices - GMER 1.0.15 ----
 
Device          \FileSystem\Ntfs \Ntfs                                                                                                                        88CF7D30
 
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                                                       Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                                                       Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \FileSystem\fastfat \Fat                                                                                                                      fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
 
---- Services - GMER 1.0.15 ----
 
Service          (*** hidden *** )                                                                                                                            [BOOT] hzicoziy                                                                                                                    <-- ROOTKIT !!!
 
---- Registry - GMER 1.0.15 ----
 
Reg             HKLM\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys\0c6076aebbd1 (not active ControlSet)                                               
Reg             HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                          
Reg             HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                               C:\Program Files\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                               0xD4 0xC3 0x97 0x02 ...
Reg             HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                               0
Reg             HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                            0xE0 0x54 0xAF 0x72 ...
Reg             HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)                                 
Reg             HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                                      0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                                   0x2C 0x22 0x9F 0x83 ...
Reg             HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)                            
Reg             HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                              0x09 0x0E 0x71 0x1F ...
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0c6076aebbd1 (not active ControlSet)                                               
Reg             HKLM\SYSTEM\ControlSet002\Services\hzicoziy@Type                                                                                              1
Reg             HKLM\SYSTEM\ControlSet002\Services\hzicoziy@Start                                                                                             0
Reg             HKLM\SYSTEM\ControlSet002\Services\hzicoziy@ErrorControl                                                                                      0
Reg             HKLM\SYSTEM\ControlSet002\Services\hzicoziy@Group                                                                                             Boot Bus Extender
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)                                          
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0                                                               C:\Program Files\Alcohol Soft\Alcohol 120\
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                                               1
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                                                            0xD8 0xF6 0x6A 0x2E ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet)                                 
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0                                                      0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew                                                   0x19 0x2D 0x58 0x51 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 (not active ControlSet)                          
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew                                            0xD7 0x35 0x1F 0x09 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                          
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                               0xD4 0xC3 0x97 0x02 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                               0
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                            0xCC 0x11 0x8D 0x3F ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                               C:\Program Files\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)                                 
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                                   0x2C 0x22 0x9F 0x83 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                                      0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)                            
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                              0x0C 0x25 0x4E 0x1A ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0c6076aebbd1                                                                   
Reg             HKLM\SYSTEM\CurrentControlSet\Services\hzicoziy@Type                                                                                          1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\hzicoziy@Start                                                                                         0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\hzicoziy@ErrorControl                                                                                  0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\hzicoziy@Group                                                                                         Boot Bus Extender
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                                                              
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0                                                           C:\Program Files\Alcohol Soft\Alcohol 120\
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                                           1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                                                        0xD8 0xF6 0x6A 0x2E ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001                                                     
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0                                                  0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew                                               0x19 0x2D 0x58 0x51 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40                                              
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew                                        0xD7 0x35 0x1F 0x09 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                              
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                           0xD4 0xC3 0x97 0x02 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                           0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                        0xCC 0x11 0x8D 0x3F ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                           C:\Program Files\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                                                     
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                               0x2C 0x22 0x9F 0x83 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                                  0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                                                
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                          0x0C 0x25 0x4E 0x1A ...
 
---- EOF - GMER 1.0.15 ----
         
--- --- ---


Liebes Forum, nachdem mir leider immer noch keiner geantwortet hat ist nun folgendes Stand der Dinge ! Habe alles auf eigene Faust wegbekommen, bis auf die Tatsache dass er neu startet und alles blockiert sobald das Internet aktiviert wird (das Problem hatten ja schon sehr viele hier im Board!). Habe von OTL, Combofix und GMER die Logfiles gepostet und da müsste der Fehler doch zu entdecken sein!!! Also gebt euch bitte 2 Minuten Mühe und sagt mir was ich noch löschen muss denn ich verzweifele und die zeit rennt !!!

Vielen Dank schonmal...

Lg Sascha

Alt 29.08.2010, 19:06   #2
Swisstreasure
/// Malwareteam
 
Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet - Standard

Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet





Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
  • Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren).
  • Installiere oder Deinstalliere während der Bereinigung keine Software ausser Du wurdest dazu aufgefordert.
  • Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
  • Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf. Erschwert mir nämlich das auswerten.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

Schritt 1

Lade den Avenger herunter und entzippe ihn auf den Desktop. Nicht gezippt direkt als EXE ist der Avenger hier erhältlich.

Starte die avenger.exe durch Doppelklick und akzeptiere mit OK die Nutzungsbedingungen. Füge den Inhalt der folgenden Codebox vollständig und unverändert bei "Input script here" ein und klicke auf "Execute". Beantworte die Frage, ob Du sicher bist, dass das Skript ausgeführt werden soll mit "Ja".

Code:
ATTFilter
Drivers to disable:
hzicoziy

Drivers to delete:
hzicoziy

Files to delete:
C:\Windows\System32\drivers\hzicoziy.sys
         
Beantworte die Frage zum Neustart des Rechners (Reboot now?) ebenfalls mit "Ja". Nachdem der Rechner neu gestartet ist (das kann auch zweimal nötig sein und passieren!) und das DOS-Fenster, das der Avenger geöffnet hat, wieder geschlossen ist, öffnet Avenger Deinen Editor mit dem Avengerlog, zu finden auch unter C:\avenger.txt. Den Inhalt bitte posten. Ein Backup der entfernten Objekte wurde als C:\avenger\backup.zip angelegt.

Schritt 2

Gehe in den abgesicherten Modus (Link bitte unbedingt anklicken & lesen!) von windows

Drücke beim Hochfahren des rechners [F8] (bei win xp) solange, bis du eine auswahlmöglichkeit hast.
Wähle hier:Abgesicherter Modus mit Netzwerktreibern

Schritt 3

Proxy deaktivieren

IE => Extras => Internetoptionen => Verbindungen => Lan-Einstellungen
Haken bei Proxyserver für LAN verwenden und Proxyserver für lokale Adressen umgehen entfernen

Firefox => Extras => Einstellungen => Erweitert => Netzwerk => Einstellungen.
Dort unter Verbindungs-Einstellungen => Kein Proxy anhaken.


Schritt 4
  • Download rkill.com auf den Desktop Desktop.
  • Starte per Doppelklick rkill.com und führe das Programm aus (kann etwas dauern)…
  • Am Ende wird das schwarze Fenster von rkill.com automatisch geschlossen.
  • Wenn eine Meldung von Deiner Sicherheitslösung kommt rkill.com sei Malware, erlaube rkill.com als „Ausnahme“.
  • Bitte poste mir das Logfile.

Nun wechsle wieder in den Normalmodus.

Schritt 5

Downloade Malwarebytes Anti-Malware (ca. 2 MB) von diesen Downloadspiegel:
Malwarebytes
  • Installiere das Programm in den vorgegebenen Pfad.
  • Denke daran, bei Vista das Programm als Admin zu starten, ansonsten per Doppelklick starten.
  • Lasse es online updaten (Reiter Updates), wenn das nicht automatisch passiert (ca. 1 MB).
  • Aktiviere "Komplett Scan durchführen" => Scan.
  • Wähle alle verfügbaren Laufwerke aus und starte den Scan.
  • Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
  • Versichere Dich, dass alle Funde markiert sind und drücke "Löschen".
  • Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Scan-Berichte" finden.
  • Berichte, wie der Rechner nun läuft.
Hier findest Du eine ausführliche und bebilderte Anleitung.

Schritt 6

Erneuter Systemscan mit OTL
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles in Code-Tags hier in den Thread.
__________________


Alt 29.08.2010, 19:17   #3
Sashinho
 
Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet - Standard

Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet



Logfile of The Avenger Version 2.0, (c) by Swandog46
hxxp://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "hzicoziy" disabled successfully.
Driver "hzicoziy" deleted successfully.
File "C:\Windows\System32\drivers\hzicoziy.sys" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.
__________________

Alt 29.08.2010, 19:27   #4
Sashinho
 
Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet - Standard

Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet



This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as Sashinho on 29.08.2010 at 19:26:09.


Processes terminated by Rkill or while it was running:




Rkill completed on 29.08.2010 at 19:26:14.

Alt 29.08.2010, 19:40   #5
Sashinho
 
Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet - Standard

Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet



Erst mal Danke dass sich doch noch einer meinem Probklem annimmt ! Der vollständige Malwarebytes scan scheint im moment durchzulaufen und internet verbindung besteht und er ist noch nicht runter gefahren...sobald der scan durch ist poste ich ihn direkt.

danke

sascha


Alt 29.08.2010, 21:26   #6
Sashinho
 
Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet - Standard

Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet



Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4503

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904

29.08.2010 21:24:15
mbam-log-2010-08-29 (21-24-15).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|I:\|)
Durchsuchte Objekte: 510432
Laufzeit: 1 Stunde(n), 52 Minute(n), 8 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)




Läuft bis jetzt stabil der Laptop trotz Internet-Verbindung Noch was ?

Geändert von Sashinho (29.08.2010 um 21:28 Uhr) Grund: Ergänzung

Alt 29.08.2010, 21:59   #7
Swisstreasure
/// Malwareteam
 
Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet - Standard

Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet



Schritt 6 fehlt noch.

Antwort

Themen zu Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet
0 bytes, 32 bit, 4d36e972-e325-11ce-bfc1-08002be10318, agere systems, alles blockiert, alternate, battle.net, c:\windows\system32\rundll32.exe, call of duty, combofix, components, controlset002, corp./icp, excel.exe, fehler, fontcache, gestartet, hijack, hijackthis, hoffe, home premium, iastor.sys, intranet, kollege, kritischer, kritischer fehler, launch, local\temp, location, locker, logfile, lösen, media center, minute, mywinlocker, neu, neustart., ntdll.dll, nvlddmkm.sys, nvstor.sys, oldtimer, otl.exe, problem, procexp113.sys, programdata, richtlinie, searchplugins, security scan, sptd.sys, start menu, vista 32, vista 32 bit, windows, windows wird in einer minute neu gestartet



Ähnliche Themen: Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet


  1. ein Kritischer Fehler ist aufgetreten/ Windows Explorer funktioniert nicht mehr
    Plagegeister aller Art und deren Bekämpfung - 03.01.2015 (14)
  2. TFC killt Systemstabilität: ein kritischer fehler ist aufgetreten...
    Antiviren-, Firewall- und andere Schutzprogramme - 21.11.2014 (3)
  3. Windows7: Ein kritischer Fehler ist aufgetreten. Windows wird in einer Minute neu gestartet. Speichern Sie jetzt ihre Daten.
    Log-Analyse und Auswertung - 29.05.2014 (9)
  4. Ein kritischer Fehler ist aufgetreten...
    Plagegeister aller Art und deren Bekämpfung - 19.03.2014 (17)
  5. Das übliche: Windows 7: Kritischer Fehler aufgetreten, Neustart in einer Minute
    Alles rund um Windows - 03.02.2014 (5)
  6. Win 7: "Ein kritischer Fehler ist aufgetreten. Windows wird in einer Minute neu gestartet"
    Log-Analyse und Auswertung - 18.09.2013 (9)
  7. Kritischer Fehler, Windows neu gestartet, friert häufiger ein
    Plagegeister aller Art und deren Bekämpfung - 16.11.2012 (0)
  8. Windows- Ein kritischer Fehler ist aufgetreten , Windows wird in einer Minute neugestartet!
    Alles rund um Windows - 07.07.2012 (1)
  9. "Ein kritischer Fehler ist aufgetreten. Windows wird in einer Minute neu gestartet."
    Log-Analyse und Auswertung - 24.04.2012 (7)
  10. Fehlermeldung "Ein kritischer Fehler ist aufgetreten. Windows wird in einer Minute neu gestartet."
    Log-Analyse und Auswertung - 30.09.2011 (3)
  11. "Ein kritischer Fehler ist aufgetreten. Windows wird in einer Minute neu gestartet."
    Plagegeister aller Art und deren Bekämpfung - 01.03.2011 (7)
  12. Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet (windows vista)
    Log-Analyse und Auswertung - 16.12.2010 (1)
  13. Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet
    Log-Analyse und Auswertung - 31.08.2010 (5)
  14. Ein kritischer Fehler ist aufgetreten...
    Log-Analyse und Auswertung - 26.08.2010 (0)
  15. Fehler in Windows Vista: "Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute..."
    Log-Analyse und Auswertung - 20.08.2010 (0)
  16. Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet
    Log-Analyse und Auswertung - 19.08.2010 (1)
  17. Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet
    Log-Analyse und Auswertung - 17.08.2010 (14)

Zum Thema Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet - Wie der Kollege am 16.08. habe ich genau das selbe Problem und hoffe das es sich ganuso lösen lässt. HijackThis, CCCleaner, Combofix etc. alles ist vorbereitet. Was als errstes ? - Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet...
Archiv
Du betrachtest: Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.