Trojaner-Board - Post_Label_N2420US und Win32:Downloader-LWR

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Post_Label_N2420US und Win32:Downloader-LWR (https://www.trojaner-board.de/106745-post_label_n2420us-win32-downloader-lwr.html)

Post_Label_N2420US und Win32:Downloader-LWR

Ich habe dummerweise heute auf einen Anhang getippt, der von information@dhl-usa.com kam, getippt:
Der Avast-Scanner hat gottseidank vorgeschlagen, die exe nur in der Sandbox zu öffnen und gemeldet, dass ein Virus gefunden, aber unschädlcih gemacht worden sei.
Sicherheitshalber habe ich Malwarebytes laufen lassen - nichts gefunden.
Aber AVAST hat im Modus "Startzeitüberprüfung" den Virus "Win32:Downloader-FWR" reichlich gefunden und in Quarantäne genommen.

Aber ist das System nun sauber? Schaut doch mal bitte!

Code:

OTL logfile created on: 22.12.2011 15:35:23 - Run 3

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\a\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,25 Gb Total Physical Memory | 2,20 Gb Available Physical Memory | 67,87% Memory free

6,71 Gb Paging File | 5,73 Gb Available in Paging File | 85,40% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 911,50 Gb Total Space | 649,66 Gb Free Space | 71,27% Space Free | Partition Type: NTFS

Drive D: | 20,00 Gb Total Space | 8,33 Gb Free Space | 41,64% Space Free | Partition Type: FAT32

 

Computer Name: A-PC | User Name: a | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.12.22 15:23:51 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\a\Desktop\OTL.exe

PRC - [2011.11.28 19:01:24 | 003,744,552 | ---- | M] (AVAST Software) -- C:\Programme\Alwil Software\Avast5\AvastUI.exe

PRC - [2011.11.28 19:01:23 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe

PRC - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2009.06.30 16:20:08 | 000,339,968 | ---- | M] () -- C:\Windows\tsnpstd3.exe

PRC - [2009.04.10 22:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009.04.10 22:27:30 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe

PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe

PRC - [2008.10.14 01:52:50 | 000,376,937 | ---- | M] () -- C:\Programme\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe

PRC - [2008.10.14 01:52:50 | 000,184,423 | ---- | M] () -- C:\Programme\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe

PRC - [2008.01.21 03:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2008.01.21 03:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe

PRC - [2007.10.09 00:19:22 | 000,358,936 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe

PRC - [2007.10.09 00:19:20 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe

PRC - [2007.06.05 12:20:32 | 000,177,704 | ---- | M] () -- C:\Windows\System32\PSIService.exe

PRC - [2007.05.10 13:18:26 | 000,835,584 | ---- | M] () -- C:\Windows\vsnpstd3.exe

PRC - [2006.09.20 07:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

PRC - [2006.09.19 15:05:32 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe

PRC - [2005.01.27 20:48:34 | 000,057,344 | ---- | M] (KYOCERA MITA Corporation) -- C:\Programme\Kyocera\FS-720 Utilities\KMGLNC.exe

PRC - [2001.11.12 12:31:48 | 000,020,480 | ---- | M] (X10) -- C:\Programme\Common Files\X10\Common\X10nets.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2009.06.30 16:20:08 | 000,339,968 | ---- | M] () -- C:\Windows\tsnpstd3.exe

MOD - [2007.05.10 13:18:26 | 000,835,584 | ---- | M] () -- C:\Windows\vsnpstd3.exe

MOD - [2006.09.20 07:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

MOD - [2006.09.19 15:05:32 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.11.28 19:01:23 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)

SRV - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)

SRV - [2008.10.14 01:52:50 | 000,376,937 | ---- | M] () [Auto | Running] -- C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe -- (TVECapSvc) TVEnhance Background Capture Service (TBCS)

SRV - [2008.10.14 01:52:50 | 000,184,423 | ---- | M] () [Auto | Running] -- C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe -- (TVESched) TVEnhance Task Scheduler (TTS))

SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.10.09 00:19:22 | 000,358,936 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)

SRV - [2007.06.05 12:20:32 | 000,177,704 | ---- | M] () [Auto | Running] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing)

SRV - [2001.11.12 12:31:48 | 000,020,480 | ---- | M] (X10) [Auto | Running] -- C:\Programme\Common Files\X10\Common\X10nets.exe -- (x10nets)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.11.28 18:53:53 | 000,435,032 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)

DRV - [2011.11.28 18:53:35 | 000,314,456 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)

DRV - [2011.11.28 18:52:19 | 000,034,392 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)

DRV - [2011.11.28 18:52:16 | 000,052,952 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)

DRV - [2011.11.28 18:52:07 | 000,055,128 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)

DRV - [2011.11.28 18:51:50 | 000,020,568 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)

DRV - [2009.07.03 09:15:12 | 010,526,464 | ---- | M] (Sonix Co. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snpstd3.sys -- (SNPSTD3) USB PC Camera (SNPSTD3)

DRV - [2008.09.25 14:28:06 | 001,332,576 | ---- | M] (NXP Semiconductors Germany GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NxpCap.sys -- (NxpCap)

DRV - [2008.09.22 19:10:00 | 007,400,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2008.08.21 10:57:22 | 000,645,120 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netr28u.sys -- (netr28u)

DRV - [2008.01.21 03:23:25 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)

DRV - [2006.11.30 14:18:18 | 000,027,416 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10ufx2.sys -- (XUIF)

DRV - [2006.11.17 09:31:04 | 000,013,976 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10hid.sys -- (X10Hid)

DRV - [2006.11.07 01:00:00 | 000,014,976 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avmunet.sys -- (AVMUNET)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Program Files\Picasa2\npPicasa2.dll File not found

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.0: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.11.09 15:23:09 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.09.16 15:04:04 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.10.03 18:42:45 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

 

[2010.03.02 15:03:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\a\AppData\Roaming\mozilla\Extensions

[2010.03.02 15:03:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\a\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2011.12.15 13:59:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions

[2009.09.24 15:43:56 | 000,000,000 | ---D | M] (Nuke Anything Enhanced) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\{1ced4832-f06e-413f-aa14-9eb63ad40ace}

[2010.04.27 14:45:08 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.02.04 12:01:16 | 000,000,000 | ---D | M] (PDF Download) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}

[2008.12.13 17:52:56 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(2)

[2011.01.02 17:07:03 | 000,000,000 | ---D | M] (Context Search) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\{902D2C4A-457A-4EF9-AD43-7014562929FF}

[2011.11.10 17:14:29 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2010.11.18 16:52:06 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\de-DE@dictionaries.addons.mozilla.org

[2011.11.16 11:08:32 | 000,000,000 | ---D | M] (HTTPS-Everywhere) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\https-everywhere@eff.org

[2010.11.04 13:53:01 | 000,000,000 | ---D | M] (QuickStores-Toolbar) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\quickstores@quickstores.de

[2011.11.09 15:23:13 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2011.11.04 11:53:42 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2011.09.16 15:57:28 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}

[2011.10.24 20:14:53 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}

[2010.08.01 13:49:17 | 000,000,000 | ---D | M] (QuickStores-Toolbar) -- C:\Programme\Mozilla Firefox\extensions\quickstores@quickstores.de

[2011.11.09 15:23:09 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2011.07.08 20:08:24 | 000,167,704 | ---- | M] (Tracker Software Products Ltd.) -- C:\Program Files\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll

[2011.10.03 11:37:26 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.10.03 11:37:26 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2011.10.03 11:37:26 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2011.10.03 11:37:26 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.10.03 11:37:26 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.10.03 11:37:26 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2011.09.14 16:30:36 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Programme\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)

O2 - BHO: (T3ToolbarHelper Class) - {164E93C4-09BF-4647-9E0B-D5FBB1D35E63} - C:\Programme\Das Örtliche Toolbar\DasOertlicheToolbar.dll ()

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O3 - HKLM\..\Toolbar: (DasÖrtliche Toolbar) - {6E5B18CB-0EB6-4461-88B8-33B4683613D5} - C:\Programme\Das Örtliche Toolbar\DasOertlicheToolbar.dll ()

O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll ()

O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll ()

O4 - HKLM..\Run: [avast] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)

O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)

O4 - HKLM..\Run: [Launcher] C:\Programme\Kyocera\FS-720 Utilities\KMGLNC.exe (KYOCERA MITA Corporation)

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [snpstd3] C:\Windows\vsnpstd3.exe ()

O4 - HKLM..\Run: [tsnpstd3] C:\Windows\tsnpstd3.exe ()

O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()

O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : In Windows Live Writer in &Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3C8ED1F3-C984-4D61-A8E2-D71FD759C5F5}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AB6241D3-9F10-462A-85BB-34F3A7719B35}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BFE0E0CB-E7E0-4248-AF95-3F2A8DBC94A4}: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) -  File not found

O24 - Desktop WallPaper: 

O24 - Desktop BackupWallPaper: 

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpReg: Ad-Watch - hkey= - key= -  File not found

MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

MsConfig - StartUpReg: Google EULA Launcher - hkey= - key= - C:\Program Files\Google\Google EULA\GoogleEULALauncher.exe (Google)

MsConfig - StartUpReg: IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - hkey= - key= - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)

MsConfig - StartUpReg: NBKeyScan - hkey= - key= - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)

MsConfig - StartUpReg: OpwareSE4 - hkey= - key= - C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.)

MsConfig - StartUpReg: Skytel - hkey= - key= -  File not found

MsConfig - StartUpReg: SSBkgdUpdate - hkey= - key= - C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)

MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

MsConfig - StartUpReg: SUPERAntiSpyware - hkey= - key= -  File not found

MsConfig - StartUpReg: swg - hkey= - key= - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)

MsConfig - StartUpReg: TVEService - hkey= - key= - C:\Program Files\HomeCinema\TV Enhance\TVEService.exe (CyberLink Corp.)

MsConfig - State: "startup" - 2

MsConfig - State: "bootini" - 0

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.12.22 15:23:49 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\a\Desktop\OTL.exe

[2011.12.22 12:05:39 | 000,000,000 | ---D | C] -- C:\Users\a\Desktop\Post_Label_N2420US

[2011.11.24 17:11:03 | 003,511,776 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup312.exe

[2011.11.13 12:39:01 | 051,566,481 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Program Files\32bit_Vista_Win7_R266.exe

[2011.09.29 21:56:24 | 003,495,424 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup311.exe

[2011.09.17 14:22:37 | 003,127,456 | ---- | C] (Adobe Systems, Inc.) -- C:\Program Files\install_flash_player_ax.exe

[2011.09.16 15:55:44 | 000,908,576 | ---- | C] (Sun Microsystems, Inc.) -- C:\Program Files\jxpiinstall.exe

[2011.09.15 14:22:37 | 012,570,736 | ---- | C] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware.exe

[2011.09.13 14:39:32 | 002,322,184 | ---- | C] (ESET) -- C:\Program Files\esetsmartinstaller_enu.exe

[2011.09.13 13:00:10 | 009,466,208 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Program Files\mbam-setup-1.51.1.1800.exe

[2011.05.30 15:17:28 | 003,096,424 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup307.exe

[2011.04.23 12:59:39 | 000,568,648 | ---- | C] (Google Inc.) -- C:\Program Files\GoogleEarthSetup.exe

[2011.04.04 18:24:26 | 003,050,664 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup305.exe

[2011.03.20 15:06:40 | 000,772,384 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Mats_Run.performance.exe

[2011.03.20 15:05:43 | 000,772,896 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Mats_Run.printing.exe

[2011.03.18 12:52:24 | 006,277,496 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Silverlight.exe

[2011.01.26 17:52:49 | 003,006,368 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup303.exe

[2011.01.06 16:49:33 | 038,147,376 | ---- | C] (Apple Inc.) -- C:\Program Files\QuickTimeInstaller.exe

[2010.12.30 16:03:35 | 004,044,900 | ---- | C] ((c) 2006-2008, Tom Thielicke                                ) -- C:\Program Files\tipp10_win_v2-0-3.exe

[2010.12.20 12:43:43 | 004,750,496 | ---- | C] (Adobe Systems Inc.) -- C:\Program Files\Shockwave_Installer_Slim.exe

[2010.10.14 20:42:28 | 004,229,377 | ---- | C] (www.orbitdownloader.com                                     ) -- C:\Program Files\OrbitSetup4.0.3.exe

[2010.08.10 15:04:16 | 128,750,008 | ---- | C] (Lavasoft                                                                                                                                                                                                                                                                                                    ) -- C:\Program Files\Ad-AwareInstall.exe

[2010.05.03 12:02:38 | 005,461,276 | ---- | C] (Igor Pavlov) -- C:\Program Files\TMViewerSetup.exe

[2010.04.07 13:40:38 | 003,376,656 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup230.exe

[2010.03.02 13:31:34 | 008,853,856 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 3.0.3.exe

[2010.01.31 14:22:17 | 000,163,840 | ---- | C] ( ) -- C:\Windows\System32\rsnpstd3.dll

[2010.01.31 14:22:17 | 000,061,440 | ---- | C] ( ) -- C:\Windows\System32\vsnpstd3.dll

[2010.01.31 14:22:17 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\csnpstd3.dll

[2010.01.31 14:22:17 | 000,053,248 | ---- | C] ( ) -- C:\Windows\csnpstd3.dll

[2010.01.29 18:37:52 | 003,370,400 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup228.exe

[2010.01.28 18:18:12 | 002,572,472 | ---- | C] (www.orbitdownloader.com                                     ) -- C:\Program Files\OrbitDownloaderSetup.exe

[2009.12.02 13:06:33 | 001,128,916 | ---- | C] (www.hellopdf.com                                            ) -- C:\Program Files\pdf2wordsetup.exe

[2009.11.29 21:12:00 | 012,543,460 | ---- | C] (Andrea Vacondio) -- C:\Program Files\pdfsam-win32inst-v2_0_0.exe

[2009.10.26 14:44:08 | 077,086,488 | ---- | C] (Lavasoft                                                                                                                                                                                                                                                                                                    ) -- C:\Program Files\Ad-AwareInstallation.exe

[2009.10.14 13:26:51 | 003,309,072 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup224.exe

[2009.05.15 12:43:03 | 003,227,248 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup219.exe

[2009.05.01 10:28:15 | 218,474,518 | ---- | C] (Igor Pavlov) -- C:\Program Files\OOO31CBE.exe

[2009.04.27 14:16:35 | 003,190,688 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup218.exe

[2009.04.21 13:16:06 | 034,543,112 | ---- | C] (Lavasoft                                                                                                                                                                                                                                                                                                    ) -- C:\Program Files\Ad-AwareAE.exe

[2009.02.19 17:59:10 | 016,409,960 | ---- | C] (Safer Networking Limited                                    ) -- C:\Program Files\spybotsd162.exe

[2008.12.31 15:43:22 | 001,018,074 | ---- | C] (Heinzle Christof) -- C:\Program Files\lameplugin.exe

[2008.12.31 15:11:25 | 015,083,520 | ---- | C] (Safer Networking Limited                                    ) -- C:\Program Files\spybotsd160.exe

[2008.12.31 14:51:14 | 003,165,824 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup215.exe

[2008.12.30 14:12:28 | 002,170,309 | ---- | C] (Free Software Foundation) -- C:\Program Files\gnupg-w32cli-1.4.9.exe

[2008.12.29 18:36:10 | 002,188,592 | ---- | C] (www.orbitdownloader.com                                     ) -- C:\Program Files\OrbitDownloader281Setup.exe

[2008.12.13 21:19:13 | 006,557,639 | ---- | C] (Thorsten Fritz                                              ) -- C:\Program Files\kompozer-0.77.de-DE.win32.installer.exe

[2008.12.13 21:19:04 | 000,735,964 | ---- | C] (GegenStandpunkt Verlag, München) -- C:\Program Files\GS_Index_20071215.exe

[2008.12.13 21:19:02 | 004,986,208 | ---- | C] (InstallShield Software Corporation) -- C:\Program Files\cibpdfplugin.exe

[2008.12.13 21:19:01 | 012,785,408 | ---- | C] (InstallShield Software Corporation) -- C:\Program Files\cibpdfbrewer.exe

[2008.12.13 21:18:51 | 002,955,128 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup213.exe

[2002.03.11 10:06:30 | 001,822,520 | ---- | C] (Microsoft Corporation) -- C:\Program Files\instmsiw.exe

[2002.03.11 09:45:04 | 001,708,856 | ---- | C] (Microsoft Corporation) -- C:\Program Files\instmsia.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.12.22 15:40:00 | 000,000,438 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{103B65BD-4798-4CA0-9487-EB211B637804}.job

[2011.12.22 15:24:47 | 000,302,592 | ---- | M] () -- C:\Users\a\Desktop\07oe12o9.exe

[2011.12.22 15:23:51 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\a\Desktop\OTL.exe

[2011.12.22 15:23:27 | 000,050,477 | ---- | M] () -- C:\Users\a\Desktop\Defogger.exe

[2011.12.22 15:18:14 | 000,001,088 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2011.12.22 15:18:00 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.12.22 15:18:00 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.12.22 15:18:00 | 000,126,248 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.12.22 15:18:00 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.12.22 15:14:11 | 000,001,084 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2011.12.22 15:13:38 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2011.12.22 15:13:38 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2011.12.22 15:13:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.12.22 13:27:05 | 3487,748,096 | -HS- | M] () -- C:\hiberfil.sys

[2011.12.19 17:12:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job

[2011.12.19 17:03:05 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt

[2011.12.19 15:39:31 | 000,033,185 | ---- | M] () -- C:\Users\a\Desktop\Manroland Insolvenz Gliederung.odt

[2011.12.14 14:12:23 | 000,347,560 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2011.12.13 18:05:51 | 000,042,736 | ---- | M] () -- C:\Users\a\Desktop\RG-3-11-24421.pdf

[2011.11.28 19:01:25 | 000,041,184 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr

[2011.11.28 19:01:23 | 000,199,816 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe

[2011.11.28 18:53:53 | 000,435,032 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys

[2011.11.28 18:53:35 | 000,314,456 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys

[2011.11.28 18:52:19 | 000,034,392 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys

[2011.11.28 18:52:16 | 000,052,952 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys

[2011.11.28 18:52:07 | 000,055,128 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys

[2011.11.28 18:51:50 | 000,020,568 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys

[2011.11.26 21:33:38 | 000,018,944 | ---- | M] () -- C:\Users\a\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.11.24 17:11:59 | 000,000,808 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.11.24 17:11:06 | 003,511,776 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup312.exe

 
 ========== Files Created - No Company Name ==========

 

[2011.12.22 15:24:46 | 000,302,592 | ---- | C] () -- C:\Users\a\Desktop\07oe12o9.exe

[2011.12.22 15:23:26 | 000,050,477 | ---- | C] () -- C:\Users\a\Desktop\Defogger.exe

[2011.12.22 13:24:48 | 3487,748,096 | -HS- | C] () -- C:\hiberfil.sys

[2011.12.19 15:39:31 | 000,033,185 | ---- | C] () -- C:\Users\a\Desktop\Manroland Insolvenz Gliederung.odt

[2011.12.13 18:05:50 | 000,042,736 | ---- | C] () -- C:\Users\a\Desktop\RG-3-11-24421.pdf

[2011.11.17 16:56:06 | 002,448,704 | ---- | C] () -- C:\Program Files\mp3tagv249asetup.exe

[2011.11.13 18:51:03 | 199,812,300 | ---- | C] () -- C:\Program Files\LibO_3.4.4_Win_x86_install_multi.exe

[2011.11.13 13:04:07 | 000,150,996 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT

[2011.11.12 16:48:12 | 044,579,152 | ---- | C] () -- C:\Program Files\calibre-0.8.26.msi

[2011.11.07 22:12:11 | 044,517,200 | ---- | C] () -- C:\Program Files\calibre-0.8.25.msi

[2011.09.29 21:37:03 | 000,158,832 | ---- | C] () -- C:\Program Files\1by1_175.exe

[2011.09.16 14:44:33 | 018,702,336 | ---- | C] () -- C:\Program Files\PXCViewer_x86.msi

[2011.09.16 14:43:36 | 000,071,361 | ---- | C] () -- C:\Program Files\javarasource.zip

[2011.09.12 16:07:55 | 010,268,672 | ---- | C] () -- C:\Program Files\Ad-Aware95Install.msi

[2011.08.13 12:33:54 | 000,000,064 | ---- | C] () -- C:\Windows\System32\rp_stats.dat

[2011.08.13 12:33:54 | 000,000,044 | ---- | C] () -- C:\Windows\System32\rp_rules.dat

[2011.08.03 17:11:00 | 021,073,936 | ---- | C] () -- C:\Program Files\vlc-1.1.11-win32.exe

[2011.07.29 15:37:17 | 002,448,352 | ---- | C] () -- C:\Program Files\mp3tagv249setup.exe

[2011.06.28 14:09:07 | 021,022,914 | ---- | C] () -- C:\Program Files\vlc-1.1.10-win32.exe

[2011.05.30 21:08:50 | 000,001,940 | ---- | C] () -- C:\Program Files\HiJackThis.lnk

[2011.05.30 21:07:51 | 001,402,880 | ---- | C] () -- C:\Program Files\HiJackThis.msi

[2011.04.28 15:07:16 | 002,446,680 | ---- | C] () -- C:\Program Files\mp3tagv248setup.exe

[2011.04.26 17:03:55 | 020,533,281 | ---- | C] () -- C:\Program Files\vlc-1.1.9-win32.exe

[2011.04.04 16:08:58 | 000,247,053 | ---- | C] () -- C:\Program Files\mp3DC213.exe

[2011.03.31 12:08:00 | 020,586,196 | ---- | C] () -- C:\Program Files\vlc-1.1.8-win32.exe

[2011.03.18 12:56:26 | 020,364,702 | ---- | C] () -- C:\Program Files\vlc-1.1.7-win32.exe

[2011.03.14 18:59:08 | 004,437,496 | ---- | C] () -- C:\Program Files\Songr_1_9_17.zip

[2011.02.20 16:36:14 | 168,166,968 | ---- | C] () -- C:\Program Files\OOo_3.3.0_Win_x86_install-wJRE_de.exe

[2010.12.22 22:45:41 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI

[2010.12.09 16:21:36 | 019,985,265 | ---- | C] () -- C:\Program Files\vlc-1.1.5-win32.exe

[2010.10.26 16:08:18 | 000,226,402 | ---- | C] () -- C:\Program Files\mp3DC212.exe

[2010.10.14 20:43:16 | 000,008,619 | ---- | C] () -- C:\Program Files\obdeu.zip

[2010.08.28 11:44:33 | 019,657,194 | ---- | C] () -- C:\Program Files\vlc-1.1.4-win32.exe

[2010.08.20 13:23:40 | 019,563,096 | ---- | C] () -- C:\Program Files\vlc-1.1.3-win32.exe

[2010.08.08 13:51:33 | 000,058,984 | ---- | C] () -- C:\Program Files\225p1es_00_dwv_eng.zip

[2010.08.02 13:14:46 | 019,461,015 | ---- | C] () -- C:\Program Files\vlc-1.1.2-win32.exe

[2010.08.01 13:43:51 | 001,295,402 | ---- | C] () -- C:\Program Files\ag_mp3_plugin_setup.exe

[2010.07.27 13:10:19 | 151,343,200 | ---- | C] () -- C:\Program Files\OOo_3.2.1_Win_x86_install_de.exe

[2010.05.25 19:43:14 | 003,099,136 | ---- | C] () -- C:\Program Files\openofficeorg32.msi

[2010.05.25 19:40:04 | 145,988,770 | ---- | C] () -- C:\Program Files\openofficeorg1.cab

[2010.05.25 18:46:20 | 000,000,290 | ---- | C] () -- C:\Program Files\setup.ini

[2010.05.20 14:50:50 | 000,150,358 | ---- | C] () -- C:\Program Files\1by1_169.exe

[2010.05.03 12:26:03 | 000,068,640 | ---- | C] () -- C:\Windows\unTMV.exe

[2010.04.08 16:00:16 | 002,439,075 | ---- | C] () -- C:\Program Files\fc_setup_ (2).zip

[2010.03.04 16:10:43 | 167,555,440 | ---- | C] () -- C:\Program Files\OOo_3.2.0_Win32Intel_install_wJRE_de.exe

[2010.03.02 15:44:27 | 002,024,035 | ---- | C] () -- C:\Program Files\Firesave.exe

[2010.03.02 13:48:37 | 001,222,286 | ---- | C] () -- C:\Program Files\enigmail-1.0.1-tb-win.xpi

[2010.03.02 13:20:10 | 000,000,213 | ---- | C] () -- C:\Program Files\PFADE.ini

[2010.03.02 13:06:40 | 001,772,267 | ---- | C] () -- C:\Program Files\Thundersave_1.0.exe

[2010.02.19 13:40:40 | 044,518,776 | ---- | C] () -- C:\Program Files\setup_av_free_2_.exe

[2010.02.06 15:06:34 | 018,499,623 | ---- | C] () -- C:\Program Files\vlc-1.0.5-win32.exe

[2010.01.31 14:22:18 | 000,835,584 | ---- | C] () -- C:\Windows\vsnpstd3.exe

[2010.01.31 14:22:18 | 000,339,968 | ---- | C] () -- C:\Windows\tsnpstd3.exe

[2010.01.31 14:22:17 | 000,015,498 | ---- | C] () -- C:\Windows\snpstd3.ini

[2010.01.28 18:53:14 | 000,127,083 | ---- | C] () -- C:\Program Files\1by1_168.exe

[2009.11.29 21:05:33 | 001,137,763 | ---- | C] () -- C:\Program Files\sun-pdfimport10.zip

[2009.10.07 12:45:28 | 149,845,064 | ---- | C] () -- C:\Program Files\OOo_3.1.1_Win32Intel_install_de.exe

[2009.07.11 13:35:13 | 017,828,326 | ---- | C] () -- C:\Program Files\vlc-1.0.0-win32.exe

[2009.06.26 16:59:35 | 000,728,103 | ---- | C] () -- C:\Program Files\VAL v1.1.1 Setup.exe

[2009.05.26 17:53:38 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009.05.26 17:52:24 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009.05.08 22:15:49 | 016,742,799 | ---- | C] () -- C:\Program Files\vlc-0.9.9-win32.exe

[2009.05.07 14:31:52 | 147,695,064 | ---- | C] () -- C:\Program Files\OOo_3.1.0_Win32Intel_install_de.exe

[2009.05.05 15:01:41 | 000,212,713 | ---- | C] () -- C:\Program Files\mp3DC211.exe

[2009.05.05 14:59:51 | 000,121,784 | ---- | C] () -- C:\Program Files\1by1_167.exe

[2009.04.27 11:03:46 | 009,818,624 | ---- | C] () -- C:\Program Files\openofficeorg31.msi

[2009.04.16 14:33:14 | 000,049,230 | ---- | C] () -- C:\Program Files\download_manager_tweak-0.7.2-fx.xpi

[2009.04.09 18:58:43 | 001,300,755 | ---- | C] () -- C:\Program Files\KKiller_v3.4.4.zip

[2009.02.26 17:29:19 | 000,037,658 | ---- | C] () -- C:\Program Files\duplicate_contact_manager-0.6-tb.xpi

[2009.01.27 19:28:46 | 000,111,016 | ---- | C] () -- C:\Program Files\image_zoom-0.3.1-fx+mz+tb+sm.xpi

[2009.01.10 20:37:39 | 156,172,680 | ---- | C] () -- C:\Program Files\ooo300.exe

[2009.01.04 18:29:10 | 000,938,576 | ---- | C] () -- C:\Program Files\7z463.exe

[2009.01.02 16:05:44 | 016,320,472 | ---- | C] () -- C:\Program Files\vlc-0.9.8a-win32.exe

[2008.12.31 17:34:50 | 007,949,158 | ---- | C] () -- C:\Program Files\kompozer-0.7.10-win32.zip

[2008.12.31 15:28:55 | 023,804,784 | ---- | C] () -- C:\Program Files\aaw2008_11n.exe

[2008.12.31 15:03:51 | 000,018,944 | ---- | C] () -- C:\Users\a\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008.12.13 21:19:02 | 001,176,154 | ---- | C] () -- C:\Program Files\enigmail-0.95.6-tb+sm.xpi

[2008.12.13 21:18:50 | 000,189,429 | ---- | C] () -- C:\Program Files\mp3DC209.exe

[2008.12.13 19:35:07 | 000,000,296 | ---- | C] () -- C:\Users\a\AppData\Roaming\wklnhst.dat

[2008.12.13 17:50:37 | 000,792,771 | ---- | C] () -- C:\Program Files\MozBackup-1.4.8-DE.exe

[2008.12.13 17:29:22 | 000,040,960 | ---- | C] () -- C:\Windows\System32\IPPCPUID.DLL

[2008.12.13 17:27:40 | 000,011,776 | ---- | C] () -- C:\Windows\System32\pmsbfn32.dll

[2008.12.13 17:25:25 | 000,000,416 | ---- | C] () -- C:\Windows\MAXLINK.INI

[2008.12.13 12:59:31 | 000,007,592 | ---- | C] () -- C:\Users\a\AppData\Local\d3d9caps.dat

[2008.10.20 09:35:26 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini

[2008.10.17 16:15:05 | 000,000,917 | ---- | C] () -- C:\Windows\System32\CLWatson.ini

[2008.10.17 15:56:47 | 000,009,824 | ---- | C] () -- C:\Windows\System32\716xCoInstaller.dll

[2008.10.17 15:56:47 | 000,000,464 | ---- | C] () -- C:\Windows\11317231_000216BE_11.bin

[2008.10.17 15:56:47 | 000,000,464 | ---- | C] () -- C:\Windows\11317231_000216BE_1.bin

[2008.10.17 15:56:47 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_000116BE_1.bin

[2008.10.08 13:51:57 | 000,127,184 | ---- | C] () -- C:\Windows\Unwise.exe

[2008.10.08 12:26:22 | 000,015,312 | ---- | C] () -- C:\Windows\System32\RaCoInst.dat

[2008.10.08 12:01:08 | 000,000,023 | ---- | C] () -- C:\Windows\System32\drivers\VERSION.DAT

[2008.10.08 11:00:48 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll

[2008.06.05 07:58:26 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll

[2008.01.21 08:15:58 | 000,628,504 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2008.01.21 08:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2008.01.21 08:15:58 | 000,126,248 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2008.01.21 08:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2007.06.05 12:20:32 | 000,177,704 | ---- | C] () -- C:\Windows\System32\PSIService.exe

[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 13:47:37 | 000,347,560 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 11:33:01 | 000,595,798 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 11:33:01 | 000,103,872 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[1996.12.14 00:00:00 | 000,022,016 | ---- | C] () -- C:\Windows\System32\DOCOBJ.DLL

[1996.12.14 00:00:00 | 000,012,288 | ---- | C] () -- C:\Windows\System32\HLINKPRX.DLL

 
 ========== LOP Check ==========

 

[2010.05.21 09:59:47 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\1by1

[2011.11.07 22:15:50 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\calibre

[2008.12.23 16:51:40 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Canon

[2008.12.29 17:20:30 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\FreeCommander

[2011.04.07 17:38:22 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\gnupg

[2009.03.20 17:11:11 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\GrabPro

[2008.12.31 17:57:43 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\KompoZer

[2011.11.13 19:02:17 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\LibreOffice

[2010.10.26 23:46:17 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\mp3DirectCut

[2011.11.17 16:56:13 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Mp3tag

[2009.07.13 15:45:36 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\NewSoft

[2009.01.10 23:29:36 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\OpenOffice.org

[2011.12.11 17:59:01 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Orbit

[2010.10.14 20:44:47 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\ProgSense

[2010.08.01 13:49:17 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\QuickStoresToolbar

[2008.12.13 17:25:21 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\ScanSoft

[2008.12.11 21:45:04 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\T-Online

[2010.11.07 15:56:56 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Template

[2010.03.02 15:03:23 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Thunderbird

[2011.12.19 17:12:00 | 000,000,384 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job

[2011.12.22 13:26:10 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2011.12.22 15:40:00 | 000,000,438 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{103B65BD-4798-4CA0-9487-EB211B637804}.job

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*. >

[2011.09.14 16:30:37 | 000,000,000 | ---D | M] -- C:\$RECYCLE.BIN

[2009.05.26 18:07:36 | 000,000,000 | ---D | M] -- C:\Boot

[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2008.12.11 21:22:57 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen

[2009.04.29 12:29:33 | 000,000,000 | ---D | M] -- C:\Downloads

[2008.10.14 16:49:37 | 000,000,000 | R--D | M] -- C:\MSOCache

[2008.10.08 12:09:19 | 000,000,000 | ---D | M] -- C:\NVIDIA

[2011.11.24 17:14:45 | 000,000,000 | R--D | M] -- C:\Program Files

[2011.09.16 14:51:31 | 000,000,000 | ---D | M] -- C:\ProgramData

[2008.12.11 21:22:57 | 000,000,000 | -HSD | M] -- C:\Programme

[2011.05.26 13:36:32 | 000,000,000 | ---D | M] -- C:\rei

[2011.12.22 15:38:18 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2008.12.11 21:25:55 | 000,000,000 | R--D | M] -- C:\Users

[2011.12.22 12:14:20 | 000,000,000 | ---D | M] -- C:\Windows

[2011.09.14 10:57:37 | 000,000,000 | ---D | M] -- C:\_OTL

 
 < %PROGRAMFILES%\*.exe >

[2009.05.05 14:59:55 | 000,121,784 | ---- | M] () -- C:\Program Files\1by1_167.exe

[2010.01.28 18:53:15 | 000,127,083 | ---- | M] () -- C:\Program Files\1by1_168.exe

[2010.05.20 14:50:51 | 000,150,358 | ---- | M] () -- C:\Program Files\1by1_169.exe

[2011.09.29 21:37:05 | 000,158,832 | ---- | M] () -- C:\Program Files\1by1_175.exe

[2011.11.13 12:43:01 | 051,566,481 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Program Files\32bit_Vista_Win7_R266.exe

[2009.01.04 18:29:14 | 000,938,576 | ---- | M] () -- C:\Program Files\7z463.exe

[2008.12.31 15:30:37 | 023,804,784 | ---- | M] () -- C:\Program Files\aaw2008_11n.exe

[2009.04.21 13:18:24 | 034,543,112 | ---- | M] (Lavasoft                                                                                                                                                                                                                                                                                                    ) -- C:\Program Files\Ad-AwareAE.exe

[2010.08.10 15:13:14 | 128,750,008 | ---- | M] (Lavasoft                                                                                                                                                                                                                                                                                                    ) -- C:\Program Files\Ad-AwareInstall.exe

[2009.10.26 14:49:09 | 077,086,488 | ---- | M] (Lavasoft                                                                                                                                                                                                                                                                                                    ) -- C:\Program Files\Ad-AwareInstallation.exe

[2010.08.01 13:43:52 | 001,295,402 | ---- | M] () -- C:\Program Files\ag_mp3_plugin_setup.exe

[2008.10.29 15:55:12 | 002,955,128 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup213.exe

[2008.12.31 14:51:39 | 003,165,824 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup215.exe

[2009.04.27 14:16:42 | 003,190,688 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup218.exe

[2009.05.15 12:43:08 | 003,227,248 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup219.exe

[2009.10.14 13:26:57 | 003,309,072 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup224.exe

[2010.01.29 18:38:01 | 003,370,400 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup228.exe

[2010.04.07 13:40:48 | 003,376,656 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup230.exe

[2011.01.26 17:52:54 | 003,006,368 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup303.exe

[2011.04.04 18:24:31 | 003,050,664 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup305.exe

[2011.05.30 15:17:33 | 003,096,424 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup307.exe

[2011.09.29 21:56:25 | 003,495,424 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup311.exe

[2011.11.24 17:11:06 | 003,511,776 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup312.exe

[2006.12.13 19:53:46 | 012,785,408 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\cibpdfbrewer.exe

[2006.12.13 17:41:32 | 004,986,208 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\cibpdfplugin.exe

[2011.09.13 14:39:34 | 002,322,184 | ---- | M] (ESET) -- C:\Program Files\esetsmartinstaller_enu.exe

[2010.03.02 15:44:28 | 002,024,035 | ---- | M] () -- C:\Program Files\Firesave.exe

[2008.12.30 14:12:39 | 002,170,309 | ---- | M] (Free Software Foundation) -- C:\Program Files\gnupg-w32cli-1.4.9.exe

[2011.04.23 12:59:41 | 000,568,648 | ---- | M] (Google Inc.) -- C:\Program Files\GoogleEarthSetup.exe

[2008.02.25 17:03:56 | 000,735,964 | ---- | M] (GegenStandpunkt Verlag, München) -- C:\Program Files\GS_Index_20071215.exe

[2011.09.17 14:22:38 | 003,127,456 | ---- | M] (Adobe Systems, Inc.) -- C:\Program Files\install_flash_player_ax.exe

[2002.03.11 09:45:04 | 001,708,856 | ---- | M] (Microsoft Corporation) -- C:\Program Files\instmsia.exe

[2002.03.11 10:06:30 | 001,822,520 | ---- | M] (Microsoft Corporation) -- C:\Program Files\instmsiw.exe

[2011.09.16 15:55:46 | 000,908,576 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\jxpiinstall.exe

[2008.02.05 03:09:42 | 006,557,639 | ---- | M] (Thorsten Fritz                                              ) -- C:\Program Files\kompozer-0.77.de-DE.win32.installer.exe

[2008.12.31 15:43:22 | 001,018,074 | ---- | M] (Heinzle Christof) -- C:\Program Files\lameplugin.exe

[2011.11.13 18:53:16 | 199,812,300 | ---- | M] () -- C:\Program Files\LibO_3.4.4_Win_x86_install_multi.exe

[2011.03.20 15:06:40 | 000,772,384 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mats_Run.performance.exe

[2011.03.20 15:05:44 | 000,772,896 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mats_Run.printing.exe

[2011.09.13 13:00:12 | 009,466,208 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Program Files\mbam-setup-1.51.1.1800.exe

[2008.12.10 17:28:34 | 000,792,771 | ---- | M] () -- C:\Program Files\MozBackup-1.4.8-DE.exe

[2008.10.14 15:45:56 | 000,189,429 | ---- | M] () -- C:\Program Files\mp3DC209.exe

[2009.05.05 15:01:41 | 000,212,713 | ---- | M] () -- C:\Program Files\mp3DC211.exe

[2010.10.26 16:08:19 | 000,226,402 | ---- | M] () -- C:\Program Files\mp3DC212.exe

[2011.04.04 16:09:03 | 000,247,053 | ---- | M] () -- C:\Program Files\mp3DC213.exe

[2011.04.28 15:07:20 | 002,446,680 | ---- | M] () -- C:\Program Files\mp3tagv248setup.exe

[2011.11.17 16:56:09 | 002,448,704 | ---- | M] () -- C:\Program Files\mp3tagv249asetup.exe

[2011.07.29 15:37:22 | 002,448,352 | ---- | M] () -- C:\Program Files\mp3tagv249setup.exe

[2008.10.13 15:10:04 | 156,172,680 | ---- | M] () -- C:\Program Files\ooo300.exe

[2009.05.01 10:43:25 | 218,474,518 | ---- | M] (Igor Pavlov) -- C:\Program Files\OOO31CBE.exe

[2009.05.07 14:42:11 | 147,695,064 | ---- | M] () -- C:\Program Files\OOo_3.1.0_Win32Intel_install_de.exe

[2009.10.07 12:55:47 | 149,845,064 | ---- | M] () -- C:\Program Files\OOo_3.1.1_Win32Intel_install_de.exe

[2010.03.04 16:42:06 | 167,555,440 | ---- | M] () -- C:\Program Files\OOo_3.2.0_Win32Intel_install_wJRE_de.exe

[2010.07.27 13:20:47 | 151,343,200 | ---- | M] () -- C:\Program Files\OOo_3.2.1_Win_x86_install_de.exe

[2011.02.20 16:40:23 | 168,166,968 | ---- | M] () -- C:\Program Files\OOo_3.3.0_Win_x86_install-wJRE_de.exe

[2008.12.29 18:36:11 | 002,188,592 | ---- | M] (www.orbitdownloader.com                                     ) -- C:\Program Files\OrbitDownloader281Setup.exe

[2010.01.28 18:18:20 | 002,572,472 | ---- | M] (www.orbitdownloader.com                                     ) -- C:\Program Files\OrbitDownloaderSetup.exe

[2010.10.14 20:42:56 | 004,229,377 | ---- | M] (www.orbitdownloader.com                                     ) -- C:\Program Files\OrbitSetup4.0.3.exe

[2009.12.02 13:06:35 | 001,128,916 | ---- | M] (www.hellopdf.com                                            ) -- C:\Program Files\pdf2wordsetup.exe

[2009.11.29 21:12:45 | 012,543,460 | ---- | M] (Andrea Vacondio) -- C:\Program Files\pdfsam-win32inst-v2_0_0.exe

[2011.01.06 16:49:55 | 038,147,376 | ---- | M] (Apple Inc.) -- C:\Program Files\QuickTimeInstaller.exe

[2010.02.19 13:43:42 | 044,518,776 | ---- | M] () -- C:\Program Files\setup_av_free_2_.exe

[2010.12.20 12:43:49 | 004,750,496 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Shockwave_Installer_Slim.exe

[2011.03.18 12:52:29 | 006,277,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Silverlight.exe

[2008.12.31 15:13:21 | 015,083,520 | ---- | M] (Safer Networking Limited                                    ) -- C:\Program Files\spybotsd160.exe

[2009.02.19 18:00:19 | 016,409,960 | ---- | M] (Safer Networking Limited                                    ) -- C:\Program Files\spybotsd162.exe

[2011.09.15 14:23:12 | 012,570,736 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware.exe

[2010.03.02 13:32:21 | 008,853,856 | ---- | M] (Mozilla) -- C:\Program Files\Thunderbird Setup 3.0.3.exe

[2010.03.02 13:06:41 | 001,772,267 | ---- | M] () -- C:\Program Files\Thundersave_1.0.exe

[2010.12.30 16:04:03 | 004,044,900 | ---- | M] ((c) 2006-2008, Tom Thielicke                                ) -- C:\Program Files\tipp10_win_v2-0-3.exe

[2010.05.03 12:02:53 | 005,461,276 | ---- | M] (Igor Pavlov) -- C:\Program Files\TMViewerSetup.exe

[2009.06.26 16:59:36 | 000,728,103 | ---- | M] () -- C:\Program Files\VAL v1.1.1 Setup.exe

[2009.01.02 16:07:39 | 016,320,472 | ---- | M] () -- C:\Program Files\vlc-0.9.8a-win32.exe

[2009.05.08 22:16:48 | 016,742,799 | ---- | M] () -- C:\Program Files\vlc-0.9.9-win32.exe

[2009.07.11 13:36:28 | 017,828,326 | ---- | M] () -- C:\Program Files\vlc-1.0.0-win32.exe

[2010.02.06 15:07:49 | 018,499,623 | ---- | M] () -- C:\Program Files\vlc-1.0.5-win32.exe

[2011.06.28 14:09:21 | 021,022,914 | ---- | M] () -- C:\Program Files\vlc-1.1.10-win32.exe

[2011.08.03 17:11:14 | 021,073,936 | ---- | M] () -- C:\Program Files\vlc-1.1.11-win32.exe

[2010.08.02 13:16:06 | 019,461,015 | ---- | M] () -- C:\Program Files\vlc-1.1.2-win32.exe

[2010.08.20 13:25:01 | 019,563,096 | ---- | M] () -- C:\Program Files\vlc-1.1.3-win32.exe

[2010.08.28 11:45:53 | 019,657,194 | ---- | M] () -- C:\Program Files\vlc-1.1.4-win32.exe

[2010.12.09 16:21:50 | 019,985,265 | ---- | M] () -- C:\Program Files\vlc-1.1.5-win32.exe

[2011.03.18 12:56:34 | 020,364,702 | ---- | M] () -- C:\Program Files\vlc-1.1.7-win32.exe

[2011.03.31 12:08:14 | 020,586,196 | ---- | M] () -- C:\Program Files\vlc-1.1.8-win32.exe

[2011.04.26 17:04:49 | 020,533,281 | ---- | M] () -- C:\Program Files\vlc-1.1.9-win32.exe

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.manifest /3 >

 

 
 < MD5 for: AFD.SYS  >

[2011.04.21 14:58:27 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=3911B972B55FEA0478476B2E777B29FA -- C:\Windows\System32\drivers\afd.sys

[2011.04.21 14:58:27 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=3911B972B55FEA0478476B2E777B29FA -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18457_none_d99fb42e5bb59d9b\afd.sys

[2011.04.21 14:16:42 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=48EB99503533C27AC6135648E5474457 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18639_none_d7d0e0cc5e7d461c\afd.sys

[2011.04.21 14:28:53 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=70EE0FC7A0F384DBD929A01384AEEB4B -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.22629_none_da4bc33774b91967\afd.sys

[2008.01.21 03:24:17 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=763E172A55177E478CB419F88FD0BA03 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys

[2009.04.10 20:47:04 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=A201207363AA900ABF1A388468688570 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18005_none_d9d3bb9e5b8eea9c\afd.sys

[2011.04.21 14:12:21 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=C8AF25017CECB75906A571AC70D2D306 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.22905_none_d876efff77862705\afd.sys

 
 < MD5 for: EXPLORER.EXE  >

[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe

[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe

[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe

[2009.04.10 22:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\ERDNT\cache\explorer.exe

[2009.04.10 22:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe

[2009.04.10 22:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe

[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe

[2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

 
 < MD5 for: REGEDIT.EXE  >

[2008.01.21 03:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\ERDNT\cache\regedit.exe

[2008.01.21 03:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe

[2008.01.21 03:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe

 
 < MD5 for: USERINIT.EXE  >

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\ERDNT\cache\userinit.exe

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\ERDNT\cache\wininit.exe

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.04.10 22:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\ERDNT\cache\winlogon.exe

[2009.04.10 22:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.10 22:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-12-20 08:52:15
 

< End of report >

Hier der das defrogger-log und das von Gmer

Ich will ja nicht drängen - es ist Weihnachtszeit :heilig:
und ihr habt gewiss genug zu tun - aber ich wüsste schon gerne, ob ich nun wieder Online-Banking machen kann.
Oder soll ich einfach die Systemwiderherstellung auf den 21.12. setzen? Ein wenig unsicher finde ich das schon.
Ich habe übrigens ESET laufen lassen:

Code:

C:\Users\a\AppData\Local\temp\Temp1_Post_Label_N2420US.zip\Post_Label.exe        a variant of Win32/Kryptik.XUH trojan

C:\Users\a\Desktop\Post_Label_N2420US\Post_Label.exe        a variant of Win32/Kryptik.XUH trojan

Soll ich die erstmal löschen - oder was?

Zitat:

Sicherheitshalber habe ich Malwarebytes laufen lassen - nichts gefunden.

Logs immer posten, egal ob Fund oder kein Fund

Hier das log von Malwarebytes vom 22.12.

Code:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org
 

Datenbank Version: 911122202
 

Windows 6.0.6002 Service Pack 2 (Safe Mode)

Internet Explorer 9.0.8112.16421
 

22.12.2011 13:06:54

mbam-log-2011-12-22 (13-06-54).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)

Durchsuchte Objekte: 400154

Laufzeit: 51 Minute(n), 23 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

Der Scan von AVAST im Startmodus hat folgende Art von Dateien (10 insgesamt, es ändert sich nur die Zahl hinten) als infiziert in den Viruscontainer verschoben:

WER4643.tmp.mdmp
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Report03034836

und eine
WER5892.tmp.mdpmp
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp

Das Log von Malwarebytes von heute findet den Post-Label-Virus (auf dem Desktop ist immer noch der Ordner, in dem er drin ist)

Code:

Malwarebytes Anti-Malware 1.60.0.1800

www.malwarebytes.org
 

Datenbank Version: v2011.12.28.02
 

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

a :: A-PC [Administrator]
 

28.12.2011 17:23:42

mbam-log-2011-12-28 (17-23-42).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 179959

Laufzeit: 3 Minute(n), 29 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 1

C:\Users\a\AppData\Local\temp\Temp1_Post_Label_N2420US.zip\Post_Label.exe (Trojan.Downloader.BH) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Führ bitte auch ESET aus, danach sehen wir weiter:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

hier der ESET-Scan:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=64f3865ced9e534a86ddcac0eae771c3

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-09-13 03:16:33

# local_time=2011-09-13 05:16:33 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 79391430 79391430 0 0

# compatibility_mode=768 16777215 100 0 308782 308782 0 0

# compatibility_mode=5892 16776573 100 100 15441 153454224 0 0

# compatibility_mode=8192 67108863 100 0 306 306 0 0

# scanned=305168

# found=0

# cleaned=0

# scan_time=5496

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=64f3865ced9e534a86ddcac0eae771c3

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-09-15 10:06:15

# local_time=2011-09-16 12:06:15 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 79575671 79575671 0 0

# compatibility_mode=768 16777215 100 0 493023 493023 0 0

# compatibility_mode=5892 16776573 100 100 199682 153638465 0 0

# compatibility_mode=8192 67108863 100 0 184547 184547 0 0

# scanned=303452

# found=3

# cleaned=0

# scan_time=18638

I:\A-PC\Backup Set 2010-03-02 133326\Backup Files 2010-03-02 133326\Backup files 1.zip        multiple threats (unable to clean)        00000000000000000000000000000000        I

I:\A-PC\Backup Set 2010-11-08 151038\Backup Files 2010-11-08 151038\Backup files 1.zip        multiple threats (unable to clean)        00000000000000000000000000000000        I

I:\A-PC\Backup Set 2010-11-08 151038\Backup Files 2011-05-05 111900\Backup files 1.zip        HTML/Iframe.B.Gen virus (unable to clean)        00000000000000000000000000000000        I

ESETSmartInstaller@High as downloader log:

all ok

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=64f3865ced9e534a86ddcac0eae771c3

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-12-22 06:40:10

# local_time=2011-12-22 07:40:10 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=768 16777215 100 0 8961236 8961236 0 0

# compatibility_mode=5892 16776573 100 100 14333 162106678 0 0

# compatibility_mode=8192 67108863 100 0 8392593 8392593 0 0

# scanned=235493

# found=2

# cleaned=0

# scan_time=5259

C:\Users\a\AppData\Local\temp\Temp1_Post_Label_N2420US.zip\Post_Label.exe        a variant of Win32/Kryptik.XUH trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\a\Desktop\Post_Label_N2420US\Post_Label.exe        a variant of Win32/Kryptik.XUH trojan (unable to clean)        00000000000000000000000000000000        I

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=64f3865ced9e534a86ddcac0eae771c3

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-12-28 06:40:35

# local_time=2011-12-28 07:40:35 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=768 16777215 100 0 9479826 9479826 0 0

# compatibility_mode=5892 16776573 100 100 4936 162625268 0 0

# compatibility_mode=8192 67108863 100 0 8911183 8911183 0 0

# scanned=238531

# found=0

# cleaned=0

# scan_time=5094

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

das Ergebnis von OTE:

Code:

OTL logfile created on: 29.12.2011 01:37:59 - Run 4

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\a\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,25 Gb Total Physical Memory | 2,62 Gb Available Physical Memory | 80,58% Memory free

6,70 Gb Paging File | 5,50 Gb Available in Paging File | 82,06% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 911,50 Gb Total Space | 649,73 Gb Free Space | 71,28% Space Free | Partition Type: NTFS

Drive D: | 20,00 Gb Total Space | 8,33 Gb Free Space | 41,64% Space Free | Partition Type: FAT32

 

Computer Name: A-PC | User Name: a | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.12.22 15:23:51 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\a\Desktop\OTL.exe

PRC - [2011.11.28 19:01:24 | 003,744,552 | ---- | M] (AVAST Software) -- C:\Programme\Alwil Software\Avast5\AvastUI.exe

PRC - [2011.11.28 19:01:23 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe

PRC - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2010.12.14 15:49:23 | 001,169,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sdclt.exe

PRC - [2009.06.30 16:20:08 | 000,339,968 | ---- | M] () -- C:\Windows\tsnpstd3.exe

PRC - [2009.04.10 22:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009.04.10 22:27:30 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe

PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe

PRC - [2008.10.14 01:52:50 | 000,376,937 | ---- | M] () -- C:\Programme\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe

PRC - [2008.10.14 01:52:50 | 000,184,423 | ---- | M] () -- C:\Programme\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe

PRC - [2008.01.21 03:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2008.01.21 03:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe

PRC - [2007.10.09 00:19:22 | 000,358,936 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe

PRC - [2007.10.09 00:19:20 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe

PRC - [2007.06.05 12:20:32 | 000,177,704 | ---- | M] () -- C:\Windows\System32\PSIService.exe

PRC - [2007.05.10 13:18:26 | 000,835,584 | ---- | M] () -- C:\Windows\vsnpstd3.exe

PRC - [2006.09.20 07:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

PRC - [2006.09.19 15:05:32 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe

PRC - [2005.01.27 20:48:34 | 000,057,344 | ---- | M] (KYOCERA MITA Corporation) -- C:\Programme\Kyocera\FS-720 Utilities\KMGLNC.exe

PRC - [2001.11.12 12:31:48 | 000,020,480 | ---- | M] (X10) -- C:\Programme\Common Files\X10\Common\X10nets.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2009.06.30 16:20:08 | 000,339,968 | ---- | M] () -- C:\Windows\tsnpstd3.exe

MOD - [2007.05.10 13:18:26 | 000,835,584 | ---- | M] () -- C:\Windows\vsnpstd3.exe

MOD - [2006.09.20 07:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

MOD - [2006.09.19 15:05:32 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.11.28 19:01:23 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)

SRV - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)

SRV - [2008.10.14 01:52:50 | 000,376,937 | ---- | M] () [Auto | Running] -- C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe -- (TVECapSvc) TVEnhance Background Capture Service (TBCS)

SRV - [2008.10.14 01:52:50 | 000,184,423 | ---- | M] () [Auto | Running] -- C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe -- (TVESched) TVEnhance Task Scheduler (TTS))

SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.10.09 00:19:22 | 000,358,936 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)

SRV - [2007.06.05 12:20:32 | 000,177,704 | ---- | M] () [Auto | Running] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing)

SRV - [2001.11.12 12:31:48 | 000,020,480 | ---- | M] (X10) [Auto | Running] -- C:\Programme\Common Files\X10\Common\X10nets.exe -- (x10nets)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.11.28 18:53:53 | 000,435,032 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)

DRV - [2011.11.28 18:53:35 | 000,314,456 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)

DRV - [2011.11.28 18:52:19 | 000,034,392 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)

DRV - [2011.11.28 18:52:16 | 000,052,952 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)

DRV - [2011.11.28 18:52:07 | 000,055,128 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)

DRV - [2011.11.28 18:51:50 | 000,020,568 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)

DRV - [2009.07.03 09:15:12 | 010,526,464 | ---- | M] (Sonix Co. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snpstd3.sys -- (SNPSTD3) USB PC Camera (SNPSTD3)

DRV - [2008.09.25 14:28:06 | 001,332,576 | ---- | M] (NXP Semiconductors Germany GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NxpCap.sys -- (NxpCap)

DRV - [2008.09.22 19:10:00 | 007,400,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2008.08.21 10:57:22 | 000,645,120 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netr28u.sys -- (netr28u)

DRV - [2008.01.21 03:23:25 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)

DRV - [2006.11.30 14:18:18 | 000,027,416 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10ufx2.sys -- (XUIF)

DRV - [2006.11.17 09:31:04 | 000,013,976 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10hid.sys -- (X10Hid)

DRV - [2006.11.07 01:00:00 | 000,014,976 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avmunet.sys -- (AVMUNET)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Program Files\Picasa2\npPicasa2.dll File not found

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.0: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.11.09 15:23:09 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.09.16 15:04:04 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.10.03 18:42:45 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

 

[2010.03.02 15:03:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\a\AppData\Roaming\mozilla\Extensions

[2010.03.02 15:03:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\a\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2011.12.27 20:06:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions

[2009.09.24 15:43:56 | 000,000,000 | ---D | M] (Nuke Anything Enhanced) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\{1ced4832-f06e-413f-aa14-9eb63ad40ace}

[2010.04.27 14:45:08 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.02.04 12:01:16 | 000,000,000 | ---D | M] (PDF Download) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}

[2008.12.13 17:52:56 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(2)

[2011.01.02 17:07:03 | 000,000,000 | ---D | M] (Context Search) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\{902D2C4A-457A-4EF9-AD43-7014562929FF}

[2011.12.24 14:12:12 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2010.11.18 16:52:06 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\de-DE@dictionaries.addons.mozilla.org

[2011.11.16 11:08:32 | 000,000,000 | ---D | M] (HTTPS-Everywhere) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\https-everywhere@eff.org

[2010.11.04 13:53:01 | 000,000,000 | ---D | M] (QuickStores-Toolbar) -- C:\Users\a\AppData\Roaming\mozilla\Firefox\Profiles\xce0990k.default\extensions\quickstores@quickstores.de

[2011.11.09 15:23:13 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2011.11.04 11:53:42 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2011.09.16 15:57:28 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}

[2011.10.24 20:14:53 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}

[2010.08.01 13:49:17 | 000,000,000 | ---D | M] (QuickStores-Toolbar) -- C:\Programme\Mozilla Firefox\extensions\quickstores@quickstores.de

[2011.11.09 15:23:09 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2011.07.08 20:08:24 | 000,167,704 | ---- | M] (Tracker Software Products Ltd.) -- C:\Program Files\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll

[2011.10.03 11:37:26 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.10.03 11:37:26 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2011.10.03 11:37:26 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2011.10.03 11:37:26 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.10.03 11:37:26 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.10.03 11:37:26 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2011.09.14 16:30:36 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Programme\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)

O2 - BHO: (T3ToolbarHelper Class) - {164E93C4-09BF-4647-9E0B-D5FBB1D35E63} - C:\Programme\Das Örtliche Toolbar\DasOertlicheToolbar.dll ()

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O3 - HKLM\..\Toolbar: (DasÖrtliche Toolbar) - {6E5B18CB-0EB6-4461-88B8-33B4683613D5} - C:\Programme\Das Örtliche Toolbar\DasOertlicheToolbar.dll ()

O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll ()

O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll ()

O4 - HKLM..\Run: [avast] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)

O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)

O4 - HKLM..\Run: [Launcher] C:\Programme\Kyocera\FS-720 Utilities\KMGLNC.exe (KYOCERA MITA Corporation)

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [snpstd3] C:\Windows\vsnpstd3.exe ()

O4 - HKLM..\Run: [tsnpstd3] C:\Windows\tsnpstd3.exe ()

O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()

O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : In Windows Live Writer in &Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3C8ED1F3-C984-4D61-A8E2-D71FD759C5F5}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AB6241D3-9F10-462A-85BB-34F3A7719B35}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BFE0E0CB-E7E0-4248-AF95-3F2A8DBC94A4}: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) -  File not found

O24 - Desktop WallPaper: 

O24 - Desktop BackupWallPaper: 

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpReg: Ad-Watch - hkey= - key= -  File not found

MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

MsConfig - StartUpReg: Google EULA Launcher - hkey= - key= - C:\Program Files\Google\Google EULA\GoogleEULALauncher.exe (Google)

MsConfig - StartUpReg: IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - hkey= - key= - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)

MsConfig - StartUpReg: NBKeyScan - hkey= - key= - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)

MsConfig - StartUpReg: OpwareSE4 - hkey= - key= - C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.)

MsConfig - StartUpReg: Skytel - hkey= - key= -  File not found

MsConfig - StartUpReg: SSBkgdUpdate - hkey= - key= - C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)

MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

MsConfig - StartUpReg: SUPERAntiSpyware - hkey= - key= -  File not found

MsConfig - StartUpReg: swg - hkey= - key= - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)

MsConfig - StartUpReg: TVEService - hkey= - key= - C:\Program Files\HomeCinema\TV Enhance\TVEService.exe (CyberLink Corp.)

MsConfig - State: "startup" - 2

MsConfig - State: "bootini" - 0

 

SafeBootMin: AppMgmt -  File not found

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt -  File not found

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfPf - Driver

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codecp -  File not found

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.12.22 18:10:13 | 002,322,184 | ---- | C] (ESET) -- C:\Users\a\Desktop\esetsmartinstaller_enu.exe

[2011.12.22 15:23:49 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\a\Desktop\OTL.exe

[2011.12.22 12:05:39 | 000,000,000 | ---D | C] -- C:\Users\a\Desktop\Post_Label_N2420US

[2011.11.24 17:11:03 | 003,511,776 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup312.exe

[2011.11.13 12:39:01 | 051,566,481 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Program Files\32bit_Vista_Win7_R266.exe

[2011.09.29 21:56:24 | 003,495,424 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup311.exe

[2011.09.17 14:22:37 | 003,127,456 | ---- | C] (Adobe Systems, Inc.) -- C:\Program Files\install_flash_player_ax.exe

[2011.09.16 15:55:44 | 000,908,576 | ---- | C] (Sun Microsystems, Inc.) -- C:\Program Files\jxpiinstall.exe

[2011.09.15 14:22:37 | 012,570,736 | ---- | C] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware.exe

[2011.09.13 14:39:32 | 002,322,184 | ---- | C] (ESET) -- C:\Program Files\esetsmartinstaller_enu.exe

[2011.09.13 13:00:10 | 009,466,208 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Program Files\mbam-setup-1.51.1.1800.exe

[2011.05.30 15:17:28 | 003,096,424 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup307.exe

[2011.04.23 12:59:39 | 000,568,648 | ---- | C] (Google Inc.) -- C:\Program Files\GoogleEarthSetup.exe

[2011.04.04 18:24:26 | 003,050,664 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup305.exe

[2011.03.20 15:06:40 | 000,772,384 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Mats_Run.performance.exe

[2011.03.20 15:05:43 | 000,772,896 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Mats_Run.printing.exe

[2011.03.18 12:52:24 | 006,277,496 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Silverlight.exe

[2011.01.26 17:52:49 | 003,006,368 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup303.exe

[2011.01.06 16:49:33 | 038,147,376 | ---- | C] (Apple Inc.) -- C:\Program Files\QuickTimeInstaller.exe

[2010.12.30 16:03:35 | 004,044,900 | ---- | C] ((c) 2006-2008, Tom Thielicke                                ) -- C:\Program Files\tipp10_win_v2-0-3.exe

[2010.12.20 12:43:43 | 004,750,496 | ---- | C] (Adobe Systems Inc.) -- C:\Program Files\Shockwave_Installer_Slim.exe

[2010.10.14 20:42:28 | 004,229,377 | ---- | C] (www.orbitdownloader.com                                     ) -- C:\Program Files\OrbitSetup4.0.3.exe

[2010.08.10 15:04:16 | 128,750,008 | ---- | C] (Lavasoft                                                                                                                                                                                                                                                                                                    ) -- C:\Program Files\Ad-AwareInstall.exe

[2010.05.03 12:02:38 | 005,461,276 | ---- | C] (Igor Pavlov) -- C:\Program Files\TMViewerSetup.exe

[2010.04.07 13:40:38 | 003,376,656 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup230.exe

[2010.03.02 13:31:34 | 008,853,856 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 3.0.3.exe

[2010.01.31 14:22:17 | 000,163,840 | ---- | C] ( ) -- C:\Windows\System32\rsnpstd3.dll

[2010.01.31 14:22:17 | 000,061,440 | ---- | C] ( ) -- C:\Windows\System32\vsnpstd3.dll

[2010.01.31 14:22:17 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\csnpstd3.dll

[2010.01.31 14:22:17 | 000,053,248 | ---- | C] ( ) -- C:\Windows\csnpstd3.dll

[2010.01.29 18:37:52 | 003,370,400 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup228.exe

[2010.01.28 18:18:12 | 002,572,472 | ---- | C] (www.orbitdownloader.com                                     ) -- C:\Program Files\OrbitDownloaderSetup.exe

[2009.12.02 13:06:33 | 001,128,916 | ---- | C] (www.hellopdf.com                                            ) -- C:\Program Files\pdf2wordsetup.exe

[2009.11.29 21:12:00 | 012,543,460 | ---- | C] (Andrea Vacondio) -- C:\Program Files\pdfsam-win32inst-v2_0_0.exe

[2009.10.26 14:44:08 | 077,086,488 | ---- | C] (Lavasoft                                                                                                                                                                                                                                                                                                    ) -- C:\Program Files\Ad-AwareInstallation.exe

[2009.10.14 13:26:51 | 003,309,072 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup224.exe

[2009.05.15 12:43:03 | 003,227,248 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup219.exe

[2009.05.01 10:28:15 | 218,474,518 | ---- | C] (Igor Pavlov) -- C:\Program Files\OOO31CBE.exe

[2009.04.27 14:16:35 | 003,190,688 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup218.exe

[2009.04.21 13:16:06 | 034,543,112 | ---- | C] (Lavasoft                                                                                                                                                                                                                                                                                                    ) -- C:\Program Files\Ad-AwareAE.exe

[2009.02.19 17:59:10 | 016,409,960 | ---- | C] (Safer Networking Limited                                    ) -- C:\Program Files\spybotsd162.exe

[2008.12.31 15:43:22 | 001,018,074 | ---- | C] (Heinzle Christof) -- C:\Program Files\lameplugin.exe

[2008.12.31 15:11:25 | 015,083,520 | ---- | C] (Safer Networking Limited                                    ) -- C:\Program Files\spybotsd160.exe

[2008.12.31 14:51:14 | 003,165,824 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup215.exe

[2008.12.30 14:12:28 | 002,170,309 | ---- | C] (Free Software Foundation) -- C:\Program Files\gnupg-w32cli-1.4.9.exe

[2008.12.29 18:36:10 | 002,188,592 | ---- | C] (www.orbitdownloader.com                                     ) -- C:\Program Files\OrbitDownloader281Setup.exe

[2008.12.13 21:19:13 | 006,557,639 | ---- | C] (Thorsten Fritz                                              ) -- C:\Program Files\kompozer-0.77.de-DE.win32.installer.exe

[2008.12.13 21:19:04 | 000,735,964 | ---- | C] (GegenStandpunkt Verlag, München) -- C:\Program Files\GS_Index_20071215.exe

[2008.12.13 21:19:02 | 004,986,208 | ---- | C] (InstallShield Software Corporation) -- C:\Program Files\cibpdfplugin.exe

[2008.12.13 21:19:01 | 012,785,408 | ---- | C] (InstallShield Software Corporation) -- C:\Program Files\cibpdfbrewer.exe

[2008.12.13 21:18:51 | 002,955,128 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup213.exe

[2002.03.11 10:06:30 | 001,822,520 | ---- | C] (Microsoft Corporation) -- C:\Program Files\instmsiw.exe

[2002.03.11 09:45:04 | 001,708,856 | ---- | C] (Microsoft Corporation) -- C:\Program Files\instmsia.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.12.29 01:40:00 | 000,000,438 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{103B65BD-4798-4CA0-9487-EB211B637804}.job

[2011.12.29 01:34:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.12.29 01:18:00 | 000,001,088 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2011.12.28 23:53:24 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2011.12.28 23:53:24 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2011.12.28 17:58:31 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.12.28 17:58:31 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.12.28 17:58:31 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.12.28 17:58:30 | 000,126,248 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.12.28 17:55:35 | 000,001,084 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2011.12.28 17:53:19 | 3487,748,096 | -HS- | M] () -- C:\hiberfil.sys

[2011.12.28 17:34:26 | 000,090,509 | ---- | M] () -- C:\Users\a\Desktop\Meinungsbildung_Eurogipfel_1.pdf

[2011.12.28 13:34:02 | 000,000,910 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2011.12.28 13:29:10 | 000,662,389 | ---- | M] () -- C:\Users\a\Desktop\WER4643.tmp.mdmp

[2011.12.24 14:53:55 | 000,085,713 | ---- | M] () -- C:\Users\a\Desktop\fehlende erste Zeilen [GSP Asta-zeitung].pdf

[2011.12.24 14:51:56 | 005,062,900 | ---- | M] () -- C:\Users\a\Desktop\GSP Asta-zeitung.PDF

[2011.12.24 12:59:23 | 000,019,456 | ---- | M] () -- C:\Users\a\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.12.23 13:42:56 | 004,036,051 | ---- | M] () -- C:\Users\a\Desktop\asta_artikel_122011_105.pdf

[2011.12.22 18:10:14 | 002,322,184 | ---- | M] (ESET) -- C:\Users\a\Desktop\esetsmartinstaller_enu.exe

[2011.12.22 17:44:12 | 000,075,189 | ---- | M] () -- C:\Users\a\Desktop\Gmer-22-12.zip

[2011.12.22 17:43:40 | 000,000,361 | ---- | M] () -- C:\Users\a\Desktop\defogger_disable.zip

[2011.12.22 17:12:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job

[2011.12.22 15:24:47 | 000,302,592 | ---- | M] () -- C:\Users\a\Desktop\07oe12o9.exe

[2011.12.22 15:23:51 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\a\Desktop\OTL.exe

[2011.12.22 15:23:27 | 000,050,477 | ---- | M] () -- C:\Users\a\Desktop\Defogger.exe

[2011.12.19 17:03:05 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt

[2011.12.19 15:39:31 | 000,033,185 | ---- | M] () -- C:\Users\a\Desktop\Manroland Insolvenz Gliederung.odt

[2011.12.14 14:12:23 | 000,347,560 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2011.12.13 18:05:51 | 000,042,736 | ---- | M] () -- C:\Users\a\Desktop\RG-3-11-24421.pdf

[2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

 
 ========== Files Created - No Company Name ==========

 

[2011.12.28 17:34:25 | 000,090,509 | ---- | C] () -- C:\Users\a\Desktop\Meinungsbildung_Eurogipfel_1.pdf

[2011.12.28 13:34:02 | 000,000,910 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2011.12.28 13:29:10 | 000,662,389 | ---- | C] () -- C:\Users\a\Desktop\WER4643.tmp.mdmp

[2011.12.24 14:53:55 | 000,085,713 | ---- | C] () -- C:\Users\a\Desktop\fehlende erste Zeilen [GSP Asta-zeitung].pdf

[2011.12.24 13:42:18 | 005,062,900 | ---- | C] () -- C:\Users\a\Desktop\GSP Asta-zeitung.PDF

[2011.12.23 13:42:52 | 004,036,051 | ---- | C] () -- C:\Users\a\Desktop\asta_artikel_122011_105.pdf

[2011.12.22 17:44:12 | 000,075,189 | ---- | C] () -- C:\Users\a\Desktop\Gmer-22-12.zip

[2011.12.22 17:43:40 | 000,000,361 | ---- | C] () -- C:\Users\a\Desktop\defogger_disable.zip

[2011.12.22 15:24:46 | 000,302,592 | ---- | C] () -- C:\Users\a\Desktop\07oe12o9.exe

[2011.12.22 15:23:26 | 000,050,477 | ---- | C] () -- C:\Users\a\Desktop\Defogger.exe

[2011.12.22 13:24:48 | 3487,748,096 | -HS- | C] () -- C:\hiberfil.sys

[2011.12.19 15:39:31 | 000,033,185 | ---- | C] () -- C:\Users\a\Desktop\Manroland Insolvenz Gliederung.odt

[2011.12.13 18:05:50 | 000,042,736 | ---- | C] () -- C:\Users\a\Desktop\RG-3-11-24421.pdf

[2011.11.17 16:56:06 | 002,448,704 | ---- | C] () -- C:\Program Files\mp3tagv249asetup.exe

[2011.11.13 18:51:03 | 199,812,300 | ---- | C] () -- C:\Program Files\LibO_3.4.4_Win_x86_install_multi.exe

[2011.11.13 13:04:07 | 000,150,996 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT

[2011.11.12 16:48:12 | 044,579,152 | ---- | C] () -- C:\Program Files\calibre-0.8.26.msi

[2011.11.07 22:12:11 | 044,517,200 | ---- | C] () -- C:\Program Files\calibre-0.8.25.msi

[2011.09.29 21:37:03 | 000,158,832 | ---- | C] () -- C:\Program Files\1by1_175.exe

[2011.09.16 14:44:33 | 018,702,336 | ---- | C] () -- C:\Program Files\PXCViewer_x86.msi

[2011.09.16 14:43:36 | 000,071,361 | ---- | C] () -- C:\Program Files\javarasource.zip

[2011.09.12 16:07:55 | 010,268,672 | ---- | C] () -- C:\Program Files\Ad-Aware95Install.msi

[2011.08.13 12:33:54 | 000,000,064 | ---- | C] () -- C:\Windows\System32\rp_stats.dat

[2011.08.13 12:33:54 | 000,000,044 | ---- | C] () -- C:\Windows\System32\rp_rules.dat

[2011.08.03 17:11:00 | 021,073,936 | ---- | C] () -- C:\Program Files\vlc-1.1.11-win32.exe

[2011.07.29 15:37:17 | 002,448,352 | ---- | C] () -- C:\Program Files\mp3tagv249setup.exe

[2011.06.28 14:09:07 | 021,022,914 | ---- | C] () -- C:\Program Files\vlc-1.1.10-win32.exe

[2011.05.30 21:08:50 | 000,001,940 | ---- | C] () -- C:\Program Files\HiJackThis.lnk

[2011.05.30 21:07:51 | 001,402,880 | ---- | C] () -- C:\Program Files\HiJackThis.msi

[2011.04.28 15:07:16 | 002,446,680 | ---- | C] () -- C:\Program Files\mp3tagv248setup.exe

[2011.04.26 17:03:55 | 020,533,281 | ---- | C] () -- C:\Program Files\vlc-1.1.9-win32.exe

[2011.04.04 16:08:58 | 000,247,053 | ---- | C] () -- C:\Program Files\mp3DC213.exe

[2011.03.31 12:08:00 | 020,586,196 | ---- | C] () -- C:\Program Files\vlc-1.1.8-win32.exe

[2011.03.18 12:56:26 | 020,364,702 | ---- | C] () -- C:\Program Files\vlc-1.1.7-win32.exe

[2011.03.14 18:59:08 | 004,437,496 | ---- | C] () -- C:\Program Files\Songr_1_9_17.zip

[2011.02.20 16:36:14 | 168,166,968 | ---- | C] () -- C:\Program Files\OOo_3.3.0_Win_x86_install-wJRE_de.exe

[2010.12.22 22:45:41 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI

[2010.12.09 16:21:36 | 019,985,265 | ---- | C] () -- C:\Program Files\vlc-1.1.5-win32.exe

[2010.10.26 16:08:18 | 000,226,402 | ---- | C] () -- C:\Program Files\mp3DC212.exe

[2010.10.14 20:43:16 | 000,008,619 | ---- | C] () -- C:\Program Files\obdeu.zip

[2010.08.28 11:44:33 | 019,657,194 | ---- | C] () -- C:\Program Files\vlc-1.1.4-win32.exe

[2010.08.20 13:23:40 | 019,563,096 | ---- | C] () -- C:\Program Files\vlc-1.1.3-win32.exe

[2010.08.08 13:51:33 | 000,058,984 | ---- | C] () -- C:\Program Files\225p1es_00_dwv_eng.zip

[2010.08.02 13:14:46 | 019,461,015 | ---- | C] () -- C:\Program Files\vlc-1.1.2-win32.exe

[2010.08.01 13:43:51 | 001,295,402 | ---- | C] () -- C:\Program Files\ag_mp3_plugin_setup.exe

[2010.07.27 13:10:19 | 151,343,200 | ---- | C] () -- C:\Program Files\OOo_3.2.1_Win_x86_install_de.exe

[2010.05.25 19:43:14 | 003,099,136 | ---- | C] () -- C:\Program Files\openofficeorg32.msi

[2010.05.25 19:40:04 | 145,988,770 | ---- | C] () -- C:\Program Files\openofficeorg1.cab

[2010.05.25 18:46:20 | 000,000,290 | ---- | C] () -- C:\Program Files\setup.ini

[2010.05.20 14:50:50 | 000,150,358 | ---- | C] () -- C:\Program Files\1by1_169.exe

[2010.05.03 12:26:03 | 000,068,640 | ---- | C] () -- C:\Windows\unTMV.exe

[2010.04.08 16:00:16 | 002,439,075 | ---- | C] () -- C:\Program Files\fc_setup_ (2).zip

[2010.03.04 16:10:43 | 167,555,440 | ---- | C] () -- C:\Program Files\OOo_3.2.0_Win32Intel_install_wJRE_de.exe

[2010.03.02 15:44:27 | 002,024,035 | ---- | C] () -- C:\Program Files\Firesave.exe

[2010.03.02 13:48:37 | 001,222,286 | ---- | C] () -- C:\Program Files\enigmail-1.0.1-tb-win.xpi

[2010.03.02 13:20:10 | 000,000,213 | ---- | C] () -- C:\Program Files\PFADE.ini

[2010.03.02 13:06:40 | 001,772,267 | ---- | C] () -- C:\Program Files\Thundersave_1.0.exe

[2010.02.19 13:40:40 | 044,518,776 | ---- | C] () -- C:\Program Files\setup_av_free_2_.exe

[2010.02.06 15:06:34 | 018,499,623 | ---- | C] () -- C:\Program Files\vlc-1.0.5-win32.exe

[2010.01.31 14:22:18 | 000,835,584 | ---- | C] () -- C:\Windows\vsnpstd3.exe

[2010.01.31 14:22:18 | 000,339,968 | ---- | C] () -- C:\Windows\tsnpstd3.exe

[2010.01.31 14:22:17 | 000,015,498 | ---- | C] () -- C:\Windows\snpstd3.ini

[2010.01.28 18:53:14 | 000,127,083 | ---- | C] () -- C:\Program Files\1by1_168.exe

[2009.11.29 21:05:33 | 001,137,763 | ---- | C] () -- C:\Program Files\sun-pdfimport10.zip

[2009.10.07 12:45:28 | 149,845,064 | ---- | C] () -- C:\Program Files\OOo_3.1.1_Win32Intel_install_de.exe

[2009.07.11 13:35:13 | 017,828,326 | ---- | C] () -- C:\Program Files\vlc-1.0.0-win32.exe

[2009.06.26 16:59:35 | 000,728,103 | ---- | C] () -- C:\Program Files\VAL v1.1.1 Setup.exe

[2009.05.26 17:53:38 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009.05.26 17:52:24 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009.05.08 22:15:49 | 016,742,799 | ---- | C] () -- C:\Program Files\vlc-0.9.9-win32.exe

[2009.05.07 14:31:52 | 147,695,064 | ---- | C] () -- C:\Program Files\OOo_3.1.0_Win32Intel_install_de.exe

[2009.05.05 15:01:41 | 000,212,713 | ---- | C] () -- C:\Program Files\mp3DC211.exe

[2009.05.05 14:59:51 | 000,121,784 | ---- | C] () -- C:\Program Files\1by1_167.exe

[2009.04.27 11:03:46 | 009,818,624 | ---- | C] () -- C:\Program Files\openofficeorg31.msi

[2009.04.16 14:33:14 | 000,049,230 | ---- | C] () -- C:\Program Files\download_manager_tweak-0.7.2-fx.xpi

[2009.04.09 18:58:43 | 001,300,755 | ---- | C] () -- C:\Program Files\KKiller_v3.4.4.zip

[2009.02.26 17:29:19 | 000,037,658 | ---- | C] () -- C:\Program Files\duplicate_contact_manager-0.6-tb.xpi

[2009.01.27 19:28:46 | 000,111,016 | ---- | C] () -- C:\Program Files\image_zoom-0.3.1-fx+mz+tb+sm.xpi

[2009.01.10 20:37:39 | 156,172,680 | ---- | C] () -- C:\Program Files\ooo300.exe

[2009.01.04 18:29:10 | 000,938,576 | ---- | C] () -- C:\Program Files\7z463.exe

[2009.01.02 16:05:44 | 016,320,472 | ---- | C] () -- C:\Program Files\vlc-0.9.8a-win32.exe

[2008.12.31 17:34:50 | 007,949,158 | ---- | C] () -- C:\Program Files\kompozer-0.7.10-win32.zip

[2008.12.31 15:28:55 | 023,804,784 | ---- | C] () -- C:\Program Files\aaw2008_11n.exe

[2008.12.31 15:03:51 | 000,019,456 | ---- | C] () -- C:\Users\a\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008.12.13 21:19:02 | 001,176,154 | ---- | C] () -- C:\Program Files\enigmail-0.95.6-tb+sm.xpi

[2008.12.13 21:18:50 | 000,189,429 | ---- | C] () -- C:\Program Files\mp3DC209.exe

[2008.12.13 19:35:07 | 000,000,296 | ---- | C] () -- C:\Users\a\AppData\Roaming\wklnhst.dat

[2008.12.13 17:50:37 | 000,792,771 | ---- | C] () -- C:\Program Files\MozBackup-1.4.8-DE.exe

[2008.12.13 17:29:22 | 000,040,960 | ---- | C] () -- C:\Windows\System32\IPPCPUID.DLL

[2008.12.13 17:27:40 | 000,011,776 | ---- | C] () -- C:\Windows\System32\pmsbfn32.dll

[2008.12.13 17:25:25 | 000,000,416 | ---- | C] () -- C:\Windows\MAXLINK.INI

[2008.12.13 12:59:31 | 000,007,592 | ---- | C] () -- C:\Users\a\AppData\Local\d3d9caps.dat

[2008.10.20 09:35:26 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini

[2008.10.17 16:15:05 | 000,000,917 | ---- | C] () -- C:\Windows\System32\CLWatson.ini

[2008.10.17 15:56:47 | 000,009,824 | ---- | C] () -- C:\Windows\System32\716xCoInstaller.dll

[2008.10.17 15:56:47 | 000,000,464 | ---- | C] () -- C:\Windows\11317231_000216BE_11.bin

[2008.10.17 15:56:47 | 000,000,464 | ---- | C] () -- C:\Windows\11317231_000216BE_1.bin

[2008.10.17 15:56:47 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_000116BE_1.bin

[2008.10.08 13:51:57 | 000,127,184 | ---- | C] () -- C:\Windows\Unwise.exe

[2008.10.08 12:26:22 | 000,015,312 | ---- | C] () -- C:\Windows\System32\RaCoInst.dat

[2008.10.08 12:01:08 | 000,000,023 | ---- | C] () -- C:\Windows\System32\drivers\VERSION.DAT

[2008.10.08 11:00:48 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll

[2008.09.19 07:45:40 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll

[2008.06.05 07:58:26 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll

[2008.01.21 08:15:58 | 000,628,504 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2008.01.21 08:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2008.01.21 08:15:58 | 000,126,248 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2008.01.21 08:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2007.06.05 12:20:32 | 000,177,704 | ---- | C] () -- C:\Windows\System32\PSIService.exe

[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 13:47:37 | 000,347,560 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 11:33:01 | 000,595,798 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 11:33:01 | 000,103,872 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[1996.12.14 00:00:00 | 000,022,016 | ---- | C] () -- C:\Windows\System32\DOCOBJ.DLL

[1996.12.14 00:00:00 | 000,012,288 | ---- | C] () -- C:\Windows\System32\HLINKPRX.DLL

 
 ========== LOP Check ==========

 

[2010.05.21 09:59:47 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\1by1

[2011.11.07 22:15:50 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\calibre

[2008.12.23 16:51:40 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Canon

[2008.12.29 17:20:30 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\FreeCommander

[2011.04.07 17:38:22 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\gnupg

[2009.03.20 17:11:11 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\GrabPro

[2008.12.31 17:57:43 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\KompoZer

[2011.11.13 19:02:17 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\LibreOffice

[2010.10.26 23:46:17 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\mp3DirectCut

[2011.11.17 16:56:13 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Mp3tag

[2009.07.13 15:45:36 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\NewSoft

[2009.01.10 23:29:36 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\OpenOffice.org

[2011.12.11 17:59:01 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Orbit

[2010.10.14 20:44:47 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\ProgSense

[2010.08.01 13:49:17 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\QuickStoresToolbar

[2008.12.13 17:25:21 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\ScanSoft

[2008.12.11 21:45:04 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\T-Online

[2010.11.07 15:56:56 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Template

[2010.03.02 15:03:23 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Thunderbird

[2011.12.22 17:12:00 | 000,000,384 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job

[2011.12.28 17:52:29 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2011.12.29 01:40:00 | 000,000,438 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{103B65BD-4798-4CA0-9487-EB211B637804}.job

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2010.05.21 09:59:47 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\1by1

[2010.12.20 13:00:26 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Adobe

[2011.11.07 22:15:50 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\calibre

[2008.12.23 16:51:40 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Canon

[2008.12.31 15:06:23 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\CyberLink

[2011.01.29 18:30:32 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\dvdcss

[2008.12.29 17:20:30 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\FreeCommander

[2011.04.07 17:38:22 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\gnupg

[2009.01.12 17:27:37 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Google

[2009.03.20 17:11:11 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\GrabPro

[2008.12.11 21:26:01 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Identities

[2010.01.31 14:21:40 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\InstallShield

[2008.12.31 17:57:43 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\KompoZer

[2011.11.13 19:02:17 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\LibreOffice

[2008.12.11 22:49:22 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Macromedia

[2011.09.13 13:01:51 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Malwarebytes

[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Media Center Programs

[2011.05.30 21:08:50 | 000,000,000 | --SD | M] -- C:\Users\a\AppData\Roaming\Microsoft

[2008.12.13 17:56:07 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Mozilla

[2010.10.26 23:46:17 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\mp3DirectCut

[2011.11.17 16:56:13 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Mp3tag

[2009.01.02 16:48:05 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Nero

[2009.07.13 15:45:36 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\NewSoft

[2009.01.10 23:29:36 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\OpenOffice.org

[2011.12.11 17:59:01 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Orbit

[2010.10.14 20:44:47 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\ProgSense

[2010.08.01 13:49:17 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\QuickStoresToolbar

[2008.12.13 17:25:21 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\ScanSoft

[2011.12.22 12:12:54 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Skype

[2011.07.07 19:54:06 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\skypePM

[2008.12.11 21:45:04 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\T-Online

[2008.12.13 17:56:29 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Talkback

[2010.11.07 15:56:56 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Template

[2010.03.02 15:03:23 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\Thunderbird

[2011.12.01 14:37:36 | 000,000,000 | ---D | M] -- C:\Users\a\AppData\Roaming\vlc

 
 < %APPDATA%\*.exe /s >

[2011.05.30 21:08:50 | 000,388,096 | R--- | M] (Trend Micro Inc.) -- C:\Users\a\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

[2009.07.20 15:00:17 | 000,583,168 | ---- | M] () -- C:\Users\a\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\C862.tmp_\sun-pdfimport.oxt\xpdfimport.exe

[2010.08.01 13:49:16 | 000,704,248 | ---- | M] () -- C:\Users\a\AppData\Roaming\QuickStoresToolbar\unins000.exe

[2010.03.10 14:13:58 | 000,045,304 | ---- | M] (Andreas Breitschopp - Softwareentwicklung und -vertrieb) -- C:\Users\a\AppData\Roaming\QuickStoresToolbar\Update.exe

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\ERDNT\cache\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2008.03.12 07:38:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\ERDNT\cache\atapi.sys

[2008.03.12 07:38:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\drivers\atapi.sys

[2008.03.12 07:38:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_4c9c5a00\atapi.sys

[2008.03.12 07:38:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18034_none_dd1bb97e219e87cb\atapi.sys

[2009.04.10 22:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.10 22:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2008.03.12 07:24:20 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=96DC4E1A9F90CCD489950A8935425C59 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22134_none_dda556493abc2795\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\ERDNT\cache\cngaudit.dll

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: EVENTLOG.DLL  >

[2007.05.17 20:34:04 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files\HomeCinema\PowerDirector\EventLog.dll

 
 < MD5 for: IASTOR.SYS  >

[2007.10.09 00:18:44 | 000,306,200 | ---- | M] (Intel Corporation) MD5=28AAE599496B4930B3F19026F2083BC4 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys

[2007.10.09 00:18:44 | 000,306,200 | ---- | M] (Intel Corporation) MD5=28AAE599496B4930B3F19026F2083BC4 -- C:\Windows\System32\drivers\iaStor.sys

[2007.10.09 00:18:44 | 000,306,200 | ---- | M] (Intel Corporation) MD5=28AAE599496B4930B3F19026F2083BC4 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_1bb129e3\iaStor.sys

[2007.10.09 00:19:02 | 000,383,000 | ---- | M] (Intel Corporation) MD5=968BCEAD432CD478D0659FC95ED52170 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.04.10 22:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\ERDNT\cache\netlogon.dll

[2009.04.10 22:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.10 22:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2009.04.10 22:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\ERDNT\cache\scecli.dll

[2009.04.10 22:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.10 22:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.04.10 22:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\ERDNT\cache\user32.dll

[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2009.04.10 22:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.10 22:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\ERDNT\cache\userinit.exe

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\ERDNT\cache\wininit.exe

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.04.10 22:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\ERDNT\cache\winlogon.exe

[2009.04.10 22:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.10 22:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":Files" muss mitkopiert werden!!!)

Code:

:Files

C:\Users\a\Desktop\Post_Label_N2420US

C:\Program Files\OOO31CBE.exe

C:\Users\a\Desktop\WER4643.tmp.mdmp

:Commands

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

OTL ist gelaufen, bis Windows anzeigte, "OTL funktioniert nicht mehr" "APPCRASH". Ich habe den Computer neu gestartet, dann erschien folgende Nachricht im Editor:

Code:

Files\Folders moved on Reboot...

C:\Users\a\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7D4UECWZ\background-banner-middle-v45[1].jpg moved successfully.

C:\Users\a\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7D4UECWZ\background_banner_green_50_v45[1].jpg moved successfully.

C:\Users\a\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4AVF2GJ3\background-banner-right-v45[1].jpg moved successfully.

C:\Users\a\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4AVF2GJ3\list-item-plus[1].png moved successfully.

C:\Users\a\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3VEI5K5W\background_button_green_full[1].png moved successfully.
 

Registry entries deleted on Reboot...

Soll ich OTL noch einmal laufen lassen?

Ja bitte wiederholen.
Und OTL muss per Rechtsklick als Admin ausgeführt werden!

Jetzt hat es geklappt. Hier das OTL-Ergebnis:

Code:

All processes killed

========== FILES ==========

File\Folder C:\Users\a\Desktop\Post_Label_N2420US not found.

File\Folder C:\Program Files\OOO31CBE.exe not found.

File\Folder C:\Users\a\Desktop\WER4643.tmp.mdmp not found.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: a

->Temp folder emptied: 368119 bytes

->Temporary Internet Files folder emptied: 1243170 bytes

->Java cache emptied: 440940 bytes

->FireFox cache emptied: 69250027 bytes

->Flash cache emptied: 618 bytes

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

->Temp folder emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 0 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 68,00 mb

Malverbytes, der die beiden Post_label.exe gesäubert hat, habe ich auch vorhin zur Prüfung, ob es jetzt sauber ist, laufen lassen:

Code:

Malwarebytes Anti-Malware 1.60.0.1800

www.malwarebytes.org
 

Datenbank Version: v2011.12.29.02
 

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

a :: A-PC [Administrator]
 

29.12.2011 14:11:14

mbam-log-2011-12-29 (14-11-14).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 372898

Laufzeit: 1 Stunde(n), 9 Minute(n), 25 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Und ESET gestern Abend:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=64f3865ced9e534a86ddcac0eae771c3

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-09-13 03:16:33

# local_time=2011-09-13 05:16:33 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 79391430 79391430 0 0

# compatibility_mode=768 16777215 100 0 308782 308782 0 0

# compatibility_mode=5892 16776573 100 100 15441 153454224 0 0

# compatibility_mode=8192 67108863 100 0 306 306 0 0

# scanned=305168

# found=0

# cleaned=0

# scan_time=5496

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=64f3865ced9e534a86ddcac0eae771c3

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-09-15 10:06:15

# local_time=2011-09-16 12:06:15 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 79575671 79575671 0 0

# compatibility_mode=768 16777215 100 0 493023 493023 0 0

# compatibility_mode=5892 16776573 100 100 199682 153638465 0 0

# compatibility_mode=8192 67108863 100 0 184547 184547 0 0

# scanned=303452

# found=3

# cleaned=0

# scan_time=18638

I:\A-PC\Backup Set 2010-03-02 133326\Backup Files 2010-03-02 133326\Backup files 1.zip        multiple threats (unable to clean)        00000000000000000000000000000000        I

I:\A-PC\Backup Set 2010-11-08 151038\Backup Files 2010-11-08 151038\Backup files 1.zip        multiple threats (unable to clean)        00000000000000000000000000000000        I

I:\A-PC\Backup Set 2010-11-08 151038\Backup Files 2011-05-05 111900\Backup files 1.zip        HTML/Iframe.B.Gen virus (unable to clean)        00000000000000000000000000000000        I

ESETSmartInstaller@High as downloader log:

all ok

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=64f3865ced9e534a86ddcac0eae771c3

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-12-22 06:40:10

# local_time=2011-12-22 07:40:10 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=768 16777215 100 0 8961236 8961236 0 0

# compatibility_mode=5892 16776573 100 100 14333 162106678 0 0

# compatibility_mode=8192 67108863 100 0 8392593 8392593 0 0

# scanned=235493

# found=2

# cleaned=0

# scan_time=5259

C:\Users\a\AppData\Local\temp\Temp1_Post_Label_N2420US.zip\Post_Label.exe        a variant of Win32/Kryptik.XUH trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\a\Desktop\Post_Label_N2420US\Post_Label.exe        a variant of Win32/Kryptik.XUH trojan (unable to clean)        00000000000000000000000000000000        I

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=64f3865ced9e534a86ddcac0eae771c3

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-12-28 06:40:35

# local_time=2011-12-28 07:40:35 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=768 16777215 100 0 9479826 9479826 0 0

# compatibility_mode=5892 16776573 100 100 4936 162625268 0 0

# compatibility_mode=8192 67108863 100 0 8911183 8911183 0 0

# scanned=238531

# found=0

# cleaned=0

# scan_time=5094

ESETSmartInstaller@High as downloader log:

all ok

esets_scanner_update returned -1 esets_gle=53251

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=64f3865ced9e534a86ddcac0eae771c3

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-12-28 10:29:48

# local_time=2011-12-28 11:29:48 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=768 16777215 100 0 9493433 9493433 0 0

# compatibility_mode=5892 16776573 100 100 18543 162638875 0 0

# compatibility_mode=8192 67108863 100 0 8924790 8924790 0 0

# scanned=238821

# found=0

# cleaned=0

# scan_time=5241

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

TDSS-Killer findet eine Datei,
netr28u ( UnsignedFile.Multi.Generic ) - skipped by user

Code:

17:35:14.0629 4308        TDSS rootkit removing tool 2.6.25.0 Dec 23 2011 14:51:16

17:35:14.0722 4308        ============================================================

17:35:14.0722 4308        Current date / time: 2011/12/29 17:35:14.0722

17:35:14.0722 4308        SystemInfo:

17:35:14.0722 4308        

17:35:14.0722 4308        OS Version: 6.0.6002 ServicePack: 2.0

17:35:14.0722 4308        Product type: Workstation

17:35:14.0722 4308        ComputerName: A-PC

17:35:14.0722 4308        UserName: a

17:35:14.0722 4308        Windows directory: C:\Windows

17:35:14.0722 4308        System windows directory: C:\Windows

17:35:14.0722 4308        Processor architecture: Intel x86

17:35:14.0722 4308        Number of processors: 4

17:35:14.0722 4308        Page size: 0x1000

17:35:14.0722 4308        Boot type: Normal boot

17:35:14.0722 4308        ============================================================

17:35:15.0112 4308        Initialize success

17:36:32.0925 5176        ============================================================

17:36:32.0925 5176        Scan started

17:36:32.0925 5176        Mode: Manual; SigCheck; TDLFS; 

17:36:32.0925 5176        ============================================================

17:36:33.0409 5176        ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

17:36:33.0502 5176        ACPI - ok

17:36:33.0580 5176        adp94xx         (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys

17:36:33.0596 5176        adp94xx - ok

17:36:33.0627 5176        adpahci         (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys

17:36:33.0643 5176        adpahci - ok

17:36:33.0643 5176        adpu160m        (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys

17:36:33.0658 5176        adpu160m - ok

17:36:33.0674 5176        adpu320         (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys

17:36:33.0689 5176        adpu320 - ok

17:36:33.0767 5176        AFD             (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys

17:36:33.0814 5176        AFD - ok

17:36:33.0861 5176        agp440          (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys

17:36:33.0877 5176        agp440 - ok

17:36:33.0923 5176        aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

17:36:33.0923 5176        aic78xx - ok

17:36:33.0970 5176        aliide          (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys

17:36:33.0986 5176        aliide - ok

17:36:34.0001 5176        amdagp          (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys

17:36:34.0017 5176        amdagp - ok

17:36:34.0033 5176        amdide          (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys

17:36:34.0048 5176        amdide - ok

17:36:34.0064 5176        AmdK7           (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys

17:36:34.0111 5176        AmdK7 - ok

17:36:34.0142 5176        AmdK8           (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys

17:36:34.0189 5176        AmdK8 - ok

17:36:34.0220 5176        arc             (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys

17:36:34.0235 5176        arc - ok

17:36:34.0282 5176        arcsas          (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys

17:36:34.0282 5176        arcsas - ok

17:36:34.0345 5176        aswFsBlk        (054df24c92b55427e0757cfff160e4f2) C:\Windows\system32\drivers\aswFsBlk.sys

17:36:34.0360 5176        aswFsBlk - ok

17:36:34.0438 5176        aswMonFlt       (258143605e77e4008f1758481d6a977d) C:\Windows\system32\drivers\aswMonFlt.sys

17:36:34.0454 5176        aswMonFlt - ok

17:36:34.0469 5176        aswRdr          (352d5a48ebab35a7693b048679304831) C:\Windows\system32\drivers\aswRdr.sys

17:36:34.0485 5176        aswRdr - ok

17:36:34.0516 5176        aswSnx          (8d34d2b24297e27d93e847319abfdec4) C:\Windows\system32\drivers\aswSnx.sys

17:36:34.0532 5176        aswSnx - ok

17:36:34.0563 5176        aswSP           (010012597333da1f46c3243f33f8409e) C:\Windows\system32\drivers\aswSP.sys

17:36:34.0579 5176        aswSP - ok

17:36:34.0594 5176        aswTdi          (f9f84364416658e9786235904d448d37) C:\Windows\system32\drivers\aswTdi.sys

17:36:34.0594 5176        aswTdi - ok

17:36:34.0625 5176        AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

17:36:34.0672 5176        AsyncMac - ok

17:36:34.0688 5176        atapi           (0d83c87a801a3dfcd1bf73893fe7518c) C:\Windows\system32\drivers\atapi.sys

17:36:34.0703 5176        atapi - ok

17:36:34.0781 5176        AVMUNET         (980f4c96c73c61cc6fcf657a721b35d3) C:\Windows\system32\DRIVERS\avmunet.sys

17:36:34.0797 5176        AVMUNET - ok

17:36:34.0844 5176        Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

17:36:34.0891 5176        Beep - ok

17:36:34.0953 5176        blbdrive        (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys

17:36:35.0000 5176        blbdrive - ok

17:36:35.0047 5176        bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys

17:36:35.0125 5176        bowser - ok

17:36:35.0140 5176        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

17:36:35.0203 5176        BrFiltLo - ok

17:36:35.0218 5176        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

17:36:35.0265 5176        BrFiltUp - ok

17:36:35.0437 5176        Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

17:36:35.0515 5176        Brserid - ok

17:36:35.0530 5176        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

17:36:35.0593 5176        BrSerWdm - ok

17:36:35.0608 5176        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

17:36:35.0686 5176        BrUsbMdm - ok

17:36:35.0702 5176        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

17:36:35.0764 5176        BrUsbSer - ok

17:36:35.0795 5176        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

17:36:35.0842 5176        BTHMODEM - ok

17:36:35.0873 5176        catchme - ok

17:36:35.0905 5176        cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

17:36:35.0951 5176        cdfs - ok

17:36:35.0983 5176        cdrom           (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

17:36:35.0998 5176        cdrom - ok

17:36:36.0029 5176        circlass        (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys

17:36:36.0061 5176        circlass - ok

17:36:36.0092 5176        CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

17:36:36.0107 5176        CLFS - ok

17:36:36.0154 5176        cmdide          (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys

17:36:36.0170 5176        cmdide - ok

17:36:36.0201 5176        Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\drivers\compbatt.sys

17:36:36.0217 5176        Compbatt - ok

17:36:36.0248 5176        crcdisk         (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys

17:36:36.0248 5176        crcdisk - ok

17:36:36.0279 5176        Crusoe          (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys

17:36:36.0326 5176        Crusoe - ok

17:36:36.0404 5176        DfsC            (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys

17:36:36.0435 5176        DfsC - ok

17:36:36.0497 5176        disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

17:36:36.0513 5176        disk - ok

17:36:36.0575 5176        drmkaud         (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

17:36:36.0607 5176        drmkaud - ok

17:36:36.0653 5176        DXGKrnl         (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys

17:36:36.0669 5176        DXGKrnl - ok

17:36:36.0747 5176        e1express       (908ed85b7806e8af3af5e9b74f7809d4) C:\Windows\system32\DRIVERS\e1e6032.sys

17:36:36.0778 5176        e1express - ok

17:36:36.0809 5176        E1G60           (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys

17:36:36.0841 5176        E1G60 - ok

17:36:36.0903 5176        Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

17:36:36.0919 5176        Ecache - ok

17:36:36.0934 5176        elxstor         (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys

17:36:36.0965 5176        elxstor - ok

17:36:37.0012 5176        ErrDev          (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys

17:36:37.0059 5176        ErrDev - ok

17:36:37.0106 5176        exfat           (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

17:36:37.0168 5176        exfat - ok

17:36:37.0199 5176        fastfat         (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

17:36:37.0215 5176        fastfat - ok

17:36:37.0246 5176        fdc             (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys

17:36:37.0277 5176        fdc - ok

17:36:37.0340 5176        FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

17:36:37.0340 5176        FileInfo - ok

17:36:37.0355 5176        Filetrace       (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

17:36:37.0387 5176        Filetrace - ok

17:36:37.0418 5176        flpydisk        (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys

17:36:37.0449 5176        flpydisk - ok

17:36:37.0496 5176        FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

17:36:37.0511 5176        FltMgr - ok

17:36:37.0527 5176        Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

17:36:37.0574 5176        Fs_Rec - ok

17:36:37.0605 5176        gagp30kx        (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys

17:36:37.0621 5176        gagp30kx - ok

17:36:37.0714 5176        HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys

17:36:37.0745 5176        HdAudAddService - ok

17:36:37.0792 5176        HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

17:36:37.0839 5176        HDAudBus - ok

17:36:37.0870 5176        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

17:36:37.0933 5176        HidBth - ok

17:36:37.0964 5176        HidIr           (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys

17:36:38.0026 5176        HidIr - ok

17:36:38.0073 5176        HidUsb          (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

17:36:38.0104 5176        HidUsb - ok

17:36:38.0135 5176        HpCISSs         (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys

17:36:38.0151 5176        HpCISSs - ok

17:36:38.0198 5176        HTTP            (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys

17:36:38.0245 5176        HTTP - ok

17:36:38.0276 5176        i2omp           (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys

17:36:38.0291 5176        i2omp - ok

17:36:38.0338 5176        i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

17:36:38.0369 5176        i8042prt - ok

17:36:38.0401 5176        iaStor          (28aae599496b4930b3f19026f2083bc4) C:\Windows\system32\DRIVERS\iaStor.sys

17:36:38.0416 5176        iaStor - ok

17:36:38.0432 5176        iaStorV         (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys

17:36:38.0447 5176        iaStorV - ok

17:36:38.0463 5176        iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

17:36:38.0463 5176        iirsp - ok

17:36:38.0588 5176        IntcAzAudAddService (345ac48d17f5c2f2aa1ee50d34c3978b) C:\Windows\system32\drivers\RTKVHDA.sys

17:36:38.0681 5176        IntcAzAudAddService - ok

17:36:38.0697 5176        intelide        (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys

17:36:38.0713 5176        intelide - ok

17:36:38.0728 5176        intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys

17:36:38.0775 5176        intelppm - ok

17:36:38.0806 5176        IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

17:36:38.0853 5176        IpFilterDriver - ok

17:36:38.0853 5176        IpInIp - ok

17:36:38.0884 5176        IPMIDRV         (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys

17:36:38.0915 5176        IPMIDRV - ok

17:36:38.0931 5176        IPNAT           (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

17:36:38.0962 5176        IPNAT - ok

17:36:38.0978 5176        IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

17:36:39.0025 5176        IRENUM - ok

17:36:39.0040 5176        isapnp          (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys

17:36:39.0056 5176        isapnp - ok

17:36:39.0087 5176        iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

17:36:39.0103 5176        iScsiPrt - ok

17:36:39.0134 5176        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

17:36:39.0134 5176        iteatapi - ok

17:36:39.0165 5176        iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

17:36:39.0165 5176        iteraid - ok

17:36:39.0181 5176        kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

17:36:39.0196 5176        kbdclass - ok

17:36:39.0212 5176        kbdhid          (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys

17:36:39.0259 5176        kbdhid - ok

17:36:39.0290 5176        KSecDD          (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys

17:36:39.0321 5176        KSecDD - ok

17:36:39.0368 5176        Lbd - ok

17:36:39.0383 5176        lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

17:36:39.0430 5176        lltdio - ok

17:36:39.0477 5176        LSI_FC          (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys

17:36:39.0493 5176        LSI_FC - ok

17:36:39.0508 5176        LSI_SAS         (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys

17:36:39.0524 5176        LSI_SAS - ok

17:36:39.0586 5176        LSI_SCSI        (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys

17:36:39.0586 5176        LSI_SCSI - ok

17:36:39.0602 5176        luafv           (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

17:36:39.0664 5176        luafv - ok

17:36:39.0711 5176        megasas         (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys

17:36:39.0727 5176        megasas - ok

17:36:39.0773 5176        MegaSR          (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys

17:36:39.0789 5176        MegaSR - ok

17:36:39.0805 5176        Modem           (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

17:36:39.0836 5176        Modem - ok

17:36:39.0867 5176        monitor         (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

17:36:39.0914 5176        monitor - ok

17:36:39.0929 5176        mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

17:36:39.0945 5176        mouclass - ok

17:36:39.0976 5176        mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

17:36:39.0992 5176        mouhid - ok

17:36:40.0007 5176        MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

17:36:40.0023 5176        MountMgr - ok

17:36:40.0070 5176        mpio            (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys

17:36:40.0085 5176        mpio - ok

17:36:40.0101 5176        mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

17:36:40.0132 5176        mpsdrv - ok

17:36:40.0179 5176        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

17:36:40.0195 5176        Mraid35x - ok

17:36:40.0210 5176        MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

17:36:40.0257 5176        MRxDAV - ok

17:36:40.0273 5176        mrxsmb          (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys

17:36:40.0288 5176        mrxsmb - ok

17:36:40.0351 5176        mrxsmb10        (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys

17:36:40.0397 5176        mrxsmb10 - ok

17:36:40.0429 5176        mrxsmb20        (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

17:36:40.0460 5176        mrxsmb20 - ok

17:36:40.0507 5176        msahci          (f70590424eefbf5c27a40c67afdb8383) C:\Windows\system32\drivers\msahci.sys

17:36:40.0507 5176        msahci - ok

17:36:40.0553 5176        msdsm           (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys

17:36:40.0553 5176        msdsm - ok

17:36:40.0585 5176        Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

17:36:40.0756 5176        Msfs - ok

17:36:40.0819 5176        msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

17:36:40.0834 5176        msisadrv - ok

17:36:40.0881 5176        MSKSSRV         (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

17:36:40.0928 5176        MSKSSRV - ok

17:36:40.0959 5176        MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

17:36:40.0975 5176        MSPCLOCK - ok

17:36:40.0990 5176        MSPQM           (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

17:36:41.0021 5176        MSPQM - ok

17:36:41.0037 5176        MsRPC           (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

17:36:41.0053 5176        MsRPC - ok

17:36:41.0068 5176        mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

17:36:41.0084 5176        mssmbios - ok

17:36:41.0099 5176        MSTEE           (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

17:36:41.0131 5176        MSTEE - ok

17:36:41.0146 5176        Mup             (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

17:36:41.0162 5176        Mup - ok

17:36:41.0209 5176        NativeWifiP     (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

17:36:41.0224 5176        NativeWifiP - ok

17:36:41.0271 5176        NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

17:36:41.0287 5176        NDIS - ok

17:36:41.0349 5176        NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

17:36:41.0380 5176        NdisTapi - ok

17:36:41.0380 5176        Ndisuio         (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

17:36:41.0411 5176        Ndisuio - ok

17:36:41.0443 5176        NdisWan         (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

17:36:41.0474 5176        NdisWan - ok

17:36:41.0505 5176        NDProxy         (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

17:36:41.0536 5176        NDProxy - ok

17:36:41.0583 5176        NetBIOS         (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

17:36:41.0614 5176        NetBIOS - ok

17:36:41.0630 5176        netbt           (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

17:36:41.0645 5176        netbt - ok

17:36:41.0739 5176        netr28u         (2e812881ec96e80eae304877ed90206b) C:\Windows\system32\DRIVERS\netr28u.sys

17:36:41.0848 5176        netr28u ( UnsignedFile.Multi.Generic ) - warning

17:36:41.0848 5176        netr28u - detected UnsignedFile.Multi.Generic (1)

17:36:41.0879 5176        nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

17:36:41.0895 5176        nfrd960 - ok

17:36:41.0926 5176        Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

17:36:41.0957 5176        Npfs - ok

17:36:41.0989 5176        nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

17:36:42.0020 5176        nsiproxy - ok

17:36:42.0082 5176        Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

17:36:42.0176 5176        Ntfs - ok

17:36:42.0207 5176        ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

17:36:42.0254 5176        ntrigdigi - ok

17:36:42.0254 5176        Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

17:36:42.0301 5176        Null - ok

17:36:42.0488 5176        nvlddmkm        (433b35bcc2a5cb7ecb0b807d6ed38d4e) C:\Windows\system32\DRIVERS\nvlddmkm.sys

17:36:42.0722 5176        nvlddmkm - ok

17:36:42.0769 5176        nvraid          (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys

17:36:42.0784 5176        nvraid - ok

17:36:42.0800 5176        nvstor          (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys

17:36:42.0815 5176        nvstor - ok

17:36:42.0831 5176        nv_agp          (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys

17:36:42.0831 5176        nv_agp - ok

17:36:42.0847 5176        NwlnkFlt - ok

17:36:42.0847 5176        NwlnkFwd - ok

17:36:42.0925 5176        NxpCap          (35ebe490c993f39091ce7bf89e725b0c) C:\Windows\system32\DRIVERS\NxpCap.sys

17:36:42.0971 5176        NxpCap - ok

17:36:43.0034 5176        ohci1394        (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys

17:36:43.0065 5176        ohci1394 - ok

17:36:43.0112 5176        Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

17:36:43.0174 5176        Parport - ok

17:36:43.0221 5176        partmgr         (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

17:36:43.0221 5176        partmgr - ok

17:36:43.0237 5176        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

17:36:43.0283 5176        Parvdm - ok

17:36:43.0315 5176        pci             (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

17:36:43.0330 5176        pci - ok

17:36:43.0346 5176        pciide          (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys

17:36:43.0346 5176        pciide - ok

17:36:43.0361 5176        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

17:36:43.0377 5176        pcmcia - ok

17:36:43.0424 5176        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

17:36:43.0486 5176        PEAUTH - ok

17:36:43.0549 5176        PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

17:36:43.0580 5176        PptpMiniport - ok

17:36:43.0611 5176        Processor       (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys

17:36:43.0642 5176        Processor - ok

17:36:43.0689 5176        PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

17:36:43.0736 5176        PSched - ok

17:36:43.0814 5176        PxHelp20        (49452bfcec22f36a7a9b9c2181bc3042) C:\Windows\system32\Drivers\PxHelp20.sys

17:36:43.0829 5176        PxHelp20 - ok

17:36:43.0876 5176        ql2300          (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys

17:36:43.0970 5176        ql2300 - ok

17:36:44.0032 5176        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

17:36:44.0048 5176        ql40xx - ok

17:36:44.0063 5176        QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

17:36:44.0095 5176        QWAVEdrv - ok

17:36:44.0126 5176        RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

17:36:44.0173 5176        RasAcd - ok

17:36:44.0204 5176        Rasl2tp         (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

17:36:44.0219 5176        Rasl2tp - ok

17:36:44.0251 5176        RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

17:36:44.0282 5176        RasPppoe - ok

17:36:44.0313 5176        RasSstp         (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

17:36:44.0329 5176        RasSstp - ok

17:36:44.0360 5176        rdbss           (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

17:36:44.0375 5176        rdbss - ok

17:36:44.0391 5176        RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

17:36:44.0422 5176        RDPCDD - ok

17:36:44.0438 5176        rdpdr           (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys

17:36:44.0469 5176        rdpdr - ok

17:36:44.0485 5176        RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

17:36:44.0500 5176        RDPENCDD - ok

17:36:44.0531 5176        RDPWD           (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys

17:36:44.0578 5176        RDPWD - ok

17:36:44.0625 5176        rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

17:36:44.0656 5176        rspndr - ok

17:36:44.0687 5176        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

17:36:44.0703 5176        sbp2port - ok

17:36:44.0781 5176        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

17:36:44.0843 5176        secdrv - ok

17:36:44.0875 5176        Serenum         (ce9ec966638ef0b10b864ddedf62a099) C:\Windows\system32\DRIVERS\serenum.sys

17:36:44.0906 5176        Serenum - ok

17:36:44.0937 5176        Serial          (6d663022db3e7058907784ae14b69898) C:\Windows\system32\DRIVERS\serial.sys

17:36:44.0968 5176        Serial - ok

17:36:44.0984 5176        sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

17:36:44.0999 5176        sermouse - ok

17:36:45.0015 5176        sffdisk         (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys

17:36:45.0046 5176        sffdisk - ok

17:36:45.0046 5176        sffp_mmc        (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys

17:36:45.0077 5176        sffp_mmc - ok

17:36:45.0093 5176        sffp_sd         (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys

17:36:45.0140 5176        sffp_sd - ok

17:36:45.0171 5176        sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

17:36:45.0233 5176        sfloppy - ok

17:36:45.0265 5176        sisagp          (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys

17:36:45.0265 5176        sisagp - ok

17:36:45.0296 5176        SiSRaid2        (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys

17:36:45.0296 5176        SiSRaid2 - ok

17:36:45.0327 5176        SiSRaid4        (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys

17:36:45.0327 5176        SiSRaid4 - ok

17:36:45.0358 5176        Smb             (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys

17:36:45.0405 5176        Smb - ok

17:36:45.0639 5176        SNPSTD3         (4b0e6dfe7905db8cb7318c0d23abc4ea) C:\Windows\system32\DRIVERS\snpstd3.sys

17:36:46.0169 5176        SNPSTD3 - ok

17:36:46.0232 5176        spldr           (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

17:36:46.0247 5176        spldr - ok

17:36:46.0294 5176        srv             (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys

17:36:46.0325 5176        srv - ok

17:36:46.0357 5176        srv2            (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys

17:36:46.0388 5176        srv2 - ok

17:36:46.0419 5176        srvnet          (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys

17:36:46.0435 5176        srvnet - ok

17:36:46.0481 5176        swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

17:36:46.0497 5176        swenum - ok

17:36:46.0497 5176        Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

17:36:46.0513 5176        Symc8xx - ok

17:36:46.0528 5176        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

17:36:46.0544 5176        Sym_hi - ok

17:36:46.0559 5176        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

17:36:46.0559 5176        Sym_u3 - ok

17:36:46.0606 5176        Tcpip           (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys

17:36:46.0669 5176        Tcpip - ok

17:36:46.0700 5176        Tcpip6          (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys

17:36:46.0747 5176        Tcpip6 - ok

17:36:46.0778 5176        tcpipreg        (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys

17:36:46.0809 5176        tcpipreg - ok

17:36:46.0840 5176        TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

17:36:46.0871 5176        TDPIPE - ok

17:36:46.0918 5176        TDTCP           (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

17:36:46.0949 5176        TDTCP - ok

17:36:46.0981 5176        tdx             (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

17:36:47.0012 5176        tdx - ok

17:36:47.0137 5176        TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

17:36:47.0152 5176        TermDD - ok

17:36:47.0183 5176        tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

17:36:47.0215 5176        tssecsrv - ok

17:36:47.0246 5176        tunmp           (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

17:36:47.0277 5176        tunmp - ok

17:36:47.0339 5176        tunnel          (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys

17:36:47.0355 5176        tunnel - ok

17:36:47.0402 5176        uagp35          (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys

17:36:47.0417 5176        uagp35 - ok

17:36:47.0433 5176        udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

17:36:47.0449 5176        udfs - ok

17:36:47.0480 5176        uliagpkx        (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys

17:36:47.0480 5176        uliagpkx - ok

17:36:47.0511 5176        uliahci         (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys

17:36:47.0527 5176        uliahci - ok

17:36:47.0542 5176        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

17:36:47.0558 5176        UlSata - ok

17:36:47.0558 5176        ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

17:36:47.0573 5176        ulsata2 - ok

17:36:47.0589 5176        umbus           (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

17:36:47.0636 5176        umbus - ok

17:36:47.0683 5176        usbccgp         (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

17:36:47.0714 5176        usbccgp - ok

17:36:47.0745 5176        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

17:36:47.0807 5176        usbcir - ok

17:36:47.0839 5176        usbehci         (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

17:36:47.0885 5176        usbehci - ok

17:36:47.0917 5176        usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

17:36:47.0948 5176        usbhub - ok

17:36:47.0963 5176        usbohci         (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys

17:36:48.0010 5176        usbohci - ok

17:36:48.0026 5176        usbprint        (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys

17:36:48.0057 5176        usbprint - ok

17:36:48.0088 5176        usbscan         (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys

17:36:48.0104 5176        usbscan - ok

17:36:48.0119 5176        USBSTOR         (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

17:36:48.0135 5176        USBSTOR - ok

17:36:48.0151 5176        usbuhci         (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys

17:36:48.0197 5176        usbuhci - ok

17:36:48.0229 5176        vga             (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys

17:36:48.0275 5176        vga - ok

17:36:48.0291 5176        VgaSave         (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

17:36:48.0322 5176        VgaSave - ok

17:36:48.0338 5176        viaagp          (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys

17:36:48.0353 5176        viaagp - ok

17:36:48.0369 5176        ViaC7           (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys

17:36:48.0385 5176        ViaC7 - ok

17:36:48.0400 5176        viaide          (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys

17:36:48.0416 5176        viaide - ok

17:36:48.0431 5176        volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

17:36:48.0447 5176        volmgr - ok

17:36:48.0478 5176        volmgrx         (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

17:36:48.0494 5176        volmgrx - ok

17:36:48.0494 5176        volsnap         (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

17:36:48.0509 5176        volsnap - ok

17:36:48.0556 5176        vsmraid         (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys

17:36:48.0572 5176        vsmraid - ok

17:36:48.0587 5176        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

17:36:48.0634 5176        WacomPen - ok

17:36:48.0634 5176        Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

17:36:48.0665 5176        Wanarp - ok

17:36:48.0681 5176        Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

17:36:48.0712 5176        Wanarpv6 - ok

17:36:48.0728 5176        Wd              (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys

17:36:48.0743 5176        Wd - ok

17:36:48.0775 5176        Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys

17:36:48.0790 5176        Wdf01000 - ok

17:36:48.0884 5176        WmiAcpi         (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\drivers\wmiacpi.sys

17:36:48.0915 5176        WmiAcpi - ok

17:36:48.0962 5176        WpdUsb          (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys

17:36:48.0977 5176        WpdUsb - ok

17:36:48.0993 5176        ws2ifsl         (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

17:36:49.0040 5176        ws2ifsl - ok

17:36:49.0087 5176        WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

17:36:49.0118 5176        WUDFRd - ok

17:36:49.0149 5176        X10Hid          (ab2d77bf7222b007717abb61b15f9ae2) C:\Windows\system32\Drivers\x10hid.sys

17:36:49.0149 5176        X10Hid - ok

17:36:49.0196 5176        XUIF            (6bbf7a3bab8ffdccf82057fa2aae2b7b) C:\Windows\system32\Drivers\x10ufx2.sys

17:36:49.0211 5176        XUIF - ok

17:36:49.0243 5176        MBR (0x1B8)     (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0

17:36:49.0383 5176        \Device\Harddisk0\DR0 - ok

17:36:49.0383 5176        Boot (0x1200)   (4aaf4a98fc25a4a7ad9008d4ba50c369) \Device\Harddisk0\DR0\Partition0

17:36:49.0399 5176        \Device\Harddisk0\DR0\Partition0 - ok

17:36:49.0414 5176        Boot (0x1200)   (8106bcf4512c3fa93c070df4084d8e08) \Device\Harddisk0\DR0\Partition1

17:36:49.0414 5176        \Device\Harddisk0\DR0\Partition1 - ok

17:36:49.0414 5176        ============================================================

17:36:49.0414 5176        Scan finished

17:36:49.0414 5176        ============================================================

17:36:49.0414 6116        Detected object count: 1

17:36:49.0414 6116        Actual detected object count: 1

17:38:05.0574 6116        netr28u ( UnsignedFile.Multi.Generic ) - skipped by user

17:38:05.0574 6116        netr28u ( UnsignedFile.Multi.Generic ) - User select action: Skip

Ansonsten habe ich schon mal SUPERAntispyware und aswMBR laufen lassen.

Code:

SUPERAntiSpyware Scann-Protokoll

hxxp://www.superantispyware.com
 

Generiert 12/29/2011 bei 08:46 PM
 

Version der Applikation : 5.0.1142
 

Version der Kern-Datenbank : 8089

Version der Spur-Datenbank : 5901
 

Scan Art       : Schneller Scann

Totale Scann-Zeit : 00:03:44
 

Operating System Information

Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)

UAC On - Administrator
 

Gescannte Speicherelemente  : 734

Erfasste Speicher-Bedrohungen  : 0

Gescannte Register-Elemente  : 30087

Erfasste Register-Bedrohungen  : 0

Gescannte Datei-Elemente     : 7545

Erfasste Datei-Elemente   : 0

Code:

aswMBR version 0.9.9.1124 Copyright(c) 2011 AVAST Software

Run date: 2011-12-29 19:21:51

-----------------------------

19:21:51.504    OS Version: Windows 6.0.6002 Service Pack 2

19:21:51.504    Number of processors: 4 586 0x1707

19:21:51.504    ComputerName: A-PC  UserName: a

19:22:01.706    Initialize success

19:22:01.815    AVAST engine defs: 11122900

19:22:20.177    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

19:22:20.177    Disk 0 Vendor: WDC_WD10 01.0 Size: 953869MB BusType: 3

19:22:20.177    Disk 0 MBR read successfully

19:22:20.177    Disk 0 MBR scan

19:22:20.192    Disk 0 Windows VISTA default MBR code

19:22:20.208    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       933377 MB offset 2048

19:22:20.208    Disk 0 Partition - 00     0F Extended LBA             20489 MB offset 1911558222

19:22:20.223    Disk 0 Partition 2 00     0B        FAT32 MSDOS5.0    20489 MB offset 1911558285

19:22:20.239    Disk 0 scanning sectors +1953520065

19:22:20.286    Disk 0 scanning C:\Windows\system32\drivers

19:22:25.387    Service scanning

19:22:26.760    Modules scanning

19:22:30.005    Disk 0 trace - called modules:

19:22:30.020    ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll 

19:22:30.036    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87b1d968]

19:22:30.036    3 CLASSPNP.SYS[8c19f8b3] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x86775030]

19:22:32.703    AVAST engine scan C:\Windows

19:22:39.521    AVAST engine scan C:\Windows\system32

19:24:08.253    AVAST engine scan C:\Windows\system32\drivers

19:24:39.578    AVAST engine scan C:\Users\a

20:00:34.110    AVAST engine scan C:\ProgramData

20:03:27.847    Scan finished successfully

20:31:27.218    Disk 0 MBR has been saved successfully to "C:\Users\a\Desktop\MBR.dat"

20:31:27.234    The log file has been saved successfully to "C:\Users\a\Desktop\aswMBR.txt"

Zitat:

Ansonsten habe ich schon mal SUPERAntiSpyware und aswMBR laufen lassen.

Bitte führ nicht einfach irgendwas aus, sondern halte dich an die Anweisungen!

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Nach dem Laufen von ComboFix kam es zu einem Bluescreen und der Computer wurde neu gestartet, Windows meldete ein unerwartetes Herunterfahren.
Den ComboFix-Text habe ich aus C:\combofix

Code:

omboFix 11-12-29.05 - a 30.12.2011  11:01:37.2.4 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3325.2462 [GMT 1:00]

ausgeführt von:: C:\Users\a\Desktop\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
 
 

C:\Program Files\aaw2008_11n.exe

C:\Program Files\GS_Index_20071215.exe

C:\Program Files\mbam-setup-1.51.1.1800.exe

C:\Windows\Windows6.0-KB948465-X86.exe
 
 

(((((((((((((((((((((((   Dateien erstellt von 2011-11-28 bis 2011-12-30  ))))))))))))))))))))))))))))))
 
 

2011-12-30 10:08:52 . 2011-12-30 10:08:58        --------        d-----w-        C:\Users\a\AppData\Local\temp

2011-12-30 10:08:52 . 2011-12-30 10:08:52        --------        d-----w-        C:\Users\Public\AppData\Local\temp

2011-12-30 10:08:52 . 2011-12-30 10:08:52        --------        d-----w-        C:\Users\Default\AppData\Local\temp

2011-12-29 19:37:54 . 2011-12-29 19:37:54        --------        d-----w-        C:\Users\a\AppData\Roaming\SUPERAntiSpyware.com

2011-12-29 19:37:14 . 2011-12-29 19:37:54        --------        d-----w-        C:\Program Files\SUPERAntiSpyware

2011-12-29 16:07:03 . 2011-12-29 16:07:03        56200        ----a-w-        C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{69228D0E-710D-4C42-9F2A-812FA8992112}\offreg.dll        ERROR(0x00000005)

2011-12-27 14:09:50 . 2011-11-21 10:47:38        6823496        ----a-w-        C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{69228D0E-710D-4C42-9F2A-812FA8992112}\mpengine.dll        ERROR(0x00000005)

2011-12-14 11:55:37 . 2011-10-27 08:01:53        3602816        ----a-w-        C:\Windows\system32\ntkrnlpa.exe

2011-12-14 11:55:37 . 2011-10-27 08:01:53        3550080        ----a-w-        C:\Windows\system32\ntoskrnl.exe

2011-12-14 11:55:35 . 2011-11-23 13:37:27        2043904        ----a-w-        C:\Windows\system32\win32k.sys

2011-12-14 11:55:35 . 2011-10-14 16:02:19        429056        ----a-w-        C:\Windows\system32\EncDec.dll

2011-12-14 11:55:34 . 2011-11-08 12:10:10        2409784        ----a-w-        C:\Program Files\Windows Mail\OESpamFilter.dat

2011-12-14 11:55:34 . 2011-10-25 15:56:04        49152        ----a-w-        C:\Windows\system32\csrsrv.dll

2011-12-14 11:55:33 . 2011-11-08 14:42:19        2048        ----a-w-        C:\Windows\system32\tzres.dll

.
 
 

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
 

2011-12-29 15:56:33 . 2011-06-22 13:04:07        414368        ----a-w-        C:\Windows\system32\FlashPlayerCPLApp.cpl

2011-12-10 14:24:06 . 2011-09-13 12:01:40        20464        ----a-w-        C:\Windows\system32\drivers\mbam.sys

2011-11-28 18:01:25 . 2010-06-29 12:56:38        41184        ----a-w-        C:\Windows\avastSS.scr

2011-11-28 18:01:23 . 2008-12-13 20:23:56        199816        ----a-w-        C:\Windows\system32\aswBoot.exe

2011-11-28 17:53:53 . 2011-04-04 14:57:44        435032        ----a-w-        C:\Windows\system32\drivers\aswSnx.sys

2011-11-28 17:53:35 . 2008-12-13 20:24:03        314456        ----a-w-        C:\Windows\system32\drivers\aswSP.sys

2011-11-28 17:52:19 . 2008-12-13 20:24:03        34392        ----a-w-        C:\Windows\system32\drivers\aswRdr.sys

2011-11-28 17:52:16 . 2008-12-13 20:24:03        52952        ----a-w-        C:\Windows\system32\drivers\aswTdi.sys

2011-11-28 17:52:07 . 2008-12-13 20:23:56        55128        ----a-w-        C:\Windows\system32\drivers\aswMonFlt.sys

2011-11-28 17:51:50 . 2008-12-13 20:24:03        20568        ----a-w-        C:\Windows\system32\drivers\aswFsBlk.sys

2011-11-24 16:11:06 . 2011-11-24 16:11:03        3511776        ----a-w-        C:\Program Files\ccsetup312.exe

2011-11-21 10:47:38 . 2008-10-08 09:57:06        6823496        ----a-w-        C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll        ERROR(0x00000005)

2011-11-17 15:56:09 . 2011-11-17 15:56:06        2448704        ----a-w-        C:\Program Files\mp3tagv249asetup.exe

2011-11-13 17:53:16 . 2011-11-13 17:51:03        199812300        ----a-w-        C:\Program Files\LibO_3.4.4_Win_x86_install_multi.exe

2011-11-13 12:04:27 . 2008-10-08 11:01:08        319456        ----a-w-        C:\Windows\DIFxAPI.dll

2011-11-13 11:43:01 . 2011-11-13 11:39:01        51566481        ----a-w-        C:\Program Files\32bit_Vista_Win7_R266.exe

2011-11-12 15:48:45 . 2011-11-12 15:48:12        44579152        ----a-w-        C:\Program Files\calibre-0.8.26.msi

2011-11-07 21:12:32 . 2011-11-07 21:12:11        44517200        ----a-w-        C:\Program Files\calibre-0.8.25.msi

2011-10-18 18:53:14 . 2011-11-13 12:04:10        3546664        ----a-w-        C:\Windows\system32\drivers\RTKVHDA.sys

2011-10-18 17:10:30 . 2011-11-13 12:04:09        83048        ----a-w-        C:\Windows\system32\RtkCoInst.dll

2011-10-18 14:57:10 . 2011-11-13 12:04:15        58264        ----a-w-        C:\Windows\system32\TepeqAPO.dll

2011-10-18 12:47:22 . 2011-11-13 12:04:09        1329768        ----a-w-        C:\Windows\system32\RtkApoApi.dll

2011-10-18 10:05:00 . 2011-11-13 12:04:10        2276968        ----a-w-        C:\Windows\system32\RtkPgExt.dll

2011-10-17 16:30:38 . 2011-11-13 12:04:08        4238440        ----a-w-        C:\Windows\system32\RtkAPO.dll

2011-10-14 12:43:36 . 2011-11-13 12:04:06        1873920        ----a-w-        C:\Windows\system32\RCoRes.dat

2011-10-03 03:06:03 . 2010-10-19 14:27:02        472808        ----a-w-        C:\Windows\system32\deployJava1.dll

2011-09-29 20:56:25 . 2011-09-29 20:56:24        3495424        ----a-w-        C:\Program Files\ccsetup311.exe

2011-09-29 20:37:05 . 2011-09-29 20:37:03        158832        ----a-w-        C:\Program Files\1by1_175.exe

2011-09-17 13:22:38 . 2011-09-17 13:22:37        3127456        ----a-w-        C:\Program Files\install_flash_player_ax.exe

2011-09-16 14:55:46 . 2011-09-16 14:55:44        908576        ----a-w-        C:\Program Files\jxpiinstall.exe

2011-09-16 13:44:39 . 2011-09-16 13:44:33        18702336        ----a-w-        C:\Program Files\PXCViewer_x86.msi

2011-09-15 13:23:12 . 2011-09-15 13:22:37        12570736        ----a-w-        C:\Program Files\SUPERAntiSpyware.exe

2011-09-13 13:39:34 . 2011-09-13 13:39:32        2322184        ----a-w-        C:\Program Files\esetsmartinstaller_enu.exe

2011-09-12 15:08:00 . 2011-09-12 15:07:55        10268672        ----a-w-        C:\Program Files\Ad-Aware95Install.msi

2011-08-03 16:11:14 . 2011-08-03 16:11:00        21073936        ----a-w-        C:\Program Files\vlc-1.1.11-win32.exe

2011-07-29 14:37:22 . 2011-07-29 14:37:17        2448352        ----a-w-        C:\Program Files\mp3tagv249setup.exe

2011-06-28 13:09:21 . 2011-06-28 13:09:07        21022914        ----a-w-        C:\Program Files\vlc-1.1.10-win32.exe

2011-05-30 20:07:55 . 2011-05-30 20:07:51        1402880        ----a-w-        C:\Program Files\HiJackThis.msi

2011-05-30 14:17:33 . 2011-05-30 14:17:28        3096424        ----a-w-        C:\Program Files\ccsetup307.exe

2011-04-28 14:07:20 . 2011-04-28 14:07:16        2446680        ----a-w-        C:\Program Files\mp3tagv248setup.exe

2011-04-26 16:04:49 . 2011-04-26 16:03:55        20533281        ----a-w-        C:\Program Files\vlc-1.1.9-win32.exe

2011-04-23 11:59:41 . 2011-04-23 11:59:39        568648        ----a-w-        C:\Program Files\GoogleEarthSetup.exe

2011-04-04 17:24:31 . 2011-04-04 17:24:26        3050664        ----a-w-        C:\Program Files\ccsetup305.exe

2011-04-04 15:09:03 . 2011-04-04 15:08:58        247053        ----a-w-        C:\Program Files\mp3DC213.exe

2011-03-31 11:08:14 . 2011-03-31 11:08:00        20586196        ----a-w-        C:\Program Files\vlc-1.1.8-win32.exe

2011-03-20 14:06:40 . 2011-03-20 14:06:40        772384        ----a-w-        C:\Program Files\Mats_Run.performance.exe

2011-03-20 14:05:44 . 2011-03-20 14:05:43        772896        ----a-w-        C:\Program Files\Mats_Run.printing.exe

2011-03-18 11:56:34 . 2011-03-18 11:56:26        20364702        ----a-w-        C:\Program Files\vlc-1.1.7-win32.exe

2011-03-18 11:52:29 . 2011-03-18 11:52:24        6277496        ----a-w-        C:\Program Files\Silverlight.exe

2011-02-20 15:40:23 . 2011-02-20 15:36:14        168166968        ----a-w-        C:\Program Files\OOo_3.3.0_Win_x86_install-wJRE_de.exe

2011-01-26 16:52:54 . 2011-01-26 16:52:49        3006368        ----a-w-        C:\Program Files\ccsetup303.exe

2011-01-06 15:49:55 . 2011-01-06 15:49:33        38147376        ----a-w-        C:\Program Files\QuickTimeInstaller.exe

2010-12-30 15:04:03 . 2010-12-30 15:03:35        4044900        ----a-w-        C:\Program Files\tipp10_win_v2-0-3.exe

2010-12-20 11:43:49 . 2010-12-20 11:43:43        4750496        ----a-w-        C:\Program Files\Shockwave_Installer_Slim.exe

2010-12-09 15:21:50 . 2010-12-09 15:21:36        19985265        ----a-w-        C:\Program Files\vlc-1.1.5-win32.exe

2010-10-26 15:08:19 . 2010-10-26 15:08:18        226402        ----a-w-        C:\Program Files\mp3DC212.exe

2010-10-14 19:42:56 . 2010-10-14 19:42:28        4229377        ----a-w-        C:\Program Files\OrbitSetup4.0.3.exe

2010-08-28 10:45:53 . 2010-08-28 10:44:33        19657194        ----a-w-        C:\Program Files\vlc-1.1.4-win32.exe

2010-08-20 12:25:01 . 2010-08-20 12:23:40        19563096        ----a-w-        C:\Program Files\vlc-1.1.3-win32.exe

2010-08-10 14:13:14 . 2010-08-10 14:04:16        128750008        ----a-w-        C:\Program Files\Ad-AwareInstall.exe

2010-08-02 12:16:06 . 2010-08-02 12:14:46        19461015        ----a-w-        C:\Program Files\vlc-1.1.2-win32.exe

2010-08-01 12:43:52 . 2010-08-01 12:43:51        1295402        ----a-w-        C:\Program Files\ag_mp3_plugin_setup.exe

2010-07-27 12:20:47 . 2010-07-27 12:10:19        151343200        ----a-w-        C:\Program Files\OOo_3.2.1_Win_x86_install_de.exe

2010-05-25 18:43:14 . 2010-05-25 18:43:14        3099136        ----a-w-        C:\Program Files\openofficeorg32.msi

2010-05-20 13:50:51 . 2010-05-20 13:50:50        150358        ----a-w-        C:\Program Files\1by1_169.exe

2010-05-03 11:02:53 . 2010-05-03 11:02:38        5461276        ----a-w-        C:\Program Files\TMViewerSetup.exe

2010-04-07 12:40:48 . 2010-04-07 12:40:38        3376656        ----a-w-        C:\Program Files\ccsetup230.exe

2010-03-04 15:42:06 . 2010-03-04 15:10:43        167555440        ----a-w-        C:\Program Files\OOo_3.2.0_Win32Intel_install_wJRE_de.exe

2010-03-02 14:44:28 . 2010-03-02 14:44:27        2024035        ----a-w-        C:\Program Files\Firesave.exe

2010-03-02 12:32:21 . 2010-03-02 12:31:34        8853856        ----a-w-        C:\Program Files\Thunderbird Setup 3.0.3.exe

2010-03-02 12:06:41 . 2010-03-02 12:06:40        1772267        ----a-w-        C:\Program Files\Thundersave_1.0.exe

2010-02-19 12:43:42 . 2010-02-19 12:40:40        44518776        ----a-w-        C:\Program Files\setup_av_free_2_.exe

2010-02-06 14:07:49 . 2010-02-06 14:06:34        18499623        ----a-w-        C:\Program Files\vlc-1.0.5-win32.exe

2010-01-29 17:38:01 . 2010-01-29 17:37:52        3370400        ----a-w-        C:\Program Files\ccsetup228.exe

2010-01-28 17:53:15 . 2010-01-28 17:53:14        127083        ----a-w-        C:\Program Files\1by1_168.exe

2010-01-28 17:18:20 . 2010-01-28 17:18:12        2572472        ----a-w-        C:\Program Files\OrbitDownloaderSetup.exe

2009-12-02 12:06:35 . 2009-12-02 12:06:33        1128916        ----a-w-        C:\Program Files\pdf2wordsetup.exe

2009-11-29 20:12:45 . 2009-11-29 20:12:00        12543460        ----a-w-        C:\Program Files\pdfsam-win32inst-v2_0_0.exe

2009-10-26 13:49:09 . 2009-10-26 13:44:08        77086488        ----a-w-        C:\Program Files\Ad-AwareInstallation.exe

2009-10-14 12:26:57 . 2009-10-14 12:26:51        3309072        ----a-w-        C:\Program Files\ccsetup224.exe

2009-10-07 11:55:47 . 2009-10-07 11:45:28        149845064        ----a-w-        C:\Program Files\OOo_3.1.1_Win32Intel_install_de.exe

2009-07-11 12:36:28 . 2009-07-11 12:35:13        17828326        ----a-w-        C:\Program Files\vlc-1.0.0-win32.exe

2009-06-26 15:59:36 . 2009-06-26 15:59:35        728103        ----a-w-        C:\Program Files\VAL v1.1.1 Setup.exe

2009-05-15 11:43:08 . 2009-05-15 11:43:03        3227248        ----a-w-        C:\Program Files\ccsetup219.exe

2009-05-08 21:16:48 . 2009-05-08 21:15:49        16742799        ----a-w-        C:\Program Files\vlc-0.9.9-win32.exe

2009-05-07 13:42:11 . 2009-05-07 13:31:52        147695064        ----a-w-        C:\Program Files\OOo_3.1.0_Win32Intel_install_de.exe

2009-05-05 14:01:41 . 2009-05-05 14:01:41        212713        ----a-w-        C:\Program Files\mp3DC211.exe

2009-05-05 13:59:55 . 2009-05-05 13:59:51        121784        ----a-w-        C:\Program Files\1by1_167.exe

2009-04-27 13:16:42 . 2009-04-27 13:16:35        3190688        ----a-w-        C:\Program Files\ccsetup218.exe

2009-04-27 10:03:46 . 2009-04-27 10:03:46        9818624        ----a-w-        C:\Program Files\openofficeorg31.msi

2009-04-21 12:18:24 . 2009-04-21 12:16:06        34543112        ----a-w-        C:\Program Files\Ad-AwareAE.exe

2009-02-19 17:00:19 . 2009-02-19 16:59:10        16409960        ----a-w-        C:\Program Files\spybotsd162.exe

2009-01-04 17:29:14 . 2009-01-04 17:29:10        938576        ----a-w-        C:\Program Files\7z463.exe

2009-01-02 15:07:39 . 2009-01-02 15:05:44        16320472        ----a-w-        C:\Program Files\vlc-0.9.8a-win32.exe

2008-12-31 14:43:22 . 2008-12-31 14:43:22        1018074        ----a-w-        C:\Program Files\lameplugin.exe

2008-12-31 14:13:21 . 2008-12-31 14:11:25        15083520        ----a-w-        C:\Program Files\spybotsd160.exe

2008-12-31 13:51:39 . 2008-12-31 13:51:14        3165824        ----a-w-        C:\Program Files\ccsetup215.exe

2008-12-30 13:12:39 . 2008-12-30 13:12:28        2170309        ----a-w-        C:\Program Files\gnupg-w32cli-1.4.9.exe

2008-12-29 17:36:11 . 2008-12-29 17:36:10        2188592        ----a-w-        C:\Program Files\OrbitDownloader281Setup.exe

2008-12-10 16:28:34 . 2008-12-13 16:50:37        792771        ----a-w-        C:\Program Files\MozBackup-1.4.8-DE.exe

2011-11-09 14:23:09 . 2011-03-22 16:03:41        134104        ----a-w-        C:\Program Files\mozilla firefox\components\browsercomps.dll
 
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
 
 

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-11-28 18:01:17        122512        ----a-w-        C:\Program Files\Alwil Software\Avast5\ashShell.dll
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-20 09:27:35 39408]

"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 02:25:33 202240]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-08 23:19:20 178712]

"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-09-22 18:10:00 13589024]

"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-09-22 18:10:00 92704]

"Launcher"="C:\Program Files\Kyocera\FS-720 Utilities\KMGLNC.exe" [2005-01-27 19:48:34 57344]

"snpstd3"="C:\Windows\vsnpstd3.exe" [2007-05-10 12:18:26 835584]

"tsnpstd3"="C:\Windows\tsnpstd3.exe" [2009-06-30 15:20:08 339968]

"WrtMon.exe"="C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 06:35:26 20480]

"avast"="C:\Program Files\Alwil Software\Avast5\avastUI.exe" [2011-11-28 18:01:24 3744552]

"SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 11:06:06 254696]

"RTHDVCPL"="C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-10-17 14:13:56 11430504]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)
 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 00:02:18 113024]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2011-05-04 17:54:14        551296        ----a-w-        C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2011-06-06 10:55:28        937920        ----a-w-        C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2011-09-05 17:04:58        35736        ----a-w-        C:\Program Files\Adobe\Reader 10.0\Reader\reader_sl.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google EULA Launcher]

2008-10-14 09:57:32        20480        ----a-w-        C:\Program Files\Google\Google EULA\GoogleEULALauncher.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

2008-12-12 07:31:10        1840424        ----a-w-        C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]

2008-12-02 14:29:52        2221352        ----a-w-        C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]

2006-10-11 11:45:12        75304        ----a-w-        C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]

2006-09-28 12:16:20        185896        ----a-w-        C:\Program Files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2011-06-09 11:06:06        254696        ----a-w-        C:\Program Files\Common Files\Java\Java Update\jusched.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]

2011-12-09 00:44:22        4616064        ----a-w-        C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

2008-10-20 09:27:35        39408        ----a-w-        C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TVEService]

2008-10-14 00:52:38        180224        ----a-w-        C:\Program Files\HomeCinema\TV Enhance\TVEService.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000001
 

R0 Lbd;Lbd;C:\Windows\system32\DRIVERS\Lbd.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 11:16:28 130384]

R2 gupdate;Google Update Service (gupdate);C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-19 15:21:14 135664]

R3 AVMUNET;AVM FRITZ!Box;C:\Windows\system32\DRIVERS\avmunet.sys [2006-11-07 00:00:00 14976]

R3 gupdatem;Google Update-Dienst (gupdatem);C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-19 15:21:14 135664]

R3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;C:\Windows\system32\DRIVERS\netr28u.sys [2008-08-21 09:57:22 645120]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 11:16:28 753504]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 16:27:02 12880]

S1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 21:55:22 67664]

S2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [2011-08-11 23:38:07 116608]

S2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 10:55:28 64952]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;C:\Windows\system32\drivers\aswMonFlt.sys [2011-11-28 17:52:07 55128]

S2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 14:31:10 1153368]

S2 TVECapSvc;TVEnhance Background Capture Service (TBCS);C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe [2008-10-14 00:52:50 376937]

S2 TVESched;TVEnhance Task Scheduler (TTS));C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe [2008-10-14 00:52:50 184423]

S3 NxpCap;CTX capture service;C:\Windows\system32\DRIVERS\NxpCap.sys [2008-09-25 13:28:06 1332576]

S3 X10Hid;X10 Hid Device;C:\Windows\system32\Drivers\x10hid.sys [2006-11-17 08:31:04 13976]
 
 

--- Andere Dienste/Treiber im Speicher ---
 

*NewlyCreated* - 90736186

*Deregistered* - 90736186

*Deregistered* - aswMBR
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache
 

Inhalt des "geplante Tasks" Ordners
 

2011-12-29 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

- C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-19 15:21:20 . 2010-01-19 15:21:14]
 

2011-12-30 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

- C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-19 15:21:20 . 2010-01-19 15:21:14]
 

2011-12-30 C:\Windows\Tasks\User_Feed_Synchronization-{103B65BD-4798-4CA0-9487-EB211B637804}.job

- C:\Windows\system32\msfeedssync.exe [2011-03-15 16:20:14 . 2011-03-15 16:20:14]
 
 

------- Zusätzlicher Suchlauf -------
 

uStart Page = about:blank

IE: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll/201

IE: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll/204

IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200

IE: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll/203

IE: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll/202

IE: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

IE: Nach Microsoft E&xel exportieren - C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - C:\Users\a\AppData\Roaming\Mozilla\Firefox\Profiles\xce0990k.default\

FF - prefs.js: browser.startup.homepage - 
 

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

MSConfigStartUp-Ad-Watch - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

MSConfigStartUp-Skytel - Skytel.exe

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Osam-log:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 21:22:30 on 30.12.2011
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Mozilla Corporation Firefox 8.0
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"FINDFAST.CPL" - "Microsoft Corporation" - C:\Windows\system32\FINDFAST.CPL

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl

"ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl

"PhysX.cpl" - "NVIDIA Corporation" - C:\Windows\system32\PhysX.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"aswFsBlk" (aswFsBlk) - "AVAST Software" - C:\Windows\system32\drivers\aswFsBlk.sys

"aswMonFlt" (aswMonFlt) - "AVAST Software" - C:\Windows\system32\drivers\aswMonFlt.sys

"aswRdr" (aswRdr) - "AVAST Software" - C:\Windows\system32\drivers\aswRdr.sys

"aswSnx" (aswSnx) - "AVAST Software" - C:\Windows\system32\drivers\aswSnx.sys

"aswSP" (aswSP) - "AVAST Software" - C:\Windows\system32\drivers\aswSP.sys

"avast! Network Shield Support" (aswTdi) - "AVAST Software" - C:\Windows\system32\drivers\aswTdi.sys

"catchme" (catchme) - ? - C:\Users\a\AppData\Local\Temp\catchme.sys  (File not found)

"fgldrpog" (fgldrpog) - ? - C:\Users\a\AppData\Local\Temp\fgldrpog.sys  (Hidden registry entry, rootkit activity | File not found)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"Lbd" (Lbd) - ? - C:\Windows\System32\DRIVERS\Lbd.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys

"RT2870 USB Wireless LAN Card Driver for Vista" (netr28u) - "Ralink Technology Corp." - C:\Windows\System32\DRIVERS\netr28u.sys

"SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS

"SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

{B2F55D43-C7A4-4B7C-90D7-7A860DFA9F2A} "PXCInfoShlExt Class" - "Tracker Software Products Ltd." - C:\Program Files\Tracker Software\Shell Extensions\XCShInfo.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - "The Document Foundation" - C:\Program Files\LibreOffice 3.4\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "SABShellExecuteHook Class" - "SuperAdBlocker.com" - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{472083B0-C522-11CF-8763-00608CC02F24} "avast" - "AVAST Software" - C:\Program Files\Alwil Software\Avast5\ashShell.dll

{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{AE424E85-F6DF-4910-A6A9-438797986431} "LibreOffice Property Handler" - "The Document Foundation" - C:\Program Files\LibreOffice 3.4\Basis\program\shlxthdl\propertyhdl.dll

{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)

{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} "Meine freigegebenen Ordner" - "Microsoft Corporation" - C:\Program Files\Windows Live\Messenger\fsshext.8.5.1302.1018.dll

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\ONFILTER.DLL

{59850401-6664-101B-B21C-00AA004BA90B} "Microsoft Office Sammelmappen-Teiler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office\UNBIND.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - "The Document Foundation" - C:\Program Files\LibreOffice 3.4\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - "The Document Foundation" - C:\Program Files\LibreOffice 3.4\Basis\program\shlxthdl\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - "The Document Foundation" - C:\Program Files\LibreOffice 3.4\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - "The Document Foundation" - C:\Program Files\LibreOffice 3.4\Basis\program\shlxthdl\shlxthdl.dll

{CF822AB4-6DB5-4FDA-BC28-E61DF36D2583} "PDF-XChange PDF Preview Provider" - "Tracker Software Products Ltd." - C:\Program Files\Tracker Software\Shell Extensions\XCShInfo.dll

{67EB453C-1BE1-48EC-AAF3-23B10277FCC1} "PDF-XChange PDF Property Handler" - "Tracker Software Products Ltd." - C:\Program Files\Tracker Software\Shell Extensions\XCShInfo.dll

{EBD0B8F4-A9A0-41B7-9695-030CD264D9C8} "PDF-XChange PDF Thumbnail Provider" - "Tracker Software Products Ltd." - C:\Program Files\Tracker Software\Shell Extensions\XCShInfo.dll

{B2F55D43-C7A4-4B7C-90D7-7A860DFA9F2A} "PXCInfoShlExt Class" - "Tracker Software Products Ltd." - C:\Program Files\Tracker Software\Shell Extensions\XCShInfo.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoViewer.dll

{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Autoplay Drop Target Shim" - ? -   (File not found | COM-object registry key not found)

{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoViewer.dll

{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Drop Target Shim" - ? -   (File not found | COM-object registry key not found)

{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoViewer.dll

{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Drop Target Shim" - ? -   (File not found | COM-object registry key not found)

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{00F33137-EE26-412F-8D71-F84E4C2C6625} "{00F33137-EE26-412F-8D71-F84E4C2C6625}" - ? -   (File not found | COM-object registry key not found)

{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

<binary data> "Grab Pro" - ? - C:\Program Files\Orbitdownloader\GrabPro.dll

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_29.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\Windows\system32\LegitCheckControl.DLL / hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab

{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll

{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL

{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{6E5B18CB-0EB6-4461-88B8-33B4683613D5} "DasÖrtliche Toolbar" - ? - C:\Program Files\Das Örtliche Toolbar\DasOertlicheToolbar.dll

<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

<binary data> "Grab Pro" - ? - C:\Program Files\Orbitdownloader\GrabPro.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{000123B4-9B42-4900-B3F7-F4B073EFC214} "Octh Class" - "Orbitdownloader.com" - C:\Program Files\Orbitdownloader\orbitcth.dll

{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

{164E93C4-09BF-4647-9E0B-D5FBB1D35E63} "T3ToolbarHelper Class" - ? - C:\Program Files\Das Örtliche Toolbar\DasOertlicheToolbar.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\a\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"swg" - "Google Inc." - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"avast" - "AVAST Software" - "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui

"IAAnotif" - "Intel Corporation" - "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

"Launcher" - "KYOCERA MITA Corporation" - C:\Program Files\Kyocera\FS-720 Utilities\KMGLNC.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

"tsnpstd3" - ? - C:\Windows\tsnpstd3.exe

"WrtMon.exe" - ? - C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"KML10001" - "KYOCERA MITA Corporation" - C:\Windows\system32\KML10001.DLL

"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll

"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

"avast! Antivirus" (avast! Antivirus) - "AVAST Software" - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\Cyberlink\Shared files\RichVideo.exe

"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Nero BackItUp Scheduler 3" (Nero BackItUp Scheduler 3) - "Nero AG" - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"PLFlash DeviceIoControl Service" (PLFlash DeviceIoControl Service) - "Prolific Technology Inc." - C:\Windows\system32\IoctlSvc.exe

"ProtexisLicensing" (ProtexisLicensing) - ? - C:\Windows\system32\PSIService.exe

"SAS Core Service" (!SASCORE) - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

"SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

"TVEnhance Background Capture Service (TBCS)" (TVECapSvc) - ? - C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe

"TVEnhance Task Scheduler (TTS))" (TVESched) - ? - C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe

"X10 Device Network Service" (x10nets) - "X10" - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
 

[Winlogon]

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"!SASWinLogon" - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

aswMBR-log:

Code:

aswMBR version 0.9.9.1124 Copyright(c) 2011 AVAST Software

Run date: 2011-12-30 21:23:58

-----------------------------

21:23:58.803    OS Version: Windows 6.0.6002 Service Pack 2

21:23:58.803    Number of processors: 4 586 0x1707

21:23:58.819    ComputerName: A-PC  UserName: a

21:24:02.407    Initialize success

21:24:02.735    AVAST engine defs: 11123000

21:24:18.678    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

21:24:18.678    Disk 0 Vendor: WDC_WD10 01.0 Size: 953869MB BusType: 3

21:24:18.927    Disk 0 MBR read successfully

21:24:18.927    Disk 0 MBR scan

21:24:18.927    Disk 0 Windows VISTA default MBR code

21:24:19.193    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       933377 MB offset 2048

21:24:19.208    Disk 0 Partition - 00     0F Extended LBA             20489 MB offset 1911558222

21:24:19.442    Disk 0 Partition 2 00     0B        FAT32 MSDOS5.0    20489 MB offset 1911558285

21:24:19.551    Disk 0 scanning sectors +1953520065

21:24:20.175    Disk 0 scanning C:\Windows\system32\drivers

21:25:50.967    Service scanning

21:25:52.403    Modules scanning

21:27:26.112    Disk 0 trace - called modules:

21:27:26.174    ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll 

21:27:26.190    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87302438]

21:27:26.190    3 CLASSPNP.SYS[8c1a98b3] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x86779030]

21:27:28.701    AVAST engine scan C:\Windows

21:32:08.612    AVAST engine scan C:\Windows\system32

21:54:05.299    AVAST engine scan C:\Windows\system32\drivers

21:58:37.020    Disk 0 MBR has been saved successfully to "C:\Users\a\Desktop\MBR.dat"

21:58:37.067    The log file has been saved successfully to "C:\Users\a\Desktop\aswMBR30-12-11.txt"

Das Gmer-log als zip

Danke!!!

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

So, hier die beiden logs

Code:

Malwarebytes Anti-Malware 1.60.0.1800

www.malwarebytes.org
 

Datenbank Version: v2011.12.31.03
 

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

a :: A-PC [Administrator]
 

31.12.2011 11:46:20

mbam-log-2011-12-31 (11-46-20).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 368908

Laufzeit: 1 Stunde(n), 3 Minute(n), 20 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

SUPERAntiSpyware Scann-Protokoll

hxxp://www.superantispyware.com
 

Generiert 12/31/2011 bei 03:48 PM
 

Version der Applikation : 5.0.1142
 

Version der Kern-Datenbank : 8091

Version der Spur-Datenbank : 5903
 

Scan Art       : kompletter Scann

Totale Scann-Zeit : 01:38:00
 

Operating System Information

Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)

UAC On - Administrator
 

Gescannte Speicherelemente  : 669

Erfasste Speicher-Bedrohungen  : 0

Gescannte Register-Elemente  : 38547

Erfasste Register-Bedrohungen  : 0

Gescannte Datei-Elemente     : 260647

Erfasste Datei-Elemente   : 0

ESET hatte ja schon mehrere Male nichts gefunden - gottseidank.

Ich hoffe, die Sache ist damit gut gelaufen.
Gutes neues Jahr und vielen, vielen Dank!
:taenzer:

ESET ist noch mal gelaufen, alles gut

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=64f3865ced9e534a86ddcac0eae771c3

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-09-13 03:16:33

# local_time=2011-09-13 05:16:33 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 79391430 79391430 0 0

# compatibility_mode=768 16777215 100 0 308782 308782 0 0

# compatibility_mode=5892 16776573 100 100 15441 153454224 0 0

# compatibility_mode=8192 67108863 100 0 306 306 0 0

# scanned=305168

# found=0

# cleaned=0

# scan_time=5496

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=64f3865ced9e534a86ddcac0eae771c3

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-09-15 10:06:15

# local_time=2011-09-16 12:06:15 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 79575671 79575671 0 0

# compatibility_mode=768 16777215 100 0 493023 493023 0 0

# compatibility_mode=5892 16776573 100 100 199682 153638465 0 0

# compatibility_mode=8192 67108863 100 0 184547 184547 0 0

# scanned=303452

# found=3

# cleaned=0

# scan_time=18638

I:\A-PC\Backup Set 2010-03-02 133326\Backup Files 2010-03-02 133326\Backup files 1.zip        multiple threats (unable to clean)        00000000000000000000000000000000        I

I:\A-PC\Backup Set 2010-11-08 151038\Backup Files 2010-11-08 151038\Backup files 1.zip        multiple threats (unable to clean)        00000000000000000000000000000000        I

I:\A-PC\Backup Set 2010-11-08 151038\Backup Files 2011-05-05 111900\Backup files 1.zip        HTML/Iframe.B.Gen virus (unable to clean)        00000000000000000000000000000000        I

ESETSmartInstaller@High as downloader log:

all ok

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=64f3865ced9e534a86ddcac0eae771c3

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-12-22 06:40:10

# local_time=2011-12-22 07:40:10 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=768 16777215 100 0 8961236 8961236 0 0

# compatibility_mode=5892 16776573 100 100 14333 162106678 0 0

# compatibility_mode=8192 67108863 100 0 8392593 8392593 0 0

# scanned=235493

# found=2

# cleaned=0

# scan_time=5259

C:\Users\a\AppData\Local\temp\Temp1_Post_Label_N2420US.zip\Post_Label.exe        a variant of Win32/Kryptik.XUH trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\a\Desktop\Post_Label_N2420US\Post_Label.exe        a variant of Win32/Kryptik.XUH trojan (unable to clean)        00000000000000000000000000000000        I

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=64f3865ced9e534a86ddcac0eae771c3

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-12-28 06:40:35

# local_time=2011-12-28 07:40:35 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=768 16777215 100 0 9479826 9479826 0 0

# compatibility_mode=5892 16776573 100 100 4936 162625268 0 0

# compatibility_mode=8192 67108863 100 0 8911183 8911183 0 0

# scanned=238531

# found=0

# cleaned=0

# scan_time=5094

ESETSmartInstaller@High as downloader log:

all ok

esets_scanner_update returned -1 esets_gle=53251

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=64f3865ced9e534a86ddcac0eae771c3

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-12-28 10:29:48

# local_time=2011-12-28 11:29:48 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=768 16777215 100 0 9493433 9493433 0 0

# compatibility_mode=5892 16776573 100 100 18543 162638875 0 0

# compatibility_mode=8192 67108863 100 0 8924790 8924790 0 0

# scanned=238821

# found=0

# cleaned=0

# scan_time=5241

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=64f3865ced9e534a86ddcac0eae771c3

# end=stopped

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-12-31 07:48:48

# local_time=2011-12-31 08:48:48 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=768 16777215 100 0 9748163 9748163 0 0

# compatibility_mode=5892 16776573 100 100 106886 162893605 0 0

# compatibility_mode=8192 67108863 100 0 9179520 9179520 0 0

# scanned=602

# found=0

# cleaned=0

# scan_time=50

ESETSmartInstaller@High as downloader log:

all ok

esets_scanner_update returned -1 esets_gle=53251

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=64f3865ced9e534a86ddcac0eae771c3

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-12-31 09:09:54

# local_time=2011-12-31 10:09:54 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=768 16777215 100 0 9748529 9748529 0 0

# compatibility_mode=5892 16776573 100 100 107252 162893971 0 0

# compatibility_mode=8192 67108863 100 0 9179886 9179886 0 0

# scanned=205045

# found=0

# cleaned=0

# scan_time=4551

Was mache ich nun mit den Funden, die AVAST, malwarebytes und der TDSS-Killer in Quarantäne genommen haben?
Löschen?
Oder einfach dort in Sicherheit eingesperrt lassen?

Zitat:

Was mache ich nun mit den Funden, die AVAST, malwarebytes und der TDSS-Killer in Quarantäne genommen haben?

Du weißt, was eine Quarantäne ist? Ob da die schädliche Datei drinbleibt oder nicht, das hat keine Auswirkungen. Schädlinge in der Quarantäne können nichts mehr anrichten, sie sind dort isoliert. Du solltest grundsätzlich mit der Quarantäne arbeiten, denn falls der Virenscanner durch einen Fehlalarm was wichtiges löscht, kannst Du notfalls noch über die Quarantäne an die Datei ran.

Ansonsten keine weiteren Funde! :daumenhoc
Rechner wieder im Lot oder gibts noch Probleme und/oder andere Funde?

Nein, es gibt keine Funde und Befunde mehr :daumenhoc

Ich wollte nun die Tools löschen.
Nur beim Beseitigen von ComboFix habe ich offensichtlich einen Fehler gemacht: Ich habe meinen AVAST-Virenscanner nicht ausgestellt und während ich combofix/uninstall laufen ließ, sprang er an und verschob einige Dateien in die Sandbox. ComboFix hat sofort gemeckert, ich habe den Virenscanner abgestellt und combofix/unistall noch einmal laufen lassen - nun hat er sich aufgehängt:
Fehler beim Schreiben :C:\32788R2FWJFW\pev.3XE

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Wie ich oben schon schrieb:

Zitat:

Zitat von andrewJ (Beitrag 746009)

Ich wollte nun die Tools löschen.
Nur beim Beseitigen von ComboFix habe ich offensichtlich einen Fehler gemacht: Ich habe meinen AVAST-Virenscanner nicht ausgestellt und während ich combofix/uninstall laufen ließ, sprang er an und verschob einige Dateien in die Sandbox. ComboFix hat sofort gemeckert, ich habe den Virenscanner abgestellt und combofix/unistall noch einmal laufen lassen - nun hat er sich aufgehängt:
Fehler beim Schreiben :C:\32788R2FWJFW\pev.3XE

Was soll ich tun? Da Combofix\uninstall an der obigen Stelle lief und lief und lief (45 min), habe ich auf "Abbrechen" gedrückt - Combofix ist wohl nicht vollständig entfernt, einige dafür nötigen Daten in der Sandbox verschollen ....:confused:

Zitat:

Da Combofix\uninstall

Falsch: "Combofix\uninstall"
Richtig: "combofix /uninstall"

Falls es auch RICHTIG ausgeführt nicht geht:
Downloade dir bitte CF_UNINST.exe und speichere diese auf deinem Desktop.

Starte die CF_UNINST.exe
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Folge den Anweisungen auf dem Desktop.
Wenn das Tool fertig ist sollte sich ein Fenster mit folgendem Inhalt öffnen: Done

Es hat geklappt!

Vielen Dank noch mal!