"Achtung! Aus Sicherheitsgründen wurde ihr Windowssystem gesperrt!"
 

"Achtung! Aus Sicherheitsgründen wurde ihr Windowssystem gesperrt!"
Die einzig brauchbaren Tipss und Hilfestellungen die mein Problem betreffen find ich hier bei euch, und dort heisst es dann das ich meinen eigenen Thread aufmachen soll, da dieser Virus oder Trojaner eine spezielle Behandlung braucht.

Auch ich bin nun hier wie viele andere und bitte Euch um Hilfe.
Ich habe ein Win7 64bit.
Kann kaum noch windowsbefehle ausführen und sporadisch wird der Bildschirm auch immer wieder schwarz und es erscheint die o.g. Meldung.

Habe eine Avira Vollversion aber die findet nichts.
Hoffentlich komm ich durch euch weiter.

Geht auch der abgesicherte Modus mit Netzwerktreibern noch? Wenn ja, da bitte mal MBAM/ESET versuchen:

routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

So hab jetz hier mal den Online Scan gepostet. Der Scan im abgesicherten Modus ging. Konnte aber nicht online gehen um es zu posten und das gespeicherte hab ich auch nicht gefunden. War bestimmt zu unfähig.:balla:
Ältere scan-Logs habe ich nicht.

gruss

Und die Logs von MBAM?

He ja stimmt hatte ich ganz vergessen. Der erste könnte übrigens der aus dem abgesicherten Modus sein, hab ihn irgendwo aufgestöbert.

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die OTL.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
• Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

He muss das so machen da er mir sagt die Datei ist zu groß zum hochladen.
Gruss

PRC - C:\Users\Tank\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Windows\AsScrPro.exe (ASUS)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MMLoadDrv.exe (Advanced Micro Devices, Inc.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
PRC - C:\Programme\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe (Broadcom Corporation.)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)
PRC - C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ASUS)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AFBAgent) -- C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.)
SRV:64bit: - (TurboBoost) -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel(R) Corporation)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG)
SRV - (AntiVirMailService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirFirewallService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (ATKGFNEXSrv) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
SRV - (UNS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (btwdins) -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV - (ASLDRService) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (avfwot) -- C:\Windows\SysNative\drivers\avfwot.sys (Avira GmbH)
DRV:64bit: - (avfwim) -- C:\Windows\SysNative\drivers\avfwim.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (HECIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (L1C) NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20) -- C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (TurboB) -- C:\Windows\SysNative\drivers\TurboB.sys ()
DRV:64bit: - (kbfiltr) -- C:\Windows\SysNative\drivers\kbfiltr.sys ( )
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (btusbflt) -- C:\Windows\SysNative\drivers\btusbflt.sys (Broadcom Corporation.)
DRV:64bit: - (btwaudio) -- C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)
DRV:64bit: - (btwavdt) -- C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)
DRV:64bit: - (btwrchid) -- C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\Windows\SysNative\drivers\snp2uvc.sys ()
DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ATK64AMD.sys (ASUS)
DRV:64bit: - (btwl2cap) -- C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (ASMMAP64) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 83 F0 26 AA 31 C3 CC 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "web.de"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}:6.0.30

FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.12.25 21:13:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.12.26 20:45:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.12.26 20:45:06 | 000,000,000 | ---D | M]

[2011.12.25 19:22:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tank\AppData\Roaming\mozilla\Extensions
[2011.12.25 19:22:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tank\AppData\Roaming\mozilla\Firefox\Profiles\q825twlb.default\extensions
[2011.12.26 20:45:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.12.21 08:42:29 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.11.10 05:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.12.21 06:08:50 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.12.21 06:02:40 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.12.21 06:08:50 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.12.21 06:08:50 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.12.21 06:08:50 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.12.21 06:08:50 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000016 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{6f67314e-2ece-11e1-bcf5-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{6f67314e-2ece-11e1-bcf5-806e6f6e6963}\Shell\AutoRun\command - "" = G:\InstAll.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.12.26 22:12:44 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2011.12.26 21:55:40 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2011.12.26 21:55:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2011.12.26 21:55:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies
[2011.12.26 21:55:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2011.12.26 21:54:42 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011.12.26 21:47:39 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2011.12.26 21:45:11 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2011.12.26 21:44:28 | 000,000,000 | ---D | C] -- C:\ATI
[2011.12.26 21:40:28 | 000,000,000 | ---D | C] -- C:\AMD
[2011.12.26 21:26:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2011.12.26 21:26:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Steam
[2011.12.26 20:59:56 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Roaming\Macromedia
[2011.12.26 20:59:56 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Roaming\Adobe
[2011.12.26 19:46:10 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Local\PokerStars
[2011.12.26 19:46:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerStars
[2011.12.26 19:46:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PokerStars
[2011.12.26 19:45:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2011.12.26 19:42:27 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2011.12.26 18:28:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2011.12.26 18:02:55 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Roaming\Malwarebytes
[2011.12.26 18:02:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.12.26 18:02:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.12.26 18:02:45 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.12.26 18:02:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.12.25 21:19:00 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Roaming\Apple Computer
[2011.12.25 21:16:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011.12.25 21:16:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2011.12.25 21:16:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2011.12.25 21:15:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple
[2011.12.25 21:15:42 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Local\Apple
[2011.12.25 21:15:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2011.12.25 21:15:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2011.12.25 21:15:35 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Local\DDMSettings
[2011.12.25 21:13:01 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Roaming\DivX
[2011.12.25 21:12:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine
[2011.12.25 21:12:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX Plus
[2011.12.25 21:12:45 | 000,000,000 | ---D | C] -- C:\Program Files\DivX
[2011.12.25 21:12:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DivX Shared
[2011.12.25 21:10:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DivX
[2011.12.25 21:10:05 | 000,000,000 | ---D | C] -- C:\ProgramData\DivX
[2011.12.25 21:06:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.12.25 21:06:33 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.12.25 21:05:41 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3
[2011.12.25 21:05:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice.org 3
[2011.12.25 21:05:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2011.12.25 21:04:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2011.12.25 21:03:10 | 000,000,000 | ---D | C] -- C:\Users\Tank\Desktop\OpenOffice.org 3.3 (de) Installation Files
[2011.12.25 20:56:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
[2011.12.25 20:56:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
[2011.12.25 20:56:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2011.12.25 19:33:15 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Roaming\Avira
[2011.12.25 19:29:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011.12.25 19:28:52 | 000,139,512 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avfwot.sys
[2011.12.25 19:28:52 | 000,130,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2011.12.25 19:28:52 | 000,113,768 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avfwim.sys
[2011.12.25 19:28:52 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2011.12.25 19:28:52 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2011.12.25 19:28:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2011.12.25 19:28:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2011.12.25 19:21:56 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Roaming\Mozilla
[2011.12.25 19:21:56 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Local\Mozilla
[2011.12.25 19:21:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2011.12.25 18:53:23 | 000,520,192 | ---- | C] (ScreenTime Media) -- C:\Windows\SysWow64\ASUS_Notebook_G73.scr
[2011.12.25 18:53:23 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\ASUS_Notebook_G73 dir
[2011.12.25 18:53:01 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2011.12.25 18:52:59 | 003,058,304 | ---- | C] (ASUS) -- C:\Windows\AsScrPro.exe
[2011.12.25 18:52:57 | 000,379,520 | ---- | C] (ASUSTeK Computer Inc.) -- C:\Windows\SysNative\FBAgent.exe
[2011.12.25 18:52:57 | 000,000,000 | ---D | C] -- C:\Program Files\ASUS
[2011.12.25 18:52:51 | 000,000,000 | ---D | C] -- C:\ProgramData\P4G
[2011.12.25 18:52:51 | 000,000,000 | ---D | C] -- C:\Program Files\P4G
[2011.12.25 18:52:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility
[2011.12.25 18:52:29 | 000,000,000 | ---D | C] -- C:\ProgramData\AmUStor
[2011.12.25 18:52:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AmIcoSingLun
[2011.12.25 18:51:56 | 000,000,000 | ---D | C] -- C:\Program Files\Intel
[2011.12.25 18:51:13 | 000,019,008 | ---- | C] (Chicony (C) 2006 ATC) -- C:\Windows\DrvInst.exe
[2011.12.25 18:49:34 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM
[2011.12.25 18:49:34 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2011.12.25 18:49:28 | 000,304,640 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RH3DHT64.dll
[2011.12.25 18:49:28 | 000,304,640 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RH3DAA64.dll
[2011.12.25 18:49:24 | 000,513,536 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll
[2011.12.25 18:49:24 | 000,211,376 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll
[2011.12.25 18:49:24 | 000,193,536 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll
[2011.12.25 18:49:24 | 000,150,528 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll
[2011.12.25 18:49:20 | 000,363,008 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll
[2011.12.25 18:49:20 | 000,198,656 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll
[2011.12.25 18:49:20 | 000,095,744 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll
[2011.12.25 18:49:20 | 000,073,216 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll
[2011.12.25 18:49:19 | 000,304,640 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll
[2011.12.25 18:49:19 | 000,304,640 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll
[2011.12.25 18:49:16 | 000,320,512 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll
[2011.12.25 18:49:14 | 000,321,536 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll
[2011.12.25 18:49:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek
[2011.12.25 18:49:11 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp
[2011.12.25 18:49:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2011.12.25 18:48:59 | 001,542,656 | ---- | C] (Atheros Communications, Inc.) -- C:\Windows\SysNative\drivers\athrx.sys
[2011.12.25 18:48:53 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Local\Broadcom
[2011.12.25 18:48:53 | 000,000,000 | ---D | C] -- C:\Users\Tank\Documents\Bluetooth-Exchange-Ordner
[2011.12.25 18:48:20 | 000,000,000 | ---D | C] -- C:\Program Files\WIDCOMM
[2011.12.25 18:48:11 | 000,000,000 | ---D | C] -- C:\Program Files\DIFX
[2011.12.25 18:47:11 | 000,062,464 | ---- | C] (Atheros Communications, Inc.) -- C:\Windows\SysNative\drivers\L1C62x64.sys
[2011.12.25 18:46:52 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics
[2011.12.25 18:46:49 | 000,293,936 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\drivers\SynTP.sys
[2011.12.25 18:46:49 | 000,263,464 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynCtrl.dll
[2011.12.25 18:46:49 | 000,206,120 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynCtrl.dll
[2011.12.25 18:46:49 | 000,205,608 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynTPAPI.dll
[2011.12.25 18:46:49 | 000,169,256 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynCOM.dll
[2011.12.25 18:46:49 | 000,147,752 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynTPCo4.dll
[2011.12.25 18:46:49 | 000,107,816 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynTPCOM.dll
[2011.12.25 18:46:29 | 000,015,416 | ---- | C] ( ) -- C:\Windows\SysNative\drivers\kbfiltr.sys
[2011.12.25 18:45:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ASUS
[2011.12.25 18:44:44 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Roaming\ATI
[2011.12.25 18:44:44 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Local\ATI
[2011.12.25 18:43:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\postureAgent
[2011.12.25 18:43:08 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2011.12.25 18:43:06 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Roaming\InstallShield
[2011.12.25 18:42:20 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2011.12.25 18:41:55 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2011.12.25 18:41:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2011.12.25 18:41:40 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2011.12.25 18:35:06 | 000,053,248 | R--- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\SysWow64\CSVer.dll
[2011.12.25 18:35:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Intel
[2011.12.25 18:34:44 | 000,000,000 | ---D | C] -- C:\Intel
[2011.12.25 09:11:41 | 000,000,000 | R--D | C] -- C:\Users\Tank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011.12.25 09:11:41 | 000,000,000 | R--D | C] -- C:\Users\Tank\Searches
[2011.12.25 09:11:41 | 000,000,000 | R--D | C] -- C:\Users\Tank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011.12.25 09:11:32 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Roaming\Identities
[2011.12.25 09:11:30 | 000,000,000 | R--D | C] -- C:\Users\Tank\Contacts
[2011.12.25 09:11:28 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Local\VirtualStore
[2011.12.25 09:11:22 | 000,000,000 | --SD | C] -- C:\Users\Tank\AppData\Roaming\Microsoft
[2011.12.25 09:11:22 | 000,000,000 | R--D | C] -- C:\Users\Tank\Videos
[2011.12.25 09:11:22 | 000,000,000 | R--D | C] -- C:\Users\Tank\Saved Games
[2011.12.25 09:11:22 | 000,000,000 | R--D | C] -- C:\Users\Tank\Pictures
[2011.12.25 09:11:22 | 000,000,000 | R--D | C] -- C:\Users\Tank\Music
[2011.12.25 09:11:22 | 000,000,000 | R--D | C] -- C:\Users\Tank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011.12.25 09:11:22 | 000,000,000 | R--D | C] -- C:\Users\Tank\Links
[2011.12.25 09:11:22 | 000,000,000 | R--D | C] -- C:\Users\Tank\Favorites
[2011.12.25 09:11:22 | 000,000,000 | R--D | C] -- C:\Users\Tank\Downloads
[2011.12.25 09:11:22 | 000,000,000 | R--D | C] -- C:\Users\Tank\Documents
[2011.12.25 09:11:22 | 000,000,000 | R--D | C] -- C:\Users\Tank\Desktop
[2011.12.25 09:11:22 | 000,000,000 | R--D | C] -- C:\Users\Tank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011.12.25 09:11:22 | 000,000,000 | -HSD | C] -- C:\Users\Tank\Vorlagen
[2011.12.25 09:11:22 | 000,000,000 | -HSD | C] -- C:\Users\Tank\AppData\Local\Verlauf
[2011.12.25 09:11:22 | 000,000,000 | -HSD | C] -- C:\Users\Tank\AppData\Local\Temporary Internet Files
[2011.12.25 09:11:22 | 000,000,000 | -HSD | C] -- C:\Users\Tank\Startmenü
[2011.12.25 09:11:22 | 000,000,000 | -HSD | C] -- C:\Users\Tank\SendTo
[2011.12.25 09:11:22 | 000,000,000 | -HSD | C] -- C:\Users\Tank\Recent
[2011.12.25 09:11:22 | 000,000,000 | -HSD | C] -- C:\Users\Tank\Netzwerkumgebung
[2011.12.25 09:11:22 | 000,000,000 | -HSD | C] -- C:\Users\Tank\Lokale Einstellungen
[2011.12.25 09:11:22 | 000,000,000 | -HSD | C] -- C:\Users\Tank\Documents\Eigene Videos
[2011.12.25 09:11:22 | 000,000,000 | -HSD | C] -- C:\Users\Tank\Documents\Eigene Musik
[2011.12.25 09:11:22 | 000,000,000 | -HSD | C] -- C:\Users\Tank\Eigene Dateien
[2011.12.25 09:11:22 | 000,000,000 | -HSD | C] -- C:\Users\Tank\Documents\Eigene Bilder
[2011.12.25 09:11:22 | 000,000,000 | -HSD | C] -- C:\Users\Tank\Druckumgebung
[2011.12.25 09:11:22 | 000,000,000 | -HSD | C] -- C:\Users\Tank\Cookies
[2011.12.25 09:11:22 | 000,000,000 | -HSD | C] -- C:\Users\Tank\AppData\Local\Anwendungsdaten
[2011.12.25 09:11:22 | 000,000,000 | -HSD | C] -- C:\Users\Tank\Anwendungsdaten
[2011.12.25 09:11:22 | 000,000,000 | -H-D | C] -- C:\Users\Tank\AppData
[2011.12.25 09:11:22 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Local\Temp
[2011.12.25 09:11:22 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Local\Microsoft
[2011.12.25 09:11:22 | 000,000,000 | ---D | C] -- C:\Users\Tank\AppData\Roaming\Media Center Programs
[2011.12.25 09:11:11 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2011.12.25 09:11:11 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2011.12.25 09:11:11 | 000,000,000 | -HSD | C] -- C:\Recovery
[2011.12.25 09:11:11 | 000,000,000 | -HSD | C] -- C:\Programme
[2011.12.25 09:11:11 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2011.12.25 09:11:11 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2011.12.25 09:11:11 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2011.12.25 09:11:11 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2011.12.25 09:11:11 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2011.12.25 09:11:11 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2011.12.25 09:11:11 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2011.12.25 09:11:11 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2011.12.25 09:09:27 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2011.12.25 09:00:46 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2011.12.25 09:00:04 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2011.12.25 08:59:36 | 000,000,000 | ---D | C] -- C:\Windows\Panther

========== Files - Modified Within 30 Days ==========

[2011.12.26 22:14:27 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.12.26 22:14:27 | 000,643,866 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.12.26 22:14:27 | 000,607,190 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.12.26 22:14:27 | 000,126,394 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.12.26 22:14:27 | 000,103,568 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.12.26 22:09:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.26 22:09:40 | 2088,144,895 | -HS- | M] () -- C:\hiberfil.sys
[2011.12.26 22:09:11 | 000,013,600 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.26 22:09:11 | 000,013,600 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.26 21:48:18 | 000,001,492 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini
[2011.12.26 21:48:18 | 000,001,221 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini
[2011.12.26 21:26:11 | 000,000,538 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk
[2011.12.26 20:45:09 | 000,001,138 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.12.26 20:33:17 | 000,292,872 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.12.26 20:15:37 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2011.12.26 19:46:07 | 000,001,061 | ---- | M] () -- C:\Users\Public\Desktop\PokerStars.lnk
[2011.12.26 19:43:08 | 000,001,512 | ---- | M] () -- C:\Users\Tank\Desktop\Downloads - Verknüpfung.lnk
[2011.12.26 18:02:49 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.12.25 21:18:42 | 000,000,080 | ---- | M] () -- C:\Windows\SysNative\Defrag.ini
[2011.12.25 21:16:23 | 000,001,845 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011.12.25 21:13:07 | 000,002,116 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk
[2011.12.25 21:13:07 | 000,001,570 | ---- | M] () -- C:\Users\Tank\Desktop\DivX Movies.lnk
[2011.12.25 21:12:59 | 000,001,112 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2011.12.25 21:06:35 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.12.25 20:57:09 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011.12.25 20:54:40 | 000,000,355 | ---- | M] () -- C:\Users\Tank\Desktop\Computer - Verknüpfung.lnk
[2011.12.25 19:29:02 | 000,002,066 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2011.12.25 18:53:23 | 000,520,192 | ---- | M] (ScreenTime Media) -- C:\Windows\SysWow64\ASUS_Notebook_G73.scr
[2011.12.25 18:53:00 | 003,058,304 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe
[2011.12.25 18:49:41 | 000,000,159 | RH-- | M] () -- C:\Windows\ctfile.rfc
[2011.12.25 18:46:55 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf
[2011.12.25 18:44:22 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2011.12.25 09:03:41 | 000,052,953 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2011.12.25 09:03:41 | 000,052,953 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2011.12.15 14:52:00 | 000,130,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2011.12.15 14:52:00 | 000,027,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2011.12.15 14:51:59 | 000,139,512 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avfwot.sys
[2011.12.15 14:51:59 | 000,113,768 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avfwim.sys
[2011.12.15 14:51:59 | 000,097,312 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys

========== Files Created - No Company Name ==========

[2011.12.26 21:26:11 | 000,000,538 | ---- | C] () -- C:\Users\Public\Desktop\Steam.lnk
[2011.12.26 20:45:09 | 000,001,150 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.12.26 20:15:37 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2011.12.26 19:46:07 | 000,001,061 | ---- | C] () -- C:\Users\Public\Desktop\PokerStars.lnk
[2011.12.26 19:41:24 | 000,001,512 | ---- | C] () -- C:\Users\Tank\Desktop\Downloads - Verknüpfung.lnk
[2011.12.26 18:02:49 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.12.25 21:16:23 | 000,001,845 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011.12.25 21:15:42 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2011.12.25 21:13:07 | 000,001,570 | ---- | C] () -- C:\Users\Tank\Desktop\DivX Movies.lnk
[2011.12.25 21:12:59 | 000,001,112 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2011.12.25 21:12:51 | 000,002,116 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk
[2011.12.25 21:06:35 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.12.25 20:57:09 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011.12.25 20:57:09 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011.12.25 20:54:40 | 000,000,355 | ---- | C] () -- C:\Users\Tank\Desktop\Computer - Verknüpfung.lnk
[2011.12.25 19:29:02 | 000,002,066 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2011.12.25 19:21:48 | 000,001,138 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.12.25 18:52:57 | 000,001,492 | ---- | C] () -- C:\Windows\SysNative\AutoRunFilter.ini
[2011.12.25 18:52:57 | 000,001,221 | ---- | C] () -- C:\Windows\SysNative\ServiceFilter.ini
[2011.12.25 18:52:57 | 000,000,105 | ---- | C] () -- C:\Windows\SysNative\FastBoot.ini
[2011.12.25 18:52:57 | 000,000,080 | ---- | C] () -- C:\Windows\SysNative\Defrag.ini
[2011.12.25 18:52:57 | 000,000,052 | ---- | C] () -- C:\Windows\SysNative\RemoveFont.ini
[2011.12.25 18:52:57 | 000,000,015 | ---- | C] () -- C:\Windows\SysNative\BootTime.ini
[2011.12.25 18:52:09 | 000,000,328 | ---- | C] () -- C:\Uninst_1.5.17.iss
[2011.12.25 18:52:09 | 000,000,328 | ---- | C] () -- C:\Uninst_1.3.17.iss
[2011.12.25 18:52:09 | 000,000,328 | ---- | C] () -- C:\Uninst_1.2.17.iss
[2011.12.25 18:52:09 | 000,000,320 | ---- | C] () -- C:\OldUtilityUninst.iss
[2011.12.25 18:52:09 | 000,000,306 | ---- | C] () -- C:\Uninst_1.1.17.iss
[2011.12.25 18:51:13 | 001,806,400 | ---- | C] () -- C:\Windows\SysNative\drivers\snp2uvc.sys
[2011.12.25 18:51:13 | 000,042,176 | ---- | C] () -- C:\Windows\SysNative\drivers\sncduvc.sys
[2011.12.25 18:51:13 | 000,002,266 | ---- | C] () -- C:\Windows\Uninstvga.bat
[2011.12.25 18:51:13 | 000,002,008 | ---- | C] () -- C:\Windows\Uninstsxga.bat
[2011.12.25 18:51:13 | 000,001,682 | ---- | C] () -- C:\Windows\Uninstuxga.bat
[2011.12.25 18:51:13 | 000,000,386 | ---- | C] () -- C:\Windows\Uninstuxga.reg
[2011.12.25 18:51:13 | 000,000,386 | ---- | C] () -- C:\Windows\Uninstsxga.reg
[2011.12.25 18:51:13 | 000,000,384 | ---- | C] () -- C:\Windows\Uninstvga.reg
[2011.12.25 18:49:41 | 000,188,416 | ---- | C] () -- C:\Windows\SysNative\APOMgr64.DLL
[2011.12.25 18:49:41 | 000,146,432 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011.12.25 18:49:41 | 000,088,064 | ---- | C] () -- C:\Windows\SysNative\CmdRtr64.DLL
[2011.12.25 18:49:41 | 000,072,704 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2011.12.25 18:49:41 | 000,000,159 | RH-- | C] () -- C:\Windows\ctfile.rfc
[2011.12.25 18:49:30 | 000,000,520 | R--- | C] () -- C:\Windows\SysNative\drivers\SamSfPa.dat
[2011.12.25 18:46:55 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf
[2011.12.25 18:44:22 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.12.25 18:42:09 | 000,019,017 | ---- | C] () -- C:\Windows\atiogl.xml
[2011.12.25 09:11:45 | 000,001,405 | ---- | C] () -- C:\Users\Tank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2011.12.25 09:11:42 | 000,001,439 | ---- | C] () -- C:\Users\Tank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011.12.25 09:03:35 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2011.12.25 09:03:33 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2011.12.25 09:00:05 | 2088,144,895 | -HS- | C] () -- C:\hiberfil.sys
[2011.11.10 03:36:06 | 000,204,960 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2011.11.10 03:36:06 | 000,157,152 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2011.11.09 22:39:44 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011.11.09 22:39:32 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

========== LOP Check ==========

[2009.07.14 06:08:49 | 000,005,922 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2011.12.26 20:59:56 | 000,000,000 | ---D | M] -- C:\Users\Tank\AppData\Roaming\Adobe
[2011.12.25 21:19:00 | 000,000,000 | ---D | M] -- C:\Users\Tank\AppData\Roaming\Apple Computer
[2011.12.25 18:44:44 | 000,000,000 | ---D | M] -- C:\Users\Tank\AppData\Roaming\ATI
[2011.12.25 19:33:15 | 000,000,000 | ---D | M] -- C:\Users\Tank\AppData\Roaming\Avira
[2011.12.25 21:13:01 | 000,000,000 | ---D | M] -- C:\Users\Tank\AppData\Roaming\DivX
[2011.12.25 09:11:32 | 000,000,000 | ---D | M] -- C:\Users\Tank\AppData\Roaming\Identities
[2011.12.25 18:43:06 | 000,000,000 | ---D | M] -- C:\Users\Tank\AppData\Roaming\InstallShield
[2011.12.26 20:59:56 | 000,000,000 | ---D | M] -- C:\Users\Tank\AppData\Roaming\Macromedia
[2011.12.26 18:02:55 | 000,000,000 | ---D | M] -- C:\Users\Tank\AppData\Roaming\Malwarebytes
[2009.07.14 19:18:18 | 000,000,000 | ---D | M] -- C:\Users\Tank\AppData\Roaming\Media Center Programs
[2011.12.26 21:37:44 | 000,000,000 | --SD | M] -- C:\Users\Tank\AppData\Roaming\Microsoft
[2011.12.25 19:22:01 | 000,000,000 | ---D | M] -- C:\Users\Tank\AppData\Roaming\Mozilla

< %APPDATA%\*.exe /s >

< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

< MD5 for: IASTOR.SYS >
[2009.08.06 22:24:14 | 000,408,600 | ---- | M] (Intel Corporation) MD5=BBB3B6DF1ABB0FE35802EDE85CC1C011 -- C:\Windows\SysNative\drivers\iaStor.sys
[2009.08.06 22:24:14 | 000,408,600 | ---- | M] (Intel Corporation) MD5=BBB3B6DF1ABB0FE35802EDE85CC1C011 -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_4fa22a1c88c09097\iaStor.sys

< MD5 for: IASTORV.SYS >
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\SysNative\netlogon.dll
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\drivers\nvstor.sys
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

< MD5 for: SCECLI.DLL >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\SysNative\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

< MD5 for: USER32.DLL >
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\SysNative\user32.dll
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

< MD5 for: USERINIT.EXE >
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

< MD5 for: WININIT.EXE >
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

< MD5 for: WINLOGON.EXE >
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

< MD5 for: WS2IFSL.SYS >
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< >

< End of report >

Nö ein unvollständiges Log hilft hier aber nicht weiter.
Wenn das Log zu groß ist: Pack die OTL.txt in eine ZIP-Datei und lad diese hier hoch

Morgen... Hoffe das das so Ok ist??!!
gruss stefan

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

mmmh seltsam habe es ausgeführt, hat einen Neustart gemacht aber wenn ich jetzt die OTL Log datei hochladen will sagt er immer ungültige Datei zum hochladen. ???
Was soll ich da machen?
gruss und schon mal vielen Dank für dein Hilfe im Voraus.

Datei einfach mit einem Texteditor öffnen und den Inhalt hier posten-

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Bekomme es nicht hin habe nur den Editor von Microsoft und es lässt sich öffnen aber nicht posten. :wtf:

vielleicht so ?????

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif