Hallo zusammen, ich habe wie auch schon viele vor mir das Problem, dass ich ständig bei google weitergeleitet werde. Ich hoffe ihr könnt mir weiterhelfen.
Ich habe sowohl ein hijack schon durchlaufen lassen, wie auch den OTL.

hier meiner ergebnisse:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:53:01, on 14.12.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\ProgramData\PC Tools\DownloadManager\Spyware Doctor8.0\sdsetup_dl.exe
C:\Users\Jascha\AppData\Local\Temp\is-565KK.tmp\sdsetup_dl.tmp
C:\Users\Jascha\Desktop\Dateien\HiJackThis204.exe
C:\Program Files\PC Tools Security\pctsGui.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.lge.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.lge.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - {472734EA-242A-422b-ADF8-83D1E48CC825} - (no file)
O1 - Hosts: ::1 localhost
O1 - Hosts: 74.208.10.249 gs.apple.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll (file missing)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll (file missing)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [IaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NetFxUpdate_v1.1.4322] "C:\Windows\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe" 1 v1.1.4322 GAC + NI NID
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\PC Tools Security\pctsGui.exe"
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [{1339A127-754D-82F5-9F20-ED8846849CC4}] C:\Users\Jascha\AppData\Roaming\Cyovuq\dukiy.exe
O4 - HKCU\..\Run: [Userinit] C:\Users\Jascha\AppData\Roaming\appconf32.exe
O4 - User Startup: winhelp.exe
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jascha\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll (file missing)
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe

--
End of file - 7478 bytes

hier die otl erbnisse:OTL Logfile:

OTL logfile created on: 14.12.2010 18:56:17 - Run 1
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Users\Jascha\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 43,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 73,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 100,00 Gb Total Space | 15,74 Gb Free Space | 15,74% Space Free | Partition Type: NTFS
Drive D: | 539,07 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 189,59 Gb Total Space | 151,31 Gb Free Space | 79,81% Space Free | Partition Type: NTFS
 
Computer Name: JASCHA-PC | User Name: Jascha | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Jascha\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\PC Tools Security\pctsGui.exe (PC Tools)
PRC - C:\Program Files\PC Tools Security\pctsSvc.exe (PC Tools)
PRC - C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\Program Files\PC Tools Security\pctsAuxs.exe (PC Tools)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
PRC - C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
PRC - C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Jascha\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\PC Tools Security\smum32.dll (PC Tools)
MOD - C:\Program Files\PC Tools Security\PCTGMhk.dll (PC Tools)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (sdCoreService) -- C:\Program Files\PC Tools Security\pctsSvc.exe (PC Tools)
SRV - (Stereo Service) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (TomTomHOMEService) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (ICQ Service) -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe ()
SRV - (Hamachi2Svc) -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (sdAuxService) -- C:\Program Files\PC Tools Security\pctsAuxs.exe (PC Tools)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (NMSAccessU) -- C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
SRV - (IAANTMON) Intel(R) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (vsmon) -- C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkIpx) -- C:\Windows\System32\DRIVERS\nwlnkipx.sys File not found
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (EagleNT) -- C:\Windows\System32\drivers\EagleNT.sys File not found
DRV - (PCTCore) -- C:\Windows\system32\drivers\PCTCore.sys (PC Tools)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (pctEFA) -- C:\Windows\system32\drivers\pctEFA.sys (PC Tools)
DRV - (pctDS) -- C:\Windows\system32\drivers\pctDS.sys (PC Tools)
DRV - (PnkBstrK) -- C:\Windows\System32\drivers\PnkBstrK.sys ()
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (StarOpen) -- C:\Windows\System32\drivers\StarOpen.sys ()
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (RTSTOR) -- C:\Windows\System32\drivers\RTSTOR.sys (Realtek Semiconductor Corp.)
DRV - (iaNvStor) Intel(R) -- C:\Windows\system32\DRIVERS\iaNvStor.sys (Intel Corporation)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (WSVD) -- C:\Windows\System32\drivers\WSVD.sys (CyberLink)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (Vsdatant) -- C:\Windows\System32\drivers\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (btwaudio) -- C:\Windows\System32\drivers\btwaudio.sys (Broadcom Corporation.)
DRV - (btwrchid) -- C:\Windows\System32\drivers\btwrchid.sys (Broadcom Corporation.)
DRV - (btwavdt) -- C:\Windows\System32\drivers\btwavdt.sys (Broadcom Corporation.)
DRV - (WimFltr) -- C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.lge.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2444715207-3136921340-3634710059-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.lge.com
IE - HKU\S-1-5-21-2444715207-3136921340-3634710059-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKU\S-1-5-21-2444715207-3136921340-3634710059-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2444715207-3136921340-3634710059-1000\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-2444715207-3136921340-3634710059-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-2444715207-3136921340-3634710059-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2444715207-3136921340-3634710059-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {ED0CF0C8-62F1-4865-A3FD-2E2A2B50FAFA}:1.0
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.6&q="
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}: C:\Program Files\Crawler\firefox\
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010.06.20 22:06:04 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.12.11 13:20:59 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.12.11 13:20:59 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.06.20 22:05:59 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2010.06.20 22:06:10 | 000,000,000 | ---D | M]
 
[2010.11.04 18:13:06 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\mozilla\Extensions
[2010.11.04 18:13:06 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2010.12.14 17:31:40 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\mozilla\Firefox\Profiles\93iqnbt8.default\extensions
[2009.09.02 20:50:50 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Jascha\AppData\Roaming\mozilla\Firefox\Profiles\93iqnbt8.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.12.11 22:07:20 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\Jascha\AppData\Roaming\mozilla\Firefox\Profiles\93iqnbt8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.12.06 10:20:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jascha\AppData\Roaming\mozilla\Firefox\Profiles\93iqnbt8.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.05.13 11:10:34 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\mozilla\Firefox\Profiles\93iqnbt8.default\extensions\eafo3fflauncher@ea.com
[2010.12.13 01:36:53 | 000,000,950 | ---- | M] () -- C:\Users\Jascha\AppData\Roaming\Mozilla\FireFox\Profiles\93iqnbt8.default\searchplugins\icqplugin-1.xml
[2010.10.19 10:45:52 | 000,001,056 | ---- | M] () -- C:\Users\Jascha\AppData\Roaming\Mozilla\FireFox\Profiles\93iqnbt8.default\searchplugins\icqplugin.xml
[2009.08.09 12:16:58 | 000,000,945 | ---- | M] () -- C:\Users\Jascha\AppData\Roaming\Mozilla\FireFox\Profiles\93iqnbt8.default\searchplugins\youtube-videosuche.xml
[2010.12.09 21:28:11 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010.08.30 18:57:35 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.06.26 18:47:45 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.06.26 18:47:45 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.06.26 18:47:45 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.06.26 18:47:45 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.06.26 18:47:45 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.05.28 17:37:01 | 000,000,791 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O1 - Hosts: 74.208.10.249 gs.apple.com
O2 - BHO: () - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll File not found
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O3 - HKLM\..\Toolbar: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll File not found
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [IaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe (Intel Corporation)
O4 - HKLM..\Run: [ISTray] C:\Program Files\PC Tools Security\pctsGui.exe (PC Tools)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-2444715207-3136921340-3634710059-1000..\Run: [{1339A127-754D-82F5-9F20-ED8846849CC4}] C:\Users\Jascha\AppData\Roaming\Cyovuq\dukiy.exe (ENJsoft corp.)
O4 - HKU\S-1-5-21-2444715207-3136921340-3634710059-1000..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - HKU\S-1-5-21-2444715207-3136921340-3634710059-1000..\Run: [Userinit] C:\Users\Jascha\AppData\Roaming\appconf32.exe ()
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jascha\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000038 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.100.253 192.168.100.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\tbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Jascha\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Jascha\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2001.04.18 09:23:00 | 000,000,041 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{5e9d95fc-b201-11dd-82b1-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{5e9d95fc-b201-11dd-82b1-806e6f6e6963}\Shell\AutoRun\command - "" = D:\SETUP.EXE -- [2001.04.30 11:33:00 | 000,032,768 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe - (Broadcom Corporation.)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: AppleSyncNotifier - hkey= - key= - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
MsConfig - StartUpReg: BitTorrent DNA - hkey= - key= - C:\Users\Jascha\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
MsConfig - StartUpReg: DAEMON Tools Lite - hkey= - key= - C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: KeybdUtility - hkey= - key= - C:\Program Files\LG Software\LG OSD\HotKey.exe (LG Electronics)
MsConfig - StartUpReg: LG Intelligent Update - hkey= - key= - C:\Program Files\lg_swupdate\giljabistart.exe (BIT LEADER)
MsConfig - StartUpReg: LG Magnifier - hkey= - key= -  File not found
MsConfig - StartUpReg: LGSR - hkey= - key= -  File not found
MsConfig - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= - C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
MsConfig - StartUpReg: NvMediaCenter - hkey= - key= -  File not found
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
MsConfig - StartUpReg: RtHDVCpl - hkey= - key= - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
MsConfig - StartUpReg: Skytel - hkey= - key= - C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
MsConfig - StartUpReg: Steam - hkey= - key= - C:\Program Files\Steam\Steam.exe (Valve Corporation)
MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
MsConfig - StartUpReg: UCam_Menu - hkey= - key= - C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig - StartUpReg: userinit - hkey= - key= - C:\Users\Jascha\AppData\Roaming\sdra64.exe File not found
MsConfig - State: "startup" - 2
MsConfig - State: "services" - 2
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: Hamachi2Svc - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger -  File not found
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.12.14 18:53:32 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\Jascha\Desktop\OTL.exe
[2010.12.14 18:51:19 | 000,656,320 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctEFA.sys
[2010.12.14 18:51:19 | 000,338,880 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctDS.sys
[2010.12.14 18:51:18 | 000,249,616 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctgntdi.sys
[2010.12.14 18:51:18 | 000,102,184 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctwfpfilter.sys
[2010.12.14 18:51:16 | 000,239,168 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTCore.sys
[2010.12.14 18:51:16 | 000,160,448 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTAppEvent.sys
[2010.12.14 18:51:09 | 000,070,536 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctplsg.sys
[2010.12.14 18:50:54 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2010.12.14 18:50:54 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools Security
[2010.12.14 18:50:54 | 000,000,000 | ---D | C] -- C:\Users\Jascha\AppData\Roaming\PC Tools
[2010.12.14 18:50:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2010.12.14 18:49:05 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2010.12.12 20:55:15 | 000,000,000 | ---D | C] -- C:\Users\Jascha\AppData\Roaming\UAs
[2010.12.12 17:55:23 | 000,216,400 | ---- | C] (Adobe Systems, Incorporated) -- C:\Users\Jascha\AppData\Roaming\AcroIEHelpe.dll
[2010.12.12 17:55:23 | 000,000,000 | ---D | C] -- C:\Users\Jascha\AppData\Roaming\5008
[2010.12.12 17:55:13 | 000,000,000 | ---D | C] -- C:\Users\Jascha\AppData\Roaming\xmldm
[2010.12.12 15:53:27 | 000,000,000 | ---D | C] -- C:\Users\Jascha\AppData\Roaming\cock
[2010.12.11 21:18:40 | 000,000,000 | -H-D | C] -- C:\Users\Jascha\AppData\Local\Windows
[2010.12.11 21:18:39 | 000,000,000 | -H-D | C] -- C:\Users\Jascha\AppData\Local\Server
[2010.12.10 00:25:47 | 000,184,320 | ---- | C] (Macromedia, Inc.) -- C:\Users\Jascha\AppData\Roaming\svchost.exe
[2010.12.06 10:20:49 | 000,000,000 | ---D | C] -- C:\Users\Jascha\AppData\Roaming\vlc
[2010.12.06 10:20:36 | 000,000,000 | ---D | C] -- C:\Users\Jascha\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.12.06 10:20:14 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DVDVideoSoft
[2010.12.06 10:19:49 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN
[2010.11.28 16:21:41 | 000,000,000 | ---D | C] -- C:\Users\Jascha\Documents\Yu-Gi-Oh! ONLINE 3
[2010.11.28 16:20:14 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_5.dll
[2010.11.28 16:20:12 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_4.dll
[2010.11.28 16:20:10 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_31.dll
[2010.11.28 16:20:09 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_3.dll
[2010.11.28 16:20:09 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_2.dll
[2010.11.28 16:20:07 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_2.dll
[2010.11.28 16:20:06 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_1.dll
[2010.11.28 16:20:05 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_1.dll
[2010.11.28 16:19:53 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_30.dll
[2010.11.28 16:19:52 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_0.dll
[2010.11.28 16:19:52 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\x3daudio1_0.dll
[2010.11.28 16:19:50 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_28.dll
[2010.11.28 16:19:49 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_27.dll
[2010.11.28 16:19:47 | 002,337,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_25.dll
[2010.11.28 16:19:47 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_26.dll
[2010.11.28 16:19:45 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_24.dll
[2010.11.28 16:19:24 | 000,000,000 | ---D | C] -- C:\Program Files\Konami
[2010.11.21 16:03:33 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2010.11.21 16:02:35 | 000,813,672 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvgenco32.dll
[2010.11.21 16:02:35 | 000,123,496 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvhda32v.sys
[2010.11.21 16:02:35 | 000,065,640 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvapo32v.dll
[2010.11.21 16:02:35 | 000,026,216 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvhdap32.dll
[2010.11.21 16:02:34 | 014,899,816 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvoglv32.dll
[2010.11.21 16:02:34 | 013,019,752 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcompiler.dll
[2010.11.21 16:02:34 | 010,084,360 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvlddmkm.sys
[2010.11.21 16:02:34 | 005,473,896 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvwgf2um.dll
[2010.11.21 16:02:34 | 004,837,480 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuda.dll
[2010.11.21 16:02:34 | 002,912,360 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvid.dll
[2010.11.21 16:02:34 | 002,666,600 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvenc.dll
[2010.11.21 16:02:34 | 000,888,424 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvdispco322050.dll
[2010.11.21 16:02:34 | 000,813,672 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvgenco322030.dll
[2010.11.21 16:02:34 | 000,057,960 | ---- | C] (Khronos Group) -- C:\Windows\System32\OpenCL.dll
[2010.11.21 16:02:34 | 000,010,920 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvBridge.kmd
[2 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]
[1 C:\Users\Jascha\AppData\Roaming\*.tmp files -> C:\Users\Jascha\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.12.14 18:53:36 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Jascha\Desktop\OTL.exe
[2010.12.14 18:52:05 | 001,914,480 | ---- | M] () -- C:\Windows\System32\drivers\Cat.DB
[2010.12.14 18:51:15 | 000,001,732 | ---- | M] () -- C:\Users\Public\Desktop\Spyware Doctor.lnk
[2010.12.14 18:48:20 | 000,512,992 | ---- | M] () -- C:\Users\Jascha\Desktop\sdsetup.exe
[2010.12.14 18:17:26 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.12.14 18:10:01 | 000,000,248 | -H-- | M] () -- C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010.12.14 17:18:49 | 000,628,910 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.12.14 17:18:49 | 000,595,946 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.12.14 17:18:49 | 000,127,606 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.12.14 17:18:49 | 000,105,276 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.12.14 17:11:29 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.12.14 17:11:25 | 000,352,616 | -H-- | M] () -- C:\Windows\System32\drivers\vsconfig.xml
[2010.12.14 17:11:24 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.12.14 17:11:24 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.12.14 17:11:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.12.14 17:11:16 | 3218,272,256 | -HS- | M] () -- C:\hiberfil.sys
[2010.12.12 17:55:23 | 000,216,400 | ---- | M] (Adobe Systems, Incorporated) -- C:\Users\Jascha\AppData\Roaming\AcroIEHelpe.dll
[2010.12.10 00:25:47 | 000,184,320 | ---- | M] (Macromedia, Inc.) -- C:\Users\Jascha\AppData\Roaming\svchost.exe
[2010.12.10 00:25:47 | 000,000,012 | ---- | M] () -- C:\Users\Jascha\AppData\Roaming\abpzlw.dat
[2010.12.10 00:25:44 | 000,000,004 | ---- | M] () -- C:\Users\Jascha\AppData\Roaming\avdrn.dat
[2010.11.25 10:53:58 | 000,160,448 | ---- | M] (PC Tools) -- C:\Windows\System32\drivers\PCTAppEvent.sys
[2010.11.25 10:43:00 | 000,239,168 | ---- | M] (PC Tools) -- C:\Windows\System32\drivers\PCTCore.sys
[2010.11.25 10:42:10 | 000,070,536 | ---- | M] (PC Tools) -- C:\Windows\System32\drivers\pctplsg.sys
[2010.11.17 10:19:50 | 000,249,616 | ---- | M] (PC Tools) -- C:\Windows\System32\drivers\pctgntdi.sys
[2010.11.17 10:19:50 | 000,102,184 | ---- | M] (PC Tools) -- C:\Windows\System32\drivers\pctwfpfilter.sys
[2 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]
[1 C:\Users\Jascha\AppData\Roaming\*.tmp files -> C:\Users\Jascha\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.12.14 18:51:39 | 001,914,480 | ---- | C] () -- C:\Windows\System32\drivers\Cat.DB
[2010.12.14 18:51:15 | 000,001,732 | ---- | C] () -- C:\Users\Public\Desktop\Spyware Doctor.lnk
[2010.12.14 18:48:19 | 000,512,992 | ---- | C] () -- C:\Users\Jascha\Desktop\sdsetup.exe
[2010.12.12 17:55:24 | 000,000,065 | ---- | C] () -- C:\Users\Jascha\AppData\Roaming\AcroIEHelpe.txt
[2010.12.10 00:25:47 | 000,000,012 | ---- | C] () -- C:\Users\Jascha\AppData\Roaming\abpzlw.dat
[2010.12.10 00:25:44 | 000,000,004 | ---- | C] () -- C:\Users\Jascha\AppData\Roaming\avdrn.dat
[2010.08.23 19:02:50 | 000,000,094 | ---- | C] () -- C:\Users\Jascha\AppData\Local\fusioncache.dat
[2010.07.24 19:16:58 | 000,000,680 | ---- | C] () -- C:\Users\Jascha\AppData\Local\d3d9caps.dat
[2010.06.11 20:41:42 | 000,069,632 | R--- | C] () -- C:\Windows\System32\xmltok.dll
[2010.06.11 20:41:42 | 000,036,864 | R--- | C] () -- C:\Windows\System32\xmlparse.dll
[2010.05.15 17:42:25 | 000,000,227 | ---- | C] () -- C:\Windows\RomeTW.ini
[2010.05.13 11:12:23 | 000,139,152 | ---- | C] () -- C:\Users\Jascha\AppData\Roaming\PnkBstrK.sys
[2010.05.13 11:12:23 | 000,138,968 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2010.04.02 16:17:34 | 000,179,091 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2010.03.29 19:17:01 | 000,691,696 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
[2009.12.11 14:54:38 | 000,007,168 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2009.09.24 15:55:16 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.09.04 21:58:33 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.08.05 21:58:47 | 000,013,824 | ---- | C] () -- C:\Users\Jascha\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.07.25 17:47:50 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2009.07.25 17:47:50 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2009.07.25 17:47:50 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2009.06.20 11:04:18 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2009.06.20 11:04:17 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2009.06.20 09:59:22 | 000,012,565 | ---- | C] () -- C:\Windows\lg_up.ini
[2008.12.09 16:23:13 | 000,046,008 | RHS- | C] () -- C:\Users\Jascha\AppData\Roaming\appconf32.exe
[2008.11.14 04:58:15 | 000,172,032 | ---- | C] () -- C:\Windows\System32\nvccoin.dll
[2008.07.26 18:47:09 | 000,001,065 | ---- | C] () -- C:\Windows\lgcenter.ini
[2008.07.26 18:31:56 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008.07.26 18:18:08 | 000,000,232 | ---- | C] () -- C:\Windows\lgps.ini
[2007.10.02 22:58:12 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2005.02.05 20:46:00 | 000,004,608 | ---- | C] () -- C:\Windows\fgexec.dll
[2001.11.14 22:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2010.12.12 17:55:23 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\5008
[2010.01.07 23:51:28 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Ascaron Entertainment
[2010.05.16 16:10:06 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Azureus
[2009.12.11 14:55:01 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Canneverbe_Limited
[2010.12.12 15:53:27 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\cock
[2010.02.23 12:01:15 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2010.07.07 00:03:12 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Cyovuq
[2010.03.29 19:28:58 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\DAEMON Tools Lite
[2010.08.11 23:32:55 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\DNA
[2010.12.06 10:20:36 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.04.05 11:44:27 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\FOG Downloader
[2010.08.23 18:20:19 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\GetRightToGo
[2010.12.11 23:30:47 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\ICQ
[2010.12.13 01:59:31 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Keydep
[2010.01.01 22:39:32 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Laconic Software
[2010.05.13 12:27:07 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\LolClient
[2010.01.16 23:06:14 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\LolClient.F24C99354F615F3BAB18AE7B93E3F9B9E8784FA6.1
[2010.05.19 19:14:12 | 000,000,000 | -HSD | M] -- C:\Users\Jascha\AppData\Roaming\lowsec
[2009.09.17 17:17:41 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\TeamViewer
[2009.07.23 12:26:34 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\The Creative Assembly
[2009.06.19 22:40:54 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Thunderbird
[2010.11.04 18:13:03 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\TomTom
[2010.08.23 19:04:08 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Turbine
[2010.12.12 20:55:15 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\UAs
[2010.03.10 14:46:46 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Ubisoft
[2010.12.12 20:55:52 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\xmldm
[2010.12.13 02:02:44 | 000,032,626 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.12.14 18:10:01 | 000,000,248 | -H-- | M] () -- C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.12.12 17:55:23 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\5008
[2010.01.16 12:46:32 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Adobe
[2010.03.20 19:33:52 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Apple Computer
[2010.01.07 23:51:28 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Ascaron Entertainment
[2010.04.05 19:46:46 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Avira
[2010.05.16 16:10:06 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Azureus
[2009.12.11 14:55:01 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Canneverbe_Limited
[2010.12.12 15:53:27 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\cock
[2010.02.23 12:01:15 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2010.07.07 00:03:12 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Cyovuq
[2010.03.29 19:28:58 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\DAEMON Tools Lite
[2010.02.27 00:00:47 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\DivX
[2010.08.11 23:32:55 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\DNA
[2010.12.06 10:20:36 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.04.05 11:44:27 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\FOG Downloader
[2010.08.23 18:20:19 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\GetRightToGo
[2009.10.08 14:33:38 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Hamachi
[2010.12.11 23:30:47 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\ICQ
[2009.06.19 20:46:43 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Identities
[2010.12.13 01:59:31 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Keydep
[2010.01.01 22:39:32 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Laconic Software
[2010.05.13 12:27:07 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\LolClient
[2010.01.16 23:06:14 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\LolClient.F24C99354F615F3BAB18AE7B93E3F9B9E8784FA6.1
[2010.05.19 19:14:12 | 000,000,000 | -HSD | M] -- C:\Users\Jascha\AppData\Roaming\lowsec
[2009.06.19 21:13:28 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Macromedia
[2010.10.01 19:00:21 | 000,000,000 | --SD | M] -- C:\Users\Jascha\AppData\Roaming\Microsoft
[2010.08.23 20:10:22 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Mozilla
[2010.12.14 18:50:54 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\PC Tools
[2010.07.11 17:11:46 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Real
[2010.02.15 13:56:02 | 000,000,000 | RH-D | M] -- C:\Users\Jascha\AppData\Roaming\SecuROM
[2010.12.14 17:25:53 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Skype
[2010.12.14 17:25:44 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\skypePM
[2009.06.19 22:40:58 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Talkback
[2009.09.17 17:17:41 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\TeamViewer
[2009.07.23 12:26:34 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\The Creative Assembly
[2009.06.19 22:40:54 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Thunderbird
[2010.11.04 18:13:03 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\TomTom
[2010.08.23 19:04:08 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Turbine
[2010.12.12 20:55:15 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\UAs
[2010.03.10 14:46:46 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Ubisoft
[2010.12.06 10:21:18 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\vlc
[2009.08.05 13:15:07 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Winamp
[2009.06.20 10:59:52 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\WinRAR
[2010.12.12 20:55:52 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\xmldm
 
< %APPDATA%\*.exe /s >
[2008.12.09 16:23:13 | 000,046,008 | RHS- | M] () -- C:\Users\Jascha\AppData\Roaming\appconf32.exe
[2010.12.10 00:25:47 | 000,184,320 | ---- | M] (Macromedia, Inc.) -- C:\Users\Jascha\AppData\Roaming\svchost.exe
[1 C:\Users\Jascha\AppData\Roaming\*.tmp files -> C:\Users\Jascha\AppData\Roaming\*.tmp -> ]
[2010.05.16 14:59:32 | 008,463,808 | ---- | M] (Vuze Inc.) -- C:\Users\Jascha\AppData\Roaming\Azureus\tmp\AZU5144359182803828104.tmp\Vuze_4.4.0.4_win32.exe
[2010.07.07 00:03:12 | 000,152,576 | ---- | M] (ENJsoft corp.) -- C:\Users\Jascha\AppData\Roaming\Cyovuq\dukiy.exe
[2010.01.16 12:46:12 | 000,038,208 | ---- | M] () -- C:\Users\Jascha\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 03:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 03:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 03:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 03:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 03:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 03:23:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 03:23:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008.01.21 03:24:50 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2008.04.21 03:29:56 | 000,394,776 | ---- | M] (Intel Corporation) MD5=8BD53925C5675BC9A5EFE12E2A42BE31 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2008.04.21 03:29:38 | 000,317,464 | ---- | M] (Intel Corporation) MD5=9F1220113A3A7F4F08042C699324D073 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2008.04.21 03:29:38 | 000,317,464 | ---- | M] (Intel Corporation) MD5=9F1220113A3A7F4F08042C699324D073 -- C:\Windows\System32\drivers\iaStor.sys
[2008.04.21 03:29:38 | 000,317,464 | ---- | M] (Intel Corporation) MD5=9F1220113A3A7F4F08042C699324D073 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_18bd4575\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 03:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 03:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 03:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 03:24:31 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 03:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 03:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 03:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 03:25:18 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.21 03:24:47 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:25:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 03:25:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 03:25:17 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 03:25:11 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 03:25:11 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010.03.29 19:17:01 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\sptd.sys
[2008.03.03 14:06:04 | 000,279,440 | ---- | M] (Check Point Software Technologies LTD) Unable to obtain MD5 -- C:\Windows\System32\drivers\vsdatant.sys
[2 C:\Windows\system32\drivers\*.tmp files -> C:\Windows\system32\drivers\*.tmp -> ]
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 04:20:25 | 017,223,680 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 04:20:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 04:20:25 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.04.11 07:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2009.04.11 07:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 171 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >
         

--- --- ---


extreasOTL Logfile:

OTL Extras logfile created on: 14.12.2010 18:56:17 - Run 1
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Users\Jascha\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 43,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 73,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 100,00 Gb Total Space | 15,74 Gb Free Space | 15,74% Space Free | Partition Type: NTFS
Drive D: | 539,07 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 189,59 Gb Total Space | 151,31 Gb Free Space | 79,81% Space Free | Partition Type: NTFS
 
Computer Name: JASCHA-PC | User Name: Jascha | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-2444715207-3136921340-3634710059-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{048E126C-0C26-4EAF-ADD9-F4A0E42202C7}" = lport=137 | protocol=17 | dir=in | app=system | 
"{06581312-48E8-46ED-88F0-0A5C1A291F38}" = lport=138 | protocol=17 | dir=in | app=system | 
"{082E7DE6-CB97-4F64-B79D-EFF3F538AE6B}" = rport=445 | protocol=6 | dir=out | app=system | 
"{1147A907-7532-4678-980A-C3AB81867AB8}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher | 
"{169DB890-333C-45E4-AFD9-BE040A56D4A4}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{1B81399F-367E-4922-8148-C0508C83CE57}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{1ED9CE7A-CCC8-4431-A942-2AAAEBD8542C}" = lport=6991 | protocol=17 | dir=in | name=league of legends launcher | 
"{2573E96A-EDCC-436E-9075-A2AB28753C00}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher | 
"{3A896B27-A34E-4689-BE09-FB148EA634CC}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{546728CD-584D-4624-9F54-EE8FDB0CC08D}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{65CD987A-B825-443D-9254-9A513FB03950}" = lport=8395 | protocol=17 | dir=in | name=league of legends launcher | 
"{690B9327-B11E-4611-A401-83739E1FF62D}" = lport=8396 | protocol=6 | dir=in | name=league of legends launcher | 
"{6930DE98-7F4E-4B3D-985F-A810198CEB1F}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher | 
"{73CC5952-BB08-4B03-BEC8-7BEA99F773F9}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{83597185-7BD0-4728-A706-18FB4ECBF6B0}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{98DC03FE-E53F-4A0A-908B-7DA4CF77041A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{9DEC8A42-52E8-4033-B52F-EF9B412D5BB5}" = rport=137 | protocol=17 | dir=out | app=system | 
"{A54CE389-3CA7-4583-8E2B-33A93212EE11}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{A61E3583-7088-4586-8FFB-4D671EB04CFD}" = rport=139 | protocol=6 | dir=out | app=system | 
"{AA9BBD03-E4AD-45BB-A932-6114775DE23E}" = lport=445 | protocol=6 | dir=in | app=system | 
"{ADFBF24C-13DB-4FF3-ADA1-0662DD434678}" = lport=139 | protocol=6 | dir=in | app=system | 
"{B3891F32-C2A8-47E5-ABA5-C783816853CF}" = lport=8396 | protocol=17 | dir=in | name=league of legends launcher | 
"{B5D25E7A-FA94-4694-9B36-C033B1184474}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher | 
"{C4B72087-3796-43C6-86D7-76C7DECE86F4}" = lport=6991 | protocol=6 | dir=in | name=league of legends launcher | 
"{DABE6AD2-8E59-4EBA-A8E6-D5FEE247093F}" = lport=8395 | protocol=6 | dir=in | name=league of legends launcher | 
"{DFD7040A-EC6C-429A-8F83-6573B954B256}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{E3E0FCCF-0D71-4940-9036-9D9999B9DB7D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{EEA09725-3EEE-4988-AD77-91EB8AD14F6B}" = rport=138 | protocol=17 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00E45DA1-2C34-47E8-8C48-3F83A960BFD8}" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"{05D12BE2-1A96-443F-BA92-9440D7B05EDA}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{09EB3436-BE58-428E-9C58-5A98D58D27CE}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{1E232338-78A8-47A0-9DFD-3A1B7E5D3C6C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{245BC827-201F-4BB4-9F23-4724F7C788CD}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{31224C5F-754F-4F19-8ACF-B3BBFA4B3B91}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3590F0CC-0977-406D-A5FB-FB814D74A695}" = protocol=6 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{39657CA9-FA15-4339-923B-3102B4DFEAC3}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{3CF0E442-BF5E-4B19-A8C4-7570A91AF4AA}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\empire total war\empire.exe | 
"{3DBA2DD5-A3A2-440D-B1EB-0E7677369E73}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{3E89E177-3EB5-4362-AD16-BF28CBD10868}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{4459A7BE-E7AE-46B4-9B67-4ED35FF7E31B}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{4E289B78-9879-4BA8-9861-8E51AA5E898A}" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"{587CED61-9B04-4AF2-B3A3-5D8F3CF8122F}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{59057AFD-1EBD-424F-9E6F-4A64B829EB29}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\empire total war\empire.exe | 
"{5E0FF919-511F-4AC9-B37C-3F92E9E21EAD}" = protocol=17 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{76A7361E-919C-4F7A-B8DA-3865690A7B8F}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{7B5302AE-709F-4C28-BF28-DBA272B7FD7A}" = protocol=17 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\anno4.exe | 
"{8743A3DB-EDCB-4DA4-896D-47A6E2C0C5F3}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{889078EB-6ABA-469E-97FC-EBCAB462D8D0}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{8A998B92-EF65-4497-993E-446EE8889AD6}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{8CDE10F1-9A0D-47D7-8EF6-A97DC1771693}" = protocol=6 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\tools\anno4web.exe | 
"{91EA2652-4086-413B-95E2-285334E125F1}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{9235CE8E-76FB-49D8-88AD-D853EC854712}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{9FBE8BF1-F13D-46F1-B413-CBED24D94638}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{A79B3C56-3E4C-4146-AA9F-EA1F527A012B}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\empire total war\empire.exe | 
"{A8608792-2CF0-4658-8E70-E445DBE87A56}" = protocol=6 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{A92C46B0-060A-4215-9278-5D99FCDB905C}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{AA1383B3-84CE-4E16-86F1-86CFD3E3AEE3}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{AD481B73-842F-4E27-B48D-FD3EBED80DB4}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{ADB49B6C-51D5-4E59-BA5C-2A5D54B5087F}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{B8FF42D4-8921-414A-97D4-8D14099F5308}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{B93C0F62-3D11-4A89-8EFB-3B7EFEE1295E}" = protocol=17 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{BED52D03-1C58-43FD-9602-3B8CDA7DCB36}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{C07CEEB0-FF3F-4E7A-BCFC-883E9558B786}" = protocol=6 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{C1B1A1B7-F613-4E2C-83DE-1BAC8C672082}" = protocol=6 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{C6A4F614-6292-4200-B4CC-70F28651488C}" = protocol=17 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{C8EAB8CD-BA3F-436B-87C8-CB9859D781D1}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{CBE285AF-4158-4E2E-86BC-D5D3BA83EAF0}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{D4AF0FAB-A8E7-4F0B-842E-C7152A399B2C}" = protocol=17 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\tools\anno4web.exe | 
"{D56A7455-DC7A-44DB-9A67-966115271DAC}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{DA5DC8F7-FEBB-45C9-A433-3E638CEF5E10}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{DCF618CC-201E-468D-827F-363391208E73}" = protocol=17 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{DEEE2834-C0BA-4E27-976F-1521AA9AD181}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\empire total war\empire.exe | 
"{EB78156D-0144-4E6E-AAFE-663068B2887B}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{FBF8371F-1674-4E6E-BBF1-0DA31305A2C3}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{FD4E6A96-A18A-421B-9D6E-CE274E2438C2}" = protocol=6 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\anno4.exe | 
"{FDD7127D-B705-41B4-9750-2856D04D1B7A}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"TCP Query User{F7CE892A-6516-452E-8364-557EED36FB62}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{AE302DB3-5A3A-4A3B-B1AC-232B7944D039}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.5600
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0513EE35-E0FB-4166-B663-BD1AE3A803DE}" = Anno 1404
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 15
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{31423F74-36B2-4d24-B10D-CD00BFB7C118}" = Intel® Turbo Memory
"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = LG Smart Recovery
"{52210D57-0B1F-4681-90DD-8659DF4BCC40}" = Moorhuhn Remake
"{66D6F3BD-CA23-41A4-9FA3-96B26B32528D}" = Command & Conquer Die ersten 10 Jahre
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6FE3B0CE-37C1-4825-908A-5A84C9B4EC2F}" = EA SPORTS(TM) FIFA Online
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{7AB3A249-FB81-416B-917A-A2A10E74C503}" = iTunes
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7F815C5F-D2A4-4173-B7C0-55A9D6F87E38}" = MobileMe Control Panel
"{81717D01-32F6-449C-85E1-41AFD678E545}" = LG Intelligent Update
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{8FB1B528-E260-451E-9B55-E9152F94B80B}" = Microsoft Games for Windows - LIVE Redistributable
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager and Intel® Turbo Memory
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{92482FB3-C05B-41C6-89E7-75D985602A6E}" = System Requirements Lab
"{9672CAD2-F310-42D6-9147-E4A4B6ED8395}" = LG Magnifier
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A07B2C21-863B-47AB-AE7E-20BB00BD7D33}" = ANNO 1404 - Venedig
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A2F166A0-F031-4E27-A057-C69733219434}_is1" = Runes of Magic
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A5D65411-8E73-4C85-AD80-9FE8B7391CF9}" = Rome Total War - patch 1.3
"{A642BB6B-CA1D-4142-8DD4-318C3F3DC834}" = Rome - Total War(TM)
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-A91000000001}" = Adobe Reader 9.1 - Deutsch
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B0C30E93-D3D9-4F04-A2AC-54749B573275}" = Command & Conquer 3
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 260.99
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.1.9.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{BD3BD375-0E7A-48D0-9117-69A5C7DED63E}" = RollerCoaster Tycoon 2
"{C580908C-B3BA-4C19-BD60-16F02F272201}" = BattleForge™
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D5FCBCF0-9F60-4FBA-A34E-06222586527E}" = LogMeIn Hamachi
"{DABD50F7-0001-0002-0003-ABCDEFABCDEF}" = LG Smart Indicator
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E8D2307D-F40A-4214-86D6-613A31E948FE}" = LG OSD
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{F97E3841-CA9D-4964-9D64-26066241D26F}" = Microsoft Games for Windows - LIVE
"4f6dcc3b-179d-4b1b-80f0-b6083a0b3ce6_is1" = Der Herr der Ringe Online: Die Belagerung des Düsterwalds v03.0
"8461-7759-5462-8226" = Vuze
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Cultures - Die Entdeckung Vinlands" = Cultures - Die Entdeckung Vinlands
"Diablo II" = Diablo II
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free Fire Screensaver" = Free Fire Screensaver
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.30
"Google Chrome" = Google Chrome
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ICQToolbar" = ICQ Toolbar
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = LG Smart Recovery
"InstallShield_{A642BB6B-CA1D-4142-8DD4-318C3F3DC834}" = Rome - Total War(TM)
"JDownloader" = JDownloader
"League of Legends_is1" = League of Legends
"LGFanModeTile" = LG Fan Mode Tile for Windows Mobility Center
"LGTouchPadTile" = LG TouchPad Tile for Windows Mobility Center
"LogMeIn Hamachi" = LogMeIn Hamachi
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Mozilla Thunderbird (2.0.0.24)" = Mozilla Thunderbird (2.0.0.24)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"PokerStars.net" = PokerStars.net
"Port Royale 2" = Port Royale 2
"PunkBusterSvc" = PunkBuster Services
"RealPlayer 12.0" = RealPlayer
"S4Uninst" = Die Siedler IV
"Sim AQUARIUM 2_is1" = Sim AQUARIUM 2
"Steam App 10500" = Empire: Total War
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"SystemRequirementsLab" = System Requirements Lab
"TomTom HOME" = TomTom HOME 2.7.6.2056
"Uninstall_is1" = Uninstall 1.0.0.1
"Virtual DJ - Atomix Productions" = Virtual DJ - Atomix Productions
"VLC media player" = VLC media player 1.1.5
"Winamp" = Winamp
"WinRAR archiver" = WinRAR
"ZoneAlarm" = ZoneAlarm
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-2444715207-3136921340-3634710059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent DNA" = DNA
"UnityWebPlayer" = Unity Web Player
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 19.06.2010 08:09:44 | Computer Name = Jascha-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 19.06.2010 08:09:44 | Computer Name = Jascha-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 556518
 
Error - 19.06.2010 08:09:44 | Computer Name = Jascha-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 556518
 
Error - 19.06.2010 08:10:00 | Computer Name = Jascha-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 19.06.2010 08:10:00 | Computer Name = Jascha-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 572118
 
Error - 19.06.2010 08:10:00 | Computer Name = Jascha-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 572118
 
Error - 19.06.2010 08:10:15 | Computer Name = Jascha-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 19.06.2010 08:10:15 | Computer Name = Jascha-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 587718
 
Error - 19.06.2010 08:10:15 | Computer Name = Jascha-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 587718
 
Error - 19.06.2010 10:39:17 | Computer Name = Jascha-PC | Source = WinMgmt | ID = 10
Description = 
 
[ OSession Events ]
Error - 14.09.2010 17:05:34 | Computer Name = Jascha-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application 
Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session 
lasted 7 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 01.10.2010 13:57:03 | Computer Name = Jascha-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application 
Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session 
lasted 43 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 01.10.2010 14:00:21 | Computer Name = Jascha-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application 
Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session 
lasted 195 seconds with 180 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 11.12.2010 13:10:57 | Computer Name = Jascha-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 11.12.2010 13:11:04 | Computer Name = Jascha-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 11.12.2010 18:25:59 | Computer Name = Jascha-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 11.12.2010 18:26:50 | Computer Name = Jascha-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 12.12.2010 06:22:50 | Computer Name = Jascha-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 12.12.2010 06:23:41 | Computer Name = Jascha-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 12.12.2010 21:02:41 | Computer Name = Jascha-PC | Source = Service Control Manager | ID = 7043
Description = 
 
Error - 14.12.2010 12:12:04 | Computer Name = Jascha-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 14.12.2010 12:12:53 | Computer Name = Jascha-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 14.12.2010 14:02:12 | Computer Name = Jascha-PC | Source = DCOM | ID = 10010
Description = 
 
 
< End of report >
         

--- --- ---

dep für alle prozesse:
Datenausführungsverhinderung (DEP)
• "Datenausführungsverhinderung für alle Programme und Dienste mit Ausnahme der ausgewählten einschalten:".
falls warnmeldung erscheint, gib bescheid.

1. nimm keinerlei reinigung selbstständig vor, sonst ist das nur störend.
2. reiche alle evtl vorhandenen scan logs nach. ootl:
3.
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
beide posten

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKU\S-1-5-21-2444715207-3136921340-3634710059-1000..\Run: [{1339A127-754D-82F5-9F20-ED8846849CC4}] C:\Users\Jascha\AppData\Roaming\Cyovuq\dukiy.exe
(ENJsoft corp.)
O4 - HKU\S-1-5-21-2444715207-3136921340-3634710059-1000..\Run: [Userinit] C:\Users\Jascha\AppData\Roaming\appconf32.exe ()
[2010.12.12 15:53:27 | 000,000,000 | ---D | C] -- C:\Users\Jascha\AppData\Roaming\cock
[2010.12.11 21:18:40 | 000,000,000 | -H-D | C] -- C:\Users\Jascha\AppData\Local\Windows
[2010.12.11 21:18:39 | 000,000,000 | -H-D | C] -- C:\Users\Jascha\AppData\Local\Server
[2010.12.10 00:25:47 | 000,184,320 | ---- | C] (Macromedia, Inc.) -- C:\Users\Jascha\AppData\Roaming\svchost.exe
[2010.12.12 17:55:23 | 000,216,400 | ---- | M] (Adobe Systems, Incorporated) -- C:\Users\Jascha\AppData\Roaming\AcroIEHelpe.dll
[2010.12.10 00:25:47 | 000,184,320 | ---- | M] (Macromedia, Inc.) -- C:\Users\Jascha\AppData\Roaming\svchost.exe
[2010.12.10 00:25:47 | 000,000,012 | ---- | M] () -- C:\Users\Jascha\AppData\Roaming\abpzlw.dat
[2010.12.10 00:25:44 | 000,000,004 | ---- | M] () -- C:\Users\Jascha\AppData\Roaming\avdrn.dat
[2010.07.07 00:03:12 | 000,000,000 | ---D | M] -- C:\Users\Jascha\AppData\Roaming\Cyovuq

:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort posten.

gesagt, getan:


All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-2444715207-3136921340-3634710059-1000\Software\Microsoft\Windows\CurrentVersion\Run\\{1339A127-754D-82F5-9F20-ED8846849CC4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1339A127-754D-82F5-9F20-ED8846849CC4}\ not found.
C:\Users\Jascha\AppData\Roaming\Cyovuq\dukiy.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-2444715207-3136921340-3634710059-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Userinit deleted successfully.
File move failed. C:\Users\Jascha\AppData\Roaming\appconf32.exe scheduled to be moved on reboot.
C:\Users\Jascha\AppData\Roaming\cock folder moved successfully.
C:\Users\Jascha\AppData\Local\Windows folder moved successfully.
C:\Users\Jascha\AppData\Local\Server folder moved successfully.
C:\Users\Jascha\AppData\Roaming\svchost.exe moved successfully.
C:\Users\Jascha\AppData\Roaming\AcroIEHelpe.dll moved successfully.
File C:\Users\Jascha\AppData\Roaming\svchost.exe not found.
C:\Users\Jascha\AppData\Roaming\abpzlw.dat moved successfully.
C:\Users\Jascha\AppData\Roaming\avdrn.dat moved successfully.
C:\Users\Jascha\AppData\Roaming\Cyovuq folder moved successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 41044 bytes

User: Default User

User: Jascha
->Flash cache emptied: 125893 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: Default User

User: Jascha
->Temp folder emptied: 503580278 bytes
->Temporary Internet Files folder emptied: 250054257 bytes
->Java cache emptied: 15193125 bytes
->FireFox cache emptied: 88021521 bytes
->Google Chrome cache emptied: 226783478 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 558880 bytes
Windows Temp folder emptied: 2891598698 bytes
RecycleBin emptied: 316542 bytes

Total Files Cleaned = 3.792,00 mb


OTL by OldTimer - Version 3.2.17.3 log created on 12142010_194813

Files\Folders moved on Reboot...
C:\Users\Jascha\AppData\Roaming\appconf32.exe moved successfully.

Registry entries deleted on Reboot...

öffne mein computer, c: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
lade das archiv in unserem upload channel hoch.
http://www.trojaner-board.de/54791-a...ner-board.html


machst du onlinebanking /einkäufe oder sonst was wichtiges am pc?

Einkäufe ab und zu über amazon, ansonsten habe ich hier jede mange daten drauf die wichtig sind

ok lad mir das archiv mal hoch, will mir die dateien ansehen.
wenn sich mein verdacht bestätigt, sollten wir neu aufsetzen, damit du dann wieder sicher shoppen kannst.

ok, ist hochgeladen. Vielen dank schon einmal für die Hilfe

ich würd sagen, formatiern, aber ich möchte vorher noch was prüfen dauert nur 20 minuten.
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Combofix Logfile:

ComboFix 10-12-14.01 - Jascha 14.12.2010  20:24:43.1.2 - x86
Microsoft® Windows Vista™ Business   6.0.6002.2.1252.49.1031.18.3068.1991 [GMT 1:00]
ausgeführt von:: c:\users\Jascha\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Jascha\AppData\Roaming\Cyovuq\dukiy.exe
c:\users\Jascha\videos\RitterArthur2.exe
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

.
(((((((((((((((((((((((   Dateien erstellt von 2010-11-14 bis 2010-12-14  ))))))))))))))))))))))))))))))
.

2010-12-14 19:28 . 2010-12-14 19:28	--------	d-----w-	c:\users\Jascha\AppData\Local\temp
2010-12-14 19:28 . 2010-12-14 19:28	--------	d-----w-	c:\users\Default\AppData\Local\temp
2010-12-14 18:52 . 2010-12-14 18:52	--------	d--h--w-	c:\users\Jascha\AppData\Local\Windows
2010-12-14 18:52 . 2010-12-14 18:52	--------	d--h--w-	c:\users\Jascha\AppData\Local\Server
2010-12-14 18:46 . 2010-12-14 19:03	--------	d-----w-	C:\_OTL
2010-12-14 17:49 . 2010-12-14 18:03	--------	d-----w-	c:\programdata\PC Tools
2010-12-14 16:16 . 2010-11-10 04:33	6273872	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{CC8567A1-BA5F-4560-B324-B7D224DBD8A1}\mpengine.dll
2010-12-12 19:55 . 2010-12-12 19:55	--------	d-----w-	c:\users\Jascha\AppData\Roaming\UAs
2010-12-12 16:55 . 2010-12-12 16:55	--------	d-----w-	c:\users\Jascha\AppData\Roaming\5008
2010-12-12 16:55 . 2010-12-12 16:55	112	----a-w-	c:\users\Jascha\AppData\Roaming\srvblck2.tmp
2010-12-12 16:55 . 2010-12-12 19:55	--------	d-----w-	c:\users\Jascha\AppData\Roaming\xmldm
2010-12-06 09:20 . 2010-12-06 09:21	--------	d-----w-	c:\users\Jascha\AppData\Roaming\vlc
2010-12-06 09:20 . 2010-12-06 09:20	--------	d-----w-	c:\users\Jascha\AppData\Roaming\DVDVideoSoftIEHelpers
2010-12-06 09:20 . 2010-12-06 09:20	--------	d-----w-	c:\program files\Common Files\DVDVideoSoft
2010-12-06 09:19 . 2010-12-06 09:19	--------	d-----w-	c:\program files\VideoLAN
2010-11-28 15:20 . 2006-12-08 11:02	251672	----a-w-	c:\windows\system32\xactengine2_5.dll
2010-11-28 15:20 . 2006-09-28 15:05	237848	----a-w-	c:\windows\system32\xactengine2_4.dll
2010-11-28 15:20 . 2006-09-28 15:05	2414360	----a-w-	c:\windows\system32\d3dx9_31.dll
2010-11-28 15:20 . 2006-07-28 08:30	236824	----a-w-	c:\windows\system32\xactengine2_3.dll
2010-11-28 15:20 . 2006-07-28 08:30	62744	----a-w-	c:\windows\system32\xinput1_2.dll
2010-11-28 15:19 . 2005-05-26 14:34	2297552	----a-w-	c:\windows\system32\d3dx9_26.dll
2010-11-28 15:19 . 2010-11-28 15:19	--------	d-----w-	c:\program files\Konami
2010-11-21 15:03 . 2010-11-21 15:03	--------	d-----w-	c:\programdata\NVIDIA Corporation

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 09:41 . 2009-10-03 09:20	222080	------w-	c:\windows\system32\MpSigStub.exe
2010-10-16 18:55 . 2010-11-21 15:02	10920	----a-w-	c:\windows\system32\drivers\nvBridge.kmd
2010-10-16 18:55 . 2008-07-26 17:35	10023528	----a-w-	c:\windows\system32\nvd3dum.dll
2010-10-16 18:55 . 2008-07-26 17:35	1719912	----a-w-	c:\windows\system32\nvapi.dll
2010-10-16 11:42 . 2010-10-16 11:42	600680	----a-w-	c:\windows\system32\nvvsvc.exe
2010-10-16 11:42 . 2010-10-16 11:42	1881704	----a-w-	c:\windows\system32\nvsvcr.dll
2010-10-16 11:42 . 2010-10-16 11:42	110696	----a-w-	c:\windows\system32\nvmctray.dll
2010-10-16 11:42 . 2010-10-16 11:42	3420776	----a-w-	c:\windows\system32\nvcpl.dll
2010-10-16 11:42 . 2010-10-16 11:42	2079336	----a-w-	c:\windows\system32\nvsvc.dll
2009-05-01 21:02 . 2009-05-01 21:02	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-08-24 247144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-07 1029416]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-21 178712]
"IaNvSrv"="c:\program files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2008-05-17 33304]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-03 959976]
"NetFxUpdate_v1.1.4322"="c:\windows\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe" [2004-08-10 106496]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
backup=c:\windows\pss\Bluetooth.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGSR]
%ProgramFiles%\LG Software\LG Smart Recovery\MUITransfer\MUIStartMenu.exe %ProgramFiles%\LG Software\LG Smart Recovery UpdateWithCreateOnce Software\CyberLink\PowerRecover [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 15:10	35696	----a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2010-06-15 11:37	47408	----a-w-	c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
2010-05-16 21:09	323392	----a-w-	c:\users\Jascha\Program Files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-10-30 11:57	369200	----a-w-	c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-06-15 14:33	141624	----a-w-	c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KeybdUtility]
2008-06-09 20:17	2867200	----a-w-	c:\program files\LG Software\LG OSD\HotKey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LG Intelligent Update]
2009-06-20 09:00	304432	----a-w-	c:\program files\lg_swupdate\GiljabiStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2010-03-25 08:22	1820040	----a-w-	c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2010-10-16 11:42	110696	----a-w-	c:\windows\System32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-17 19:53	421888	----a-w-	c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2008-04-17 18:50	6111232	----a-w-	c:\windows\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-11-21 01:15	1826816	----a-w-	c:\windows\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-08-28 11:11	1242448	----a-w-	c:\program files\Steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-06-20 21:05	202256	----a-w-	c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]
2007-09-14 00:32	222504	------w-	c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

R3 WSVD;WSVD;c:\windows\system32\drivers\WSVD.sys [2008-03-26 81192]
R4 gupdate1c9f986681c2678;Google Update Service (gupdate1c9f986681c2678);c:\program files\Google\Update\GoogleUpdate.exe [2009-06-30 133104]
R4 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2010-03-25 1107336]
S0 iaNvStor;Intel(R) Turbo Memory Controller;c:\windows\system32\DRIVERS\iaNvStor.sys [2008-05-09 226328]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-03-29 691696]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2010-06-02 246520]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2010-08-24 92008]
S3 NETw5v32;Intel(R) Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit ;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-04-27 3658752]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2010-09-07 123496]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork	REG_MULTI_SZ   	PLA DPS BFE mpssvc
bthsvcs	REG_MULTI_SZ   	BthServ
.
Inhalt des "geplante Tasks" Ordners

2010-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-30 13:25]

2010-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-30 13:25]
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\users\Jascha\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - 
FF - ProfilePath - c:\users\Jascha\AppData\Roaming\Mozilla\Firefox\Profiles\93iqnbt8.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (de)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.6&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Skype extension for Firefox: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: JavaString Helper: {ED0CF0C8-62F1-4865-A3FD-2E2A2B50FAFA} - c:\users\Jascha\AppData\Roaming\5008
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: JavaString Helper: {ED0CF0C8-62F1-4865-A3FD-2E2A2B50FAFA} - c:\users\Jascha\AppData\Roaming\5008
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKCU-Run-{1339A127-754D-82F5-9F20-ED8846849CC4} - c:\users\Jascha\AppData\Roaming\Cyovuq\dukiy.exe
MSConfigStartUp-LG Magnifier - %ProgramFiles%\LG Software\LG Magnifier\MagnifyingGlass.exe
MSConfigStartUp-userinit - c:\users\Jascha\AppData\Roaming\sdra64.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-12-14 20:28
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteinträge... 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{00bdce56-32d5-4e55-be59-8950f88c2e18}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:0e00238b
"Dhcpv6State"=dword:00000000
"NameServer"=""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{2805e90c-341c-495d-8d89-0c1a790bfd7c}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:06001422
"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{352ca9d1-bdd3-4248-a512-f2db1b251a95}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:140016ea
"Dhcpv6State"=dword:00000000
"NameServer"=""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{5dd8700a-8cec-4993-a623-2931aa266c25}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:12000000
"Dhcpv6State"=dword:00000000
"NameServer"=""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{63c6161c-b636-4767-b403-9c7c8c8f1137}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:0c001143
"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{883622a3-ea6c-4a3d-9ab3-f21c603ed78f}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:11000df0
"Dhcpv6State"=dword:00000000
"NameServer"=""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{8c114073-53fb-4ca3-8f49-36a8ab3a4f19}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:18020054
"Dhcpv6State"=dword:00000000
"NameServer"=""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{ab4d0a4e-1c0f-4463-b800-d63a20244a13}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:0f001b24
"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{d49b0fb5-de02-4e28-ae91-94565eaf16b8}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:0e001143
"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{f8b9ab0c-f9e8-47f4-ba0b-9ddcc01bffb2}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:07001422
"Dhcpv6State"=dword:00000000
.
Zeit der Fertigstellung: 2010-12-14  20:29:32
ComboFix-quarantined-files.txt  2010-12-14 19:29

Vor Suchlauf: 12 Verzeichnis(se), 20.407.664.640 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 20.132.179.968 Bytes frei

- - End Of File - - 2B32315CA43C9267F428F3F98A3D7455
         

--- --- ---

ok, du solltest jetzt daten sichern.
wie der pc dann zu formatieren /abzusichern ist, sage ich dir, falls gewünscht. damit du das nächste mal besser geschützt bist.

ok, kannst du mir aber bitte vorher sagen wo genau das problem noch liegt? weil ich im moment nicht mehr falsch umgeleitet werde...

das problem ist, solche trojaner können für uns nicht mehr nachvollziehbare enderungen vor nehmen, die zb ne wiederinfektion erleichtern etc.
und beim nächsten mal fällts vllt nicht auf :-)
du has damit kein vertrauenswürdiges system, und solltest daher, wie gesagt, neu machen.