Trojaner-Board - Bundespolizei-Virus - Festplatte unbedingt formatieren?

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Bundespolizei-Virus - Festplatte unbedingt formatieren? (https://www.trojaner-board.de/107583-bundespolizei-virus-festplatte-unbedingt-formatieren.html)

nightingale7

05.01.2012 09:55

Bundespolizei-Virus - Festplatte unbedingt formatieren?

Hallo ihr Lieben!

Kurz vor Weihnachten habe ich mir durch gedankenloses Surfen und die Suche nach Online-Streams verschiedener Animes den Virus eingefangen, der vorgibt, von der Bundespolizei zu stammen und eine Geldbuße von mir zu verlangen. Von einem anderen Benutzerkonto habe ich mein AV-Programm danach suchen lassen und die betreffende Datei gelöscht. Zwischen Weihnachten und Neujahr habe ich das vermeintlich desinfizierte Notebook nicht benutzt, aber dann hatte ich einen ähnlichen Vorfall: Beim Öffnen einer gelegentlich von mir besuchten Seite, mit der ich bisher kein vergleichbares Problem hatte, legte sich eine schwarze Seite über meinen Bildschirm mit einem Button in der Mitte, auf dem stand: "Download und Bezahlen". (Ich hoffe, es ist derselbe Virus und nicht schon wieder ein neuer?!) Habe das Abschalten des Notebooks erzwungen und logge mich seitdem nur noch über das zweite Benutzerkonto ein, das allerdings Administrator-Rechte besitzt. Habe ansonsten keine Möglichkeit zuhause ins I-Net zu gehen und versuche derzeit nur den Schlamassel zu bereinigen und gehe nur auf Seiten wie diese hier, in der Hoffnung auf Hilfe. Ist es trotzdem zu riskant?

Habe mich an den letzten Abenden über so einiges informiert, was ich bisher katastrophal falsch gemacht habe, u.a. blindes Vertrauen auf mein AV-Programm, kopfloses Surfen im Netz, keine regelmäßigen Updates, kein aktueller I-Explorer (Ich arbeite mit Firefox und Chrome.) und vor allem kein einziges Backup...

Inzwischen habe ich den CCleaner runtergeladen und führe ihn nach jedem Systemstart aus. Auch sämtliche Updates habe ich gemacht und den neuesten I-Explorer installiert. Aber nützt das im Moment überhaupt etwas, da das System schon kompromittiert ist?

Habe soweit alle Anweisungen befolgt und alles hat ohne Fehlermeldung funktioniert:

Defogger runtergeladen und Emulatoren disabled.

OTL runtergeladen und ausgeführt. Hatte leider beim ersten Mal noch Avira und die Firewall zu laufen und habe deshalb OTL ein zweites Mal ausgeführt, während die beiden deaktiviert waren. Beim ersten Mal wurden die Dateien OTL.txt und Extras.txt generiert, die ich vor dem zweiten Ausführen aber gelöscht habe. Beim zweiten Mal gab es leider nur die OTL.txt. Braucht ihr noch eine Extras.txt? Wie schaffe ich es, dass OTL nochmal eine erstellt?

Gmer runtergeladen und ausgeführt.

Würde mich sehr freuen, wenn sich jemand die Dateien ansieht und mir vielleicht weiterhelfen kann.

Code:

OTL logfile created on: 04.01.2012 22:22:09 - Run 2

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\ASUS x72v\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,43 Gb Available Physical Memory | 47,79% Memory free

6,19 Gb Paging File | 4,73 Gb Available in Paging File | 76,36% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 149,04 Gb Total Space | 80,22 Gb Free Space | 53,82% Space Free | Partition Type: NTFS

Drive D: | 139,28 Gb Total Space | 32,31 Gb Free Space | 23,20% Space Free | Partition Type: NTFS

Drive E: | 4,61 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: ASUSX72V-PC | User Name: ASUS x72v | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.01.04 19:49:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\ASUS x72v\Desktop\OTL.exe

PRC - [2011.12.09 12:40:20 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.12.09 12:40:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2011.12.09 12:39:54 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.12.09 12:39:54 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.03.21 19:56:16 | 001,230,704 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe

PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009.04.11 07:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe

PRC - [2008.10.09 08:30:20 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe

PRC - [2008.07.15 19:29:00 | 007,651,328 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe

PRC - [2008.07.15 19:22:46 | 000,217,088 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControl.exe

PRC - [2008.07.10 01:09:26 | 000,191,032 | ---- | M] (ATK) -- C:\Program Files\P4G\BatteryLife.exe

PRC - [2008.06.25 03:01:08 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Media\DMedia.exe

PRC - [2008.06.24 04:16:24 | 002,482,176 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe

PRC - [2008.06.19 20:18:12 | 000,154,168 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ASUS CopyProtect\ASPG.exe

PRC - [2008.06.18 06:10:24 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files\ASUS\SmartLogon\sensorsrv.exe

PRC - [2008.06.13 06:52:51 | 006,183,456 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2008.06.04 01:29:08 | 000,851,968 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe

PRC - [2008.04.10 19:32:18 | 001,796,648 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe

PRC - [2008.04.10 19:32:18 | 000,752,168 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

PRC - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe

PRC - [2008.01.23 18:51:28 | 000,151,552 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\WDC.exe

PRC - [2008.01.21 03:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe

PRC - [2008.01.12 06:40:10 | 000,098,304 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

PRC - [2007.11.30 19:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe

PRC - [2007.11.05 03:48:06 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe

PRC - [2007.10.03 05:53:00 | 000,094,208 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe

PRC - [2007.08.15 19:20:16 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe

PRC - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe

PRC - [2007.08.03 20:24:54 | 000,125,496 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

PRC - [2007.07.06 00:53:44 | 001,040,384 | ---- | M] () -- C:\Program Files\Wireless Console 2\wcourier.exe

PRC - [2005.07.06 23:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.03.21 19:57:34 | 000,096,112 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll

MOD - [2011.03.21 19:56:16 | 001,230,704 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe

MOD - [2008.09.16 19:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll

MOD - [2008.04.10 19:25:54 | 000,126,976 | ---- | M] () -- C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll

MOD - [2008.01.12 06:40:10 | 000,098,304 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

MOD - [2007.11.30 19:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe

MOD - [2007.11.12 23:41:50 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\MsgTran.dll

MOD - [2007.08.14 21:59:54 | 006,365,184 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtGui4.dll

MOD - [2007.07.12 21:55:52 | 000,131,072 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll

MOD - [2007.07.12 21:55:28 | 001,581,056 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtCore4.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.12.09 12:40:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.12.09 12:39:54 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)

SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.10.03 05:53:00 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService)

SRV - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)

SRV - [2007.08.03 20:24:54 | 000,125,496 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.12.09 12:40:20 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.12.09 12:40:20 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.12.09 12:40:20 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.12.26 17:30:57 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2009.12.26 17:30:57 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2009.05.28 21:41:28 | 004,233,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)

DRV - [2008.06.25 15:58:59 | 007,534,720 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2008.06.25 15:58:59 | 000,043,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)

DRV - [2008.06.03 07:41:51 | 000,015,928 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)

DRV - [2008.05.29 18:21:02 | 000,015,416 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\lullaby.sys -- (lullaby)

DRV - [2008.05.20 01:15:42 | 000,061,424 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Program Files\ASUS\AI TouchMedia\PlayMovie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})

DRV - [2008.05.02 06:59:39 | 000,122,368 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2008.03.21 05:12:59 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2008.02.16 01:42:42 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)

DRV - [2008.02.05 08:52:23 | 000,206,464 | ---- | M] (eMPIA Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etFilter.sys -- (FiltUSBET)

DRV - [2008.01.31 12:18:57 | 000,006,528 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etScan.sys -- (ScanUSBET)

DRV - [2007.12.19 01:12:12 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)

DRV - [2007.09.06 09:43:49 | 000,474,624 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etDevice.sys -- (DCamUSBET)

DRV - [2007.08.03 05:26:21 | 000,020,936 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)

DRV - [2007.07.30 19:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)

DRV - [2007.07.30 18:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)

DRV - [2007.07.24 19:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP)

DRV - [2007.06.17 05:29:08 | 000,146,824 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor)

DRV - [2006.12.14 08:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)

DRV - [2006.11.02 08:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)

DRV - [2005.09.23 21:18:32 | 000,171,520 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MarvinBus.sys -- (MarvinBus)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

IE - HKU\S-1-5-21-2809889056-3464315095-2278337278-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com

IE - HKU\S-1-5-21-2809889056-3464315095-2278337278-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKU\S-1-5-21-2809889056-3464315095-2278337278-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKU\S-1-5-21-2809889056-3464315095-2278337278-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledItems: multilinks@plugin:1.0.0.12

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

 

 

[2009.04.11 14:31:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS x72v\AppData\Roaming\mozilla\Extensions

[2011.12.19 17:49:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS x72v\AppData\Roaming\mozilla\Firefox\Profiles\fgey6id2.default\extensions

[2009.11.13 20:48:43 | 000,000,000 | ---D | M] (Multi Links) -- C:\Users\ASUS x72v\AppData\Roaming\mozilla\Firefox\Profiles\fgey6id2.default\extensions\multilinks@plugin

[2011.12.19 17:49:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS x72v\AppData\Roaming\mozilla\Firefox\Profiles\fgey6id2.default\extensions\staged

[2011.12.19 20:56:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2009.09.04 14:09:54 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION

[2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2011.07.11 22:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.63\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.63\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.63\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL

CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll

CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll

CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll

CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: YouTube = C:\Users\ASUS x72v\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\

CHR - Extension: Google-Suche = C:\Users\ASUS x72v\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\

CHR - Extension: Google Mail = C:\Users\ASUS x72v\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.4_0\

 

O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe ()

O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS)

O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe ()

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O7 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O13 - gopher Prefix: missing

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)

O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B8A7E2A5-BF27-4014-93AD-F1B3729F6DCE}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EC2AFD73-5775-499D-8010-29CA5974B896}: DhcpNameServer = 192.168.2.1

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\ASUS x72v\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\ASUS x72v\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2011.10.10 14:54:08 | 002,290,144 | R--- | M] () - E:\Autorun.exe -- [ CDFS ]

O32 - AutoRun File - [2011.10.09 15:23:34 | 000,000,047 | R--- | M] () - E:\Autorun.inf -- [ CDFS ]

O32 - AutoRun File - [2011.10.09 15:23:34 | 000,224,630 | R--- | M] () - E:\autorun.ico -- [ CDFS ]

O33 - MountPoints2\{25fe0021-95d3-11dd-9e8e-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{25fe0021-95d3-11dd-9e8e-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Autorun.exe -- [2011.10.10 14:54:08 | 002,290,144 | R--- | M] ()

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F00842BF-035E-6FF4-D37F-9021C12AD969} - Microsoft Windows Media Player 11.0

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpReg: evmeufct - hkey= - key= -  File not found

MsConfig - State: "startup" - 2

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.01.04 21:30:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

[2012.01.04 21:30:25 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip

[2012.01.04 19:49:41 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\ASUS x72v\Desktop\OTL.exe

[2012.01.03 22:56:53 | 000,000,000 | ---D | C] -- C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}

[2012.01.03 22:47:14 | 000,939,368 | ---- | C] (Macromedia, Inc.) -- C:\Windows\System32\flash.ocx

[2012.01.03 22:46:59 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Local\PackageAware

[2012.01.02 23:34:36 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\Documents\ANNO 2070

[2012.01.02 22:48:12 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Local\Ubisoft Game Launcher

[2012.01.02 22:47:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Solidshield

[2011.12.22 16:40:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2011.12.22 16:40:21 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2011.12.22 15:30:32 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Roaming\Avira

[2011.12.19 21:30:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2011.12.19 21:30:24 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2011.12.19 21:30:23 | 000,134,856 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2011.12.19 21:30:23 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2011.12.19 21:30:23 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys

[2011.12.19 21:30:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2011.12.19 21:30:22 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2011.12.19 21:17:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2008.06.03 07:41:51 | 000,015,928 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.01.04 22:21:45 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.01.04 22:21:45 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.01.04 22:21:45 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.01.04 22:21:45 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.01.04 22:04:59 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.01.04 21:29:46 | 001,110,476 | ---- | M] () -- C:\Users\ASUS x72v\Desktop\7z920.exe

[2012.01.04 21:12:21 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.01.04 21:12:21 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.01.04 20:08:31 | 000,302,592 | ---- | M] () -- C:\Users\ASUS x72v\Desktop\lovg4e3u.exe

[2012.01.04 19:49:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\ASUS x72v\Desktop\OTL.exe

[2012.01.04 19:48:39 | 000,000,000 | ---- | M] () -- C:\Users\ASUS x72v\defogger_reenable

[2012.01.04 19:47:07 | 000,121,213 | ---- | M] () -- C:\ProgramData\nvModes.001

[2012.01.04 19:44:46 | 000,050,477 | ---- | M] () -- C:\Users\ASUS x72v\Desktop\Defogger.exe

[2012.01.04 17:24:53 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.01.04 17:12:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.01.04 17:11:31 | 3218,227,200 | -HS- | M] () -- C:\hiberfil.sys

[2012.01.04 01:04:41 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2012.01.03 23:14:48 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe

[2012.01.03 22:58:52 | 000,040,046 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20120103_225837.reg

[2012.01.03 22:06:25 | 000,000,067 | ---- | M] () -- C:\Windows\wininit.ini

[2012.01.03 22:05:01 | 000,000,341 | ---- | M] () -- C:\Windows\SIERRA.INI

[2012.01.03 20:49:54 | 000,450,704 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.01.03 20:42:03 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat

[2012.01.03 20:42:03 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat

[2012.01.03 20:41:52 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf

[2012.01.02 22:39:12 | 000,121,213 | ---- | M] () -- C:\ProgramData\nvModes.dat

[2011.12.22 16:48:05 | 000,000,206 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164801.reg

[2011.12.22 16:47:39 | 000,005,888 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164734.reg

[2011.12.22 16:47:08 | 000,014,124 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164703.reg

[2011.12.22 16:46:24 | 000,218,176 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164557.reg

[2011.12.22 15:29:24 | 000,000,680 | RHS- | M] () -- C:\Users\ASUS x72v\ntuser.pol

[2011.12.19 21:30:36 | 000,001,814 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2011.12.09 12:40:20 | 000,134,856 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2011.12.09 12:40:20 | 000,074,640 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2011.12.09 12:40:20 | 000,036,000 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.01.04 21:29:45 | 001,110,476 | ---- | C] () -- C:\Users\ASUS x72v\Desktop\7z920.exe

[2012.01.04 20:08:30 | 000,302,592 | ---- | C] () -- C:\Users\ASUS x72v\Desktop\lovg4e3u.exe

[2012.01.04 19:48:39 | 000,000,000 | ---- | C] () -- C:\Users\ASUS x72v\defogger_reenable

[2012.01.04 19:44:45 | 000,050,477 | ---- | C] () -- C:\Users\ASUS x72v\Desktop\Defogger.exe

[2012.01.03 22:58:42 | 000,040,046 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20120103_225837.reg

[2012.01.03 22:06:25 | 000,000,067 | ---- | C] () -- C:\Windows\wininit.ini

[2012.01.03 20:41:52 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf

[2011.12.22 16:48:03 | 000,000,206 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164801.reg

[2011.12.22 16:47:36 | 000,005,888 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164734.reg

[2011.12.22 16:47:05 | 000,014,124 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164703.reg

[2011.12.22 16:46:07 | 000,218,176 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164557.reg

[2011.12.19 21:30:36 | 000,001,814 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2011.12.18 23:23:29 | 3218,227,200 | -HS- | C] () -- C:\hiberfil.sys

[2011.08.18 21:00:49 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat

[2011.01.23 14:36:37 | 000,000,341 | ---- | C] () -- C:\Windows\SIERRA.INI

[2010.01.14 17:19:00 | 000,275,742 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\evmeufct_nav.dat

[2010.01.14 17:19:00 | 000,003,485 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\evmeufct.dat

[2010.01.14 17:19:00 | 000,002,249 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\evmeufct_navps.dat

[2009.12.26 17:30:57 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys

[2009.12.26 17:30:57 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys

[2009.11.22 19:56:21 | 000,000,016 | ---- | C] () -- C:\Windows\popcinfo.dat

[2009.10.01 17:02:49 | 000,004,907 | ---- | C] () -- C:\ProgramData\ypkpiykb.yyr

[2009.09.14 15:40:53 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009.09.14 15:40:53 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009.08.13 20:06:07 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2009.08.13 16:44:57 | 000,000,081 | -HS- | C] () -- C:\ProgramData\.zreglib

[2009.08.13 16:26:02 | 000,000,095 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\yqkcuogy.bat

[2009.02.27 09:57:49 | 000,000,680 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\d3d9caps.dat

[2009.02.07 15:04:06 | 000,024,206 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Roaming\UserTile.png

[2009.01.15 18:16:05 | 000,016,896 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008.12.13 12:37:56 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini

[2008.12.06 10:04:44 | 000,121,213 | ---- | C] () -- C:\ProgramData\nvModes.001

[2008.12.05 20:29:39 | 000,121,213 | ---- | C] () -- C:\ProgramData\nvModes.dat

[2008.10.09 08:41:14 | 000,000,024 | ---- | C] () -- C:\Windows\System32\ChkMail.ini

[2008.10.09 08:40:56 | 000,045,056 | ---- | C] () -- C:\Windows\System32\acovcnt.exe

[2008.10.09 08:30:30 | 000,047,672 | ---- | C] () -- C:\Windows\AsScrProlog.exe

[2008.10.09 07:06:39 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2008.10.09 06:16:03 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat

[2008.07.02 03:28:38 | 000,061,440 | ---- | C] () -- C:\Program Files\Common Files\CPInstallAction.dll

[2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files\Common Files\banner.jpg

[2008.04.16 12:11:34 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2008.04.16 12:11:34 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2008.04.16 12:11:34 | 000,126,454 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2008.04.16 12:11:34 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2008.04.16 11:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini

[2007.04.16 11:24:16 | 000,023,752 | ---- | C] () -- C:\Windows\System32\providers.bin

[2007.03.06 07:39:19 | 000,049,152 | ---- | C] () -- C:\Windows\revdevdll.dll

[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 13:47:37 | 000,450,704 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 11:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 11:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2006.03.09 02:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2005.04.03 00:29:59 | 000,110,592 | R--- | C] () -- C:\Windows\System32\scardsyn.dll

[2001.11.14 21:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

[1998.05.06 05:09:59 | 000,069,632 | R--- | C] () -- C:\Windows\System32\ODMA32.dll

 
 ========== LOP Check ==========

 

[2009.03.13 14:49:29 | 000,000,000 | -HSD | M] -- C:\Users\ASUS x72v\AppData\Roaming\.#

[2010.12.23 23:58:49 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\FreeAudioPack

[2011.01.18 21:02:01 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\GOA

[2009.02.07 15:04:06 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\PeerNetworking

[2011.05.07 09:51:25 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\ScummVM

[2012.01.02 22:38:39 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Ubisoft

[2011.07.01 14:47:52 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant

[2011.08.18 21:04:31 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Daedalic Entertainment

[2011.03.19 10:50:57 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\elsterformular

[2010.07.16 16:25:05 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\EPSON

[2010.12.24 00:01:32 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\FreeAudioPack

[2009.10.04 12:59:42 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\GetRightToGo

[2011.01.19 16:33:46 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\GOA

[2009.08.10 15:11:00 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\My Games

[2011.05.07 10:26:56 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\ScummVM

[2009.08.13 12:56:14 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Sega

[2010.01.07 22:05:29 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Ubisoft

[2011.11.25 19:57:41 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\WB Games

[2012.01.04 01:04:42 | 000,032,634 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*. >

[2012.01.03 22:37:47 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN

[2008.10.09 08:32:40 | 000,000,000 | -H-D | M] -- C:\ASUS.SYS

[2011.08.19 17:31:47 | 000,000,000 | -HSD | M] -- C:\Boot

[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2008.10.09 07:40:01 | 000,000,000 | ---D | M] -- C:\Intel

[2009.10.01 17:15:21 | 000,000,000 | ---D | M] -- C:\Movavi Dateien

[2009.04.29 10:20:01 | 000,000,000 | RH-D | M] -- C:\MSOCache

[2008.01.21 03:32:31 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2012.01.04 21:30:25 | 000,000,000 | ---D | M] -- C:\Program Files

[2012.01.04 17:11:27 | 000,000,000 | -H-D | M] -- C:\ProgramData

[2012.01.04 22:23:54 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2009.04.11 14:15:55 | 000,000,000 | R--D | M] -- C:\Users

[2012.01.04 17:27:36 | 000,000,000 | ---D | M] -- C:\Windows

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.manifest /3 >

 

 
 < MD5 for: AFD.SYS  >

[2011.04.21 14:58:27 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=3911B972B55FEA0478476B2E777B29FA -- C:\Windows\System32\drivers\afd.sys

[2011.04.21 14:58:27 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=3911B972B55FEA0478476B2E777B29FA -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18457_none_d99fb42e5bb59d9b\afd.sys

[2011.04.21 14:16:42 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=48EB99503533C27AC6135648E5474457 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18639_none_d7d0e0cc5e7d461c\afd.sys

[2011.04.21 14:28:53 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=70EE0FC7A0F384DBD929A01384AEEB4B -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.22629_none_da4bc33774b91967\afd.sys

[2008.01.21 03:24:17 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=763E172A55177E478CB419F88FD0BA03 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys

[2009.04.11 05:47:03 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=A201207363AA900ABF1A388468688570 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18005_none_d9d3bb9e5b8eea9c\afd.sys

[2011.04.21 14:12:21 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=C8AF25017CECB75906A571AC70D2D306 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.22905_none_d876efff77862705\afd.sys

 
 < MD5 for: EXPLORER.EXE  >

[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe

[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe

[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe

[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe

[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe

[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe

[2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

 
 < MD5 for: REGEDIT.EXE  >

[2008.01.21 03:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe

[2008.01.21 03:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe

 
 < MD5 for: USERINIT.EXE  >

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-01-04 16:46:57

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 24 bytes -> C:\Windows:8B2BC208D720ED33
 

< End of report >

cosinus

05.01.2012 13:36

Zitat:

ich mein AV-Programm danach suchen lassen und die betreffende Datei gelöscht.

Log dazu muss immer gepostet werden

nightingale7

05.01.2012 13:53

Hallo cosinus,

kannst du mir sagen, wie und wo ich das Log finde? Da es noch vor Weihnachten war, weiß ich leider auch gar nicht mehr genau, an welchem Tag ich die Löschung vorgenommen habe. Spielt das eine Rolle oder gibt es ein Log, das sämtliche Scans des AV-Programms (Avira Antivir) in den letzten Tagen anzeigt? Was in dem Zusammenhang sicher auch wichtig ist: Ich hatte vor dem Virus-Befall noch nicht das neueste Upgrade des AV-Programms und habe dieses erst danach installiert. Besteht nun durch den Virus die Möglichkeit, dass etwas mit dem Programm nicht in Ordnung ist?

cosinus

05.01.2012 13:56

Einfach mal im Programm unter Berichte/Ereignisse nachsehen

nightingale7

05.01.2012 14:11

Es scheint leider, dass ich beim ersten Auftreten des Virus diesen doch noch mit der alten Version des AV-Programms vor dem Installieren des Upgrades gelöscht habe. Die neue Version zeigt Berichte seit dem 19.12. an, die alle okay sind, bis auf einen am 03.01., als der oben geschilderte 2. Vorfall mit dem Virus sich ereignet hat. Hier das Log davon:

Code:



Avira Free Antivirus

Erstellungsdatum der Reportdatei: Dienstag, 3. Januar 2012  22:16
 

Es wird nach 3019303 Virenstämmen gesucht.
 

Das Programm läuft als uneingeschränkte Vollversion.

Online-Dienste stehen zur Verfügung.
 

Lizenznehmer   : Avira AntiVir Personal - Free Antivirus

Seriennummer   : 0000149996-ADJIE-0000001

Plattform      : Windows Vista

Windowsversion : (Service Pack 2)  [6.0.6002]

Boot Modus     : Normal gebootet

Benutzername   : SYSTEM

Computername   : ASUSX72V-PC
 

Versionsinformationen:

BUILD.DAT      : 12.0.0.872     41826 Bytes  15.12.2011 16:24:00

AVSCAN.EXE     : 12.1.0.18     490448 Bytes  09.12.2011 11:39:55

AVSCAN.DLL     : 12.1.0.17      65744 Bytes  09.12.2011 11:40:16

LUKE.DLL       : 12.1.0.17      68304 Bytes  09.12.2011 11:40:03

AVSCPLR.DLL    : 12.1.0.21      99536 Bytes  09.12.2011 11:39:56

AVREG.DLL      : 12.1.0.27     227536 Bytes  09.12.2011 12:10:20

VBASE000.VDF   : 7.10.0.0    19875328 Bytes  06.11.2009 18:18:34

VBASE001.VDF   : 7.11.0.0    13342208 Bytes  14.12.2010 09:07:39

VBASE002.VDF   : 7.11.19.170 14374912 Bytes  20.12.2011 20:35:10

VBASE003.VDF   : 7.11.19.171     2048 Bytes  20.12.2011 20:35:10

VBASE004.VDF   : 7.11.19.172     2048 Bytes  20.12.2011 20:35:10

VBASE005.VDF   : 7.11.19.173     2048 Bytes  20.12.2011 20:35:10

VBASE006.VDF   : 7.11.19.174     2048 Bytes  20.12.2011 20:35:10

VBASE007.VDF   : 7.11.19.175     2048 Bytes  20.12.2011 20:35:11

VBASE008.VDF   : 7.11.19.176     2048 Bytes  20.12.2011 20:35:11

VBASE009.VDF   : 7.11.19.177     2048 Bytes  20.12.2011 20:35:11

VBASE010.VDF   : 7.11.19.178     2048 Bytes  20.12.2011 20:35:11

VBASE011.VDF   : 7.11.19.179     2048 Bytes  20.12.2011 20:35:11

VBASE012.VDF   : 7.11.19.180     2048 Bytes  20.12.2011 20:35:11

VBASE013.VDF   : 7.11.19.217   182784 Bytes  22.12.2011 14:32:57

VBASE014.VDF   : 7.11.19.255   148480 Bytes  24.12.2011 18:00:54

VBASE015.VDF   : 7.11.20.29    164352 Bytes  27.12.2011 18:00:54

VBASE016.VDF   : 7.11.20.70    180224 Bytes  29.12.2011 18:00:55

VBASE017.VDF   : 7.11.20.102   240640 Bytes  02.01.2012 21:19:17

VBASE018.VDF   : 7.11.20.103     2048 Bytes  02.01.2012 21:19:17

VBASE019.VDF   : 7.11.20.104     2048 Bytes  02.01.2012 21:19:17

VBASE020.VDF   : 7.11.20.105     2048 Bytes  02.01.2012 21:19:17

VBASE021.VDF   : 7.11.20.106     2048 Bytes  02.01.2012 21:19:17

VBASE022.VDF   : 7.11.20.107     2048 Bytes  02.01.2012 21:19:17

VBASE023.VDF   : 7.11.20.108     2048 Bytes  02.01.2012 21:19:17

VBASE024.VDF   : 7.11.20.109     2048 Bytes  02.01.2012 21:19:17

VBASE025.VDF   : 7.11.20.110     2048 Bytes  02.01.2012 21:19:17

VBASE026.VDF   : 7.11.20.111     2048 Bytes  02.01.2012 21:19:17

VBASE027.VDF   : 7.11.20.112     2048 Bytes  02.01.2012 21:19:17

VBASE028.VDF   : 7.11.20.113     2048 Bytes  02.01.2012 21:19:17

VBASE029.VDF   : 7.11.20.114     2048 Bytes  02.01.2012 21:19:17

VBASE030.VDF   : 7.11.20.115     2048 Bytes  02.01.2012 21:19:17

VBASE031.VDF   : 7.11.20.135   156160 Bytes  03.01.2012 19:56:47

Engineversion  : 8.2.8.18  

AEVDF.DLL      : 8.1.2.2       106868 Bytes  09.12.2011 11:39:53

AESCRIPT.DLL   : 8.1.3.95      479612 Bytes  01.01.2012 18:00:58

AESCN.DLL      : 8.1.7.2       127349 Bytes  01.09.2011 21:46:02

AESBX.DLL      : 8.2.4.5       434549 Bytes  09.12.2011 11:39:52

AERDL.DLL      : 8.1.9.15      639348 Bytes  08.09.2011 21:16:06

AEPACK.DLL     : 8.2.15.1      770423 Bytes  19.12.2011 20:31:11

AEOFFICE.DLL   : 8.1.2.25      201084 Bytes  01.01.2012 18:00:58

AEHEUR.DLL     : 8.1.3.14     4260216 Bytes  01.01.2012 18:00:58

AEHELP.DLL     : 8.1.18.0      254327 Bytes  09.12.2011 11:39:50

AEGEN.DLL      : 8.1.5.17      405877 Bytes  19.12.2011 20:31:09

AEEMU.DLL      : 8.1.3.0       393589 Bytes  01.09.2011 21:46:01

AECORE.DLL     : 8.1.24.3      201079 Bytes  01.01.2012 18:00:57

AEBB.DLL       : 8.1.1.0        53618 Bytes  01.09.2011 21:46:01

AVWINLL.DLL    : 12.1.0.17      27344 Bytes  09.12.2011 11:39:57

AVPREF.DLL     : 12.1.0.17      51920 Bytes  09.12.2011 11:39:55

AVREP.DLL      : 12.1.0.17     179408 Bytes  09.12.2011 11:39:55

AVARKT.DLL     : 12.1.0.19     208848 Bytes  09.12.2011 11:39:53

AVEVTLOG.DLL   : 12.1.0.17     169168 Bytes  09.12.2011 11:39:54

SQLITE3.DLL    : 3.7.0.0       398288 Bytes  09.12.2011 11:40:07

AVSMTP.DLL     : 12.1.0.17      62928 Bytes  09.12.2011 11:39:56

NETNT.DLL      : 12.1.0.17      17104 Bytes  09.12.2011 11:40:03

RCIMAGE.DLL    : 12.1.0.17    4447952 Bytes  09.12.2011 11:40:18

RCTEXT.DLL     : 12.1.0.16      98512 Bytes  09.12.2011 11:40:19
 

Konfiguration für den aktuellen Suchlauf:

Job Name..............................: AVGuardAsyncScan

Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_4f035be8\guard_slideup.avp

Protokollierung.......................: standard

Primäre Aktion........................: interaktiv

Sekundäre Aktion......................: quarantäne

Durchsuche Masterbootsektoren.........: ein

Durchsuche Bootsektoren...............: aus

Durchsuche aktive Programme...........: ein

Durchsuche Registrierung..............: aus

Suche nach Rootkits...................: aus

Integritätsprüfung von Systemdateien..: aus

Datei Suchmodus.......................: Alle Dateien

Durchsuche Archive....................: ein

Rekursionstiefe einschränken..........: 20

Archiv Smart Extensions...............: ein

Makrovirenheuristik...................: ein

Dateiheuristik........................: vollständig
 

Beginn des Suchlaufs: Dienstag, 3. Januar 2012  22:16
 

Der Suchlauf über gestartete Prozesse wird begonnen:

Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'vssvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'msiexec.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SynTPHelper.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmpnetwk.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ehmsas.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'BTTray.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmpnscfg.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ehtray.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'LightScribeControlPanel.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'sidebar.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'DivXUpdate.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wuauclt.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'RtHDVCpl.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SynTPEnh.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'AsScrPro.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'DMedia.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ATKOSD2.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'HControlUser.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'MSASCui.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'WDC.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'KBFiltr.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ATKOSD.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ACEngSvr.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'aspg.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ACMON.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'BatteryLife.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wcourier.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'HControl.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'MsgTranAgt.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ALU.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'sensorsrv.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'Explorer.EXE' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'Dwm.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'alg.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avshadow.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'WLIDSvcM.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SearchIndexer.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'WLIDSVC.EXE' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'spmgr.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'LSSrvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'btwdins.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'agrsmsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'spoolsv.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'GFNEXSrv.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ASLDRSrv.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SLsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'nvvsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'winlogon.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'lsm.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'lsass.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'services.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wininit.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'smss.exe' - '1' Modul(e) wurden durchsucht
 

Der Suchlauf über die ausgewählten Dateien wird begonnen:
 

Beginne mit der Suche in 'C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe'

C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe

  [FUND]      Ist das Trojanische Pferd TR/Lebag.kab
 

Beginne mit der Desinfektion:

C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe

  [FUND]      Ist das Trojanische Pferd TR/Lebag.kab

  [HINWEIS]   Die Datei wurde gelöscht.
 
 

Ende des Suchlaufs: Dienstag, 3. Januar 2012  22:37

Benötigte Zeit: 00:01 Minute(n)
 

Der Suchlauf wurde vollständig durchgeführt.
 

      0 Verzeichnisse wurden überprüft

     82 Dateien wurden geprüft

      1 Viren bzw. unerwünschte Programme wurden gefunden

      0 Dateien wurden als verdächtig eingestuft

      1 Dateien wurden gelöscht

      0 Viren bzw. unerwünschte Programme wurden repariert

      0 Dateien wurden in die Quarantäne verschoben

      0 Dateien wurden umbenannt

      0 Dateien konnten nicht durchsucht werden

     81 Dateien ohne Befall

      0 Archive wurden durchsucht

      0 Warnungen

      1 Hinweise
 
 

Die Suchergebnisse werden an den Guard übermittelt.

cosinus

05.01.2012 15:25

Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

nightingale7

05.01.2012 17:58

Habe Malwarebytes installiert und einen vollständigen Scan gemacht. Während der Scan lief, hat mir Antivir neuerlich den Virus TR/Lebag.kab gemeldet, der sich hinter dem Dateipfad
C:\Users\Nebelkrähe\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P6S07U9X\files_load2[1].exe
verbirgt. Malwarebytes hatte das betreffende Verzeichnis gerade durchsucht und zeigte mir immer noch "0 infizierte Dateien" an. Obwohl ich glaube, bei den Anleitungen hier im Forum keinen solchen Hinweis gesehen zu haben, dachte ich, dass Antivir vielleicht Malwarebytes den Zugriff auf die infizierte Datei verweigert. Habe also den Scan von Malwarebytes abgebrochen, meine Internetverbindung gekappt, Antivir und die Firewall deaktiviert (ohne den Fund von Antivir in Quarantäne zu stellen oder zu löschen!) und schließlich einen neuen Scan mit Malwarebytes gemacht. Hoffe, ich habe mit alledem nicht unwissentlich was Falsches gemacht.

Malwarebytes hat 9 Funde angezeigt, die ich alle entfernt habe. Aber ich glaube, die Datei
C:\Users\Nebelkrähe\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P6S07U9X\files_load2[1].exe
war nicht dabei. Ist das bedenklich?

Hier das Log von Malwarebytes:

Code:

Malwarebytes Anti-Malware 1.60.0.1800

www.malwarebytes.org
 

Datenbank Version: v2012.01.05.02
 

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

ASUS x72v :: ASUSX72V-PC [Administrator]
 

05.01.2012 16:26:22

mbam-log-2012-01-05 (16-26-22).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 317587

Laufzeit: 1 Stunde(n), 4 Minute(n), 2 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 3

HKCU\SOFTWARE\fcn (Rogue.Residue) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\ShoppingReport (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\ShoppingReport (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 4

C:\Program Files\Free Registry Cleaner for Vista (Rogue.FreeRegistryCleanerForVista) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\ShoppingReport (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\ShoppingReport\Bin (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\ShoppingReport\Bin\2.6.56 (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateien: 2

C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.7332428504083895.exe.lnk (Backdoor.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\Free Registry Cleaner for Vista\backuphkcu.REG (Rogue.FreeRegistryCleanerForVista) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Und hier zur Sicherheit auch noch das Log des neuen Fundes von Antivir:

Code:



Avira Free Antivirus

Erstellungsdatum der Reportdatei: Donnerstag, 5. Januar 2012  16:23
 

Es wird nach 3026833 Virenstämmen gesucht.
 

Das Programm läuft als uneingeschränkte Vollversion.

Online-Dienste stehen zur Verfügung.
 

Lizenznehmer   : Avira AntiVir Personal - Free Antivirus

Seriennummer   : 0000149996-ADJIE-0000001

Plattform      : Windows Vista

Windowsversion : (Service Pack 2)  [6.0.6002]

Boot Modus     : Normal gebootet

Benutzername   : SYSTEM

Computername   : ASUSX72V-PC
 

Versionsinformationen:

BUILD.DAT      : 12.0.0.872     41826 Bytes  15.12.2011 16:24:00

AVSCAN.EXE     : 12.1.0.18     490448 Bytes  09.12.2011 11:39:55

AVSCAN.DLL     : 12.1.0.17      65744 Bytes  09.12.2011 11:40:16

LUKE.DLL       : 12.1.0.17      68304 Bytes  09.12.2011 11:40:03

AVSCPLR.DLL    : 12.1.0.21      99536 Bytes  09.12.2011 11:39:56

AVREG.DLL      : 12.1.0.27     227536 Bytes  09.12.2011 12:10:20

VBASE000.VDF   : 7.10.0.0    19875328 Bytes  06.11.2009 18:18:34

VBASE001.VDF   : 7.11.0.0    13342208 Bytes  14.12.2010 09:07:39

VBASE002.VDF   : 7.11.19.170 14374912 Bytes  20.12.2011 20:35:10

VBASE003.VDF   : 7.11.19.171     2048 Bytes  20.12.2011 20:35:10

VBASE004.VDF   : 7.11.19.172     2048 Bytes  20.12.2011 20:35:10

VBASE005.VDF   : 7.11.19.173     2048 Bytes  20.12.2011 20:35:10

VBASE006.VDF   : 7.11.19.174     2048 Bytes  20.12.2011 20:35:10

VBASE007.VDF   : 7.11.19.175     2048 Bytes  20.12.2011 20:35:11

VBASE008.VDF   : 7.11.19.176     2048 Bytes  20.12.2011 20:35:11

VBASE009.VDF   : 7.11.19.177     2048 Bytes  20.12.2011 20:35:11

VBASE010.VDF   : 7.11.19.178     2048 Bytes  20.12.2011 20:35:11

VBASE011.VDF   : 7.11.19.179     2048 Bytes  20.12.2011 20:35:11

VBASE012.VDF   : 7.11.19.180     2048 Bytes  20.12.2011 20:35:11

VBASE013.VDF   : 7.11.19.217   182784 Bytes  22.12.2011 14:32:57

VBASE014.VDF   : 7.11.19.255   148480 Bytes  24.12.2011 18:00:54

VBASE015.VDF   : 7.11.20.29    164352 Bytes  27.12.2011 18:00:54

VBASE016.VDF   : 7.11.20.70    180224 Bytes  29.12.2011 18:00:55

VBASE017.VDF   : 7.11.20.102   240640 Bytes  02.01.2012 21:19:17

VBASE018.VDF   : 7.11.20.139   164864 Bytes  04.01.2012 12:59:49

VBASE019.VDF   : 7.11.20.140     2048 Bytes  04.01.2012 12:59:49

VBASE020.VDF   : 7.11.20.141     2048 Bytes  04.01.2012 12:59:49

VBASE021.VDF   : 7.11.20.142     2048 Bytes  04.01.2012 12:59:49

VBASE022.VDF   : 7.11.20.143     2048 Bytes  04.01.2012 12:59:49

VBASE023.VDF   : 7.11.20.144     2048 Bytes  04.01.2012 12:59:49

VBASE024.VDF   : 7.11.20.145     2048 Bytes  04.01.2012 12:59:50

VBASE025.VDF   : 7.11.20.146     2048 Bytes  04.01.2012 12:59:50

VBASE026.VDF   : 7.11.20.147     2048 Bytes  04.01.2012 12:59:50

VBASE027.VDF   : 7.11.20.148     2048 Bytes  04.01.2012 12:59:50

VBASE028.VDF   : 7.11.20.149     2048 Bytes  04.01.2012 12:59:50

VBASE029.VDF   : 7.11.20.150     2048 Bytes  04.01.2012 12:59:50

VBASE030.VDF   : 7.11.20.151     2048 Bytes  04.01.2012 12:59:50

VBASE031.VDF   : 7.11.20.169   104448 Bytes  05.01.2012 12:59:50

Engineversion  : 8.2.8.18  

AEVDF.DLL      : 8.1.2.2       106868 Bytes  09.12.2011 11:39:53

AESCRIPT.DLL   : 8.1.3.95      479612 Bytes  01.01.2012 18:00:58

AESCN.DLL      : 8.1.7.2       127349 Bytes  01.09.2011 21:46:02

AESBX.DLL      : 8.2.4.5       434549 Bytes  09.12.2011 11:39:52

AERDL.DLL      : 8.1.9.15      639348 Bytes  08.09.2011 21:16:06

AEPACK.DLL     : 8.2.15.1      770423 Bytes  19.12.2011 20:31:11

AEOFFICE.DLL   : 8.1.2.25      201084 Bytes  01.01.2012 18:00:58

AEHEUR.DLL     : 8.1.3.14     4260216 Bytes  01.01.2012 18:00:58

AEHELP.DLL     : 8.1.18.0      254327 Bytes  09.12.2011 11:39:50

AEGEN.DLL      : 8.1.5.17      405877 Bytes  19.12.2011 20:31:09

AEEMU.DLL      : 8.1.3.0       393589 Bytes  01.09.2011 21:46:01

AECORE.DLL     : 8.1.24.3      201079 Bytes  01.01.2012 18:00:57

AEBB.DLL       : 8.1.1.0        53618 Bytes  01.09.2011 21:46:01

AVWINLL.DLL    : 12.1.0.17      27344 Bytes  09.12.2011 11:39:57

AVPREF.DLL     : 12.1.0.17      51920 Bytes  09.12.2011 11:39:55

AVREP.DLL      : 12.1.0.17     179408 Bytes  09.12.2011 11:39:55

AVARKT.DLL     : 12.1.0.19     208848 Bytes  09.12.2011 11:39:53

AVEVTLOG.DLL   : 12.1.0.17     169168 Bytes  09.12.2011 11:39:54

SQLITE3.DLL    : 3.7.0.0       398288 Bytes  09.12.2011 11:40:07

AVSMTP.DLL     : 12.1.0.17      62928 Bytes  09.12.2011 11:39:56

NETNT.DLL      : 12.1.0.17      17104 Bytes  09.12.2011 11:40:03

RCIMAGE.DLL    : 12.1.0.17    4447952 Bytes  09.12.2011 11:40:18

RCTEXT.DLL     : 12.1.0.16      98512 Bytes  09.12.2011 11:40:19
 

Konfiguration für den aktuellen Suchlauf:

Job Name..............................: AVGuardAsyncScan

Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_4f059729\guard_slideup.avp

Protokollierung.......................: standard

Primäre Aktion........................: interaktiv

Sekundäre Aktion......................: quarantäne

Durchsuche Masterbootsektoren.........: ein

Durchsuche Bootsektoren...............: aus

Durchsuche aktive Programme...........: ein

Durchsuche Registrierung..............: aus

Suche nach Rootkits...................: aus

Integritätsprüfung von Systemdateien..: aus

Datei Suchmodus.......................: Alle Dateien

Durchsuche Archive....................: ein

Rekursionstiefe einschränken..........: 20

Archiv Smart Extensions...............: ein

Makrovirenheuristik...................: ein

Dateiheuristik........................: vollständig
 

Beginn des Suchlaufs: Donnerstag, 5. Januar 2012  16:23
 

Der Suchlauf über gestartete Prozesse wird begonnen:

Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SynTPHelper.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmpnetwk.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ehmsas.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'BTTray.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmpnscfg.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ehtray.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'LightScribeControlPanel.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'sidebar.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'DivXUpdate.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'RtHDVCpl.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SynTPEnh.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'AsScrPro.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'DMedia.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ATKOSD2.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'HControlUser.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'MSASCui.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'WDC.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'KBFiltr.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ACEngSvr.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ATKOSD.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'aspg.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ACMON.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'BatteryLife.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wcourier.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'HControl.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'MsgTranAgt.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'sensorsrv.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ALU.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'Explorer.EXE' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'Dwm.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'alg.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avshadow.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'WLIDSvcM.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SearchIndexer.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'WLIDSVC.EXE' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'spmgr.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'LSSrvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'btwdins.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'agrsmsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'spoolsv.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'GFNEXSrv.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ASLDRSrv.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SLsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'nvvsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'winlogon.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'lsm.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'lsass.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'services.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wininit.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'smss.exe' - '1' Modul(e) wurden durchsucht
 

Der Suchlauf über die ausgewählten Dateien wird begonnen:
 

Beginne mit der Suche in 'C:\Users\Nebelkrähe\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P6S07U9X\files_load2[1].exe'

C:\Users\Nebelkrähe\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P6S07U9X\files_load2[1].exe

  [FUND]      Ist das Trojanische Pferd TR/Lebag.kab
 

Beginne mit der Desinfektion:

C:\Users\Nebelkrähe\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P6S07U9X\files_load2[1].exe

  [FUND]      Ist das Trojanische Pferd TR/Lebag.kab

  [WARNUNG]   Die Datei wurde ignoriert.
 
 

Ende des Suchlaufs: Donnerstag, 5. Januar 2012  16:24

Benötigte Zeit: 00:02 Minute(n)
 

Der Suchlauf wurde vollständig durchgeführt.
 

      0 Verzeichnisse wurden überprüft

     78 Dateien wurden geprüft

      1 Viren bzw. unerwünschte Programme wurden gefunden

      0 Dateien wurden als verdächtig eingestuft

      0 Dateien wurden gelöscht

      0 Viren bzw. unerwünschte Programme wurden repariert

      0 Dateien wurden in die Quarantäne verschoben

      0 Dateien wurden umbenannt

      0 Dateien konnten nicht durchsucht werden

     77 Dateien ohne Befall

      0 Archive wurden durchsucht

      1 Warnungen

      0 Hinweise
 
 

Die Suchergebnisse werden an den Guard übermittelt.

Nun mache ich noch den Scan mit ESET und melde mich dann wieder.

nightingale7

05.01.2012 20:04

Habe ESET ausgeführt. Das Programm hat vor dem Scan gemeldet, dass mein Windows-Defender aktiv sei und es damit Konflikte geben könnte, aber ich hatte mich extra belesen, wie ich den Defender deaktivieren kann, auch alles so gemacht und in der Systemsteuerung auch den Hinweis bekommen, dass er tatsächlich deaktiviert ist. Habe deshalb trotz der Meldung von ESET den Scan durchgeführt und das Programm hat noch weitere 4 Funde gemeldet, unter anderem nun auch die von Antivir, aber scheinbar nicht von Malwarebytes als Trojaner erkannte Datei
C:\Users\Nebelkrähe\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P6S07U9X\files_load2[1].exe.

Hier das Log des ESET-Scans:

Code:

ESETSmartInstaller@High as downloader log:

all ok

ESETSmartInstaller@High as downloader log:

all ok

ESETSmartInstaller@High as downloader log:

all ok

ESETSmartInstaller@High as downloader log:

all ok

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=4b3ba71c57ac5a47b56969e5e5838058

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-01-05 06:48:46

# local_time=2012-01-05 07:48:46 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=1792 16777215 100 0 1460724 1460724 0 0

# compatibility_mode=5892 16776574 100 100 3957 163316475 0 0

# compatibility_mode=8192 67108863 100 0 4393 4393 0 0

# scanned=154123

# found=4

# cleaned=0

# scan_time=5579

C:\Users\Nebelkrähe\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P6S07U9X\files_load2[1].exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Nebelkrähe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27\4ca01f9b-3cfe86e7        a variant of Java/Exploit.CVE-2011-3544.G trojan (unable to clean)        00000000000000000000000000000000        I

D:\Install\Setup19_FreeConverter.exe        Win32/Adware.Toolbar.Dealio application (unable to clean)        00000000000000000000000000000000        I

D:\Install\SoftonicDownloader_fuer_scummvm.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

Bitte sag mir, wie ich nun weiter vorgehen soll, um auch diese Funde zu eliminieren.

cosinus

05.01.2012 22:00

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

nightingale7

05.01.2012 22:35

Hier das neue OTL-Log:

Code:

OTL logfile created on: 05.01.2012 22:15:31 - Run 4

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\ASUS x72v\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,60 Gb Available Physical Memory | 53,46% Memory free

6,19 Gb Paging File | 4,89 Gb Available in Paging File | 78,92% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 149,04 Gb Total Space | 79,20 Gb Free Space | 53,14% Space Free | Partition Type: NTFS

Drive D: | 139,28 Gb Total Space | 32,31 Gb Free Space | 23,20% Space Free | Partition Type: NTFS

Drive E: | 4,61 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: ASUSX72V-PC | User Name: ASUS x72v | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.01.04 19:49:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\ASUS x72v\Desktop\OTL.exe

PRC - [2011.12.09 12:40:20 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.12.09 12:40:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2011.12.09 12:39:54 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.12.09 12:39:54 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.03.21 19:56:16 | 001,230,704 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe

PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009.04.11 07:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe

PRC - [2008.10.09 08:30:20 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe

PRC - [2008.07.15 19:29:00 | 007,651,328 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe

PRC - [2008.07.15 19:22:46 | 000,217,088 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControl.exe

PRC - [2008.07.10 01:09:26 | 000,191,032 | ---- | M] (ATK) -- C:\Program Files\P4G\BatteryLife.exe

PRC - [2008.06.25 03:01:08 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Media\DMedia.exe

PRC - [2008.06.24 04:16:24 | 002,482,176 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe

PRC - [2008.06.19 20:18:12 | 000,154,168 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ASUS CopyProtect\ASPG.exe

PRC - [2008.06.18 06:10:24 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files\ASUS\SmartLogon\sensorsrv.exe

PRC - [2008.06.13 06:52:51 | 006,183,456 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2008.06.04 01:29:08 | 000,851,968 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe

PRC - [2008.04.10 19:32:18 | 000,752,168 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

PRC - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe

PRC - [2008.01.23 18:51:28 | 000,151,552 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\WDC.exe

PRC - [2008.01.21 03:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe

PRC - [2008.01.12 06:40:10 | 000,098,304 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

PRC - [2007.11.30 19:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe

PRC - [2007.11.05 03:48:06 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe

PRC - [2007.10.03 05:53:00 | 000,094,208 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe

PRC - [2007.08.15 19:20:16 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe

PRC - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe

PRC - [2007.08.03 20:24:54 | 000,125,496 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

PRC - [2007.07.06 00:53:44 | 001,040,384 | ---- | M] () -- C:\Program Files\Wireless Console 2\wcourier.exe

PRC - [2005.07.06 23:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.03.21 19:57:34 | 000,096,112 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll

MOD - [2011.03.21 19:56:16 | 001,230,704 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe

MOD - [2008.09.16 19:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll

MOD - [2008.04.10 19:25:54 | 000,126,976 | ---- | M] () -- C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll

MOD - [2008.01.12 06:40:10 | 000,098,304 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

MOD - [2007.11.30 19:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe

MOD - [2007.11.12 23:41:50 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\MsgTran.dll

MOD - [2007.08.14 21:59:54 | 006,365,184 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtGui4.dll

MOD - [2007.07.12 21:55:52 | 000,131,072 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll

MOD - [2007.07.12 21:55:28 | 001,581,056 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtCore4.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.12.09 12:40:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.12.09 12:39:54 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)

SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.10.03 05:53:00 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService)

SRV - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)

SRV - [2007.08.03 20:24:54 | 000,125,496 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.12.09 12:40:20 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.12.09 12:40:20 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.12.09 12:40:20 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.12.26 17:30:57 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2009.12.26 17:30:57 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2009.05.28 21:41:28 | 004,233,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)

DRV - [2008.06.25 15:58:59 | 007,534,720 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2008.06.25 15:58:59 | 000,043,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)

DRV - [2008.06.03 07:41:51 | 000,015,928 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)

DRV - [2008.05.29 18:21:02 | 000,015,416 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\lullaby.sys -- (lullaby)

DRV - [2008.05.20 01:15:42 | 000,061,424 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Program Files\ASUS\AI TouchMedia\PlayMovie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})

DRV - [2008.05.02 06:59:39 | 000,122,368 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2008.03.21 05:12:59 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2008.02.16 01:42:42 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)

DRV - [2008.02.05 08:52:23 | 000,206,464 | ---- | M] (eMPIA Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etFilter.sys -- (FiltUSBET)

DRV - [2008.01.31 12:18:57 | 000,006,528 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etScan.sys -- (ScanUSBET)

DRV - [2007.12.19 01:12:12 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)

DRV - [2007.09.06 09:43:49 | 000,474,624 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etDevice.sys -- (DCamUSBET)

DRV - [2007.08.03 05:26:21 | 000,020,936 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)

DRV - [2007.07.30 19:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)

DRV - [2007.07.30 18:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)

DRV - [2007.07.24 19:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP)

DRV - [2007.06.17 05:29:08 | 000,146,824 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor)

DRV - [2006.12.14 08:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)

DRV - [2006.11.02 08:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)

DRV - [2005.09.23 21:18:32 | 000,171,520 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MarvinBus.sys -- (MarvinBus)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledItems: multilinks@plugin:1.0.0.12

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

 

 

[2009.04.11 14:31:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS x72v\AppData\Roaming\mozilla\Extensions

[2011.12.19 17:49:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS x72v\AppData\Roaming\mozilla\Firefox\Profiles\fgey6id2.default\extensions

[2009.11.13 20:48:43 | 000,000,000 | ---D | M] (Multi Links) -- C:\Users\ASUS x72v\AppData\Roaming\mozilla\Firefox\Profiles\fgey6id2.default\extensions\multilinks@plugin

[2011.12.19 17:49:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS x72v\AppData\Roaming\mozilla\Firefox\Profiles\fgey6id2.default\extensions\staged

[2011.12.19 20:56:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2009.09.04 14:09:54 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION

[2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2011.07.11 22:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.63\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.63\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.63\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL

CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll

CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll

CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll

CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: YouTube = C:\Users\ASUS x72v\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\

CHR - Extension: Google-Suche = C:\Users\ASUS x72v\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\

CHR - Extension: Google Mail = C:\Users\ASUS x72v\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.4_0\

 

O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe ()

O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS)

O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe ()

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O13 - gopher Prefix: missing

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)

O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B8A7E2A5-BF27-4014-93AD-F1B3729F6DCE}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EC2AFD73-5775-499D-8010-29CA5974B896}: DhcpNameServer = 192.168.2.1

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\ASUS x72v\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\ASUS x72v\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2011.10.10 14:54:08 | 002,290,144 | R--- | M] () - E:\Autorun.exe -- [ CDFS ]

O32 - AutoRun File - [2011.10.09 15:23:34 | 000,000,047 | R--- | M] () - E:\Autorun.inf -- [ CDFS ]

O32 - AutoRun File - [2011.10.09 15:23:34 | 000,224,630 | R--- | M] () - E:\autorun.ico -- [ CDFS ]

O33 - MountPoints2\{25fe0021-95d3-11dd-9e8e-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{25fe0021-95d3-11dd-9e8e-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Autorun.exe -- [2011.10.10 14:54:08 | 002,290,144 | R--- | M] ()

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpReg: evmeufct - hkey= - key= -  File not found

MsConfig - State: "startup" - 2

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfPf - Driver

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F00842BF-035E-6FF4-D37F-9021C12AD969} - Microsoft Windows Media Player 11.0

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\Windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: wave2 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.01.05 18:12:14 | 002,322,184 | ---- | C] (ESET) -- C:\Users\ASUS x72v\Desktop\esetsmartinstaller_enu.exe

[2012.01.05 18:02:34 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.01.05 15:38:58 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Roaming\Malwarebytes

[2012.01.05 15:38:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.01.05 15:38:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.01.05 15:38:41 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.01.05 15:38:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.01.05 15:36:56 | 010,847,608 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\ASUS x72v\Desktop\mbam-setup-1.60.0.1800.exe

[2012.01.04 21:30:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

[2012.01.04 21:30:25 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip

[2012.01.04 19:49:41 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\ASUS x72v\Desktop\OTL.exe

[2012.01.03 22:56:53 | 000,000,000 | ---D | C] -- C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}

[2012.01.03 22:47:14 | 000,939,368 | ---- | C] (Macromedia, Inc.) -- C:\Windows\System32\flash.ocx

[2012.01.03 22:46:59 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Local\PackageAware

[2012.01.02 23:34:36 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\Documents\ANNO 2070

[2012.01.02 22:48:12 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Local\Ubisoft Game Launcher

[2012.01.02 22:47:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Solidshield

[2011.12.22 16:40:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2011.12.22 16:40:21 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2011.12.22 15:30:32 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Roaming\Avira

[2011.12.19 21:30:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2011.12.19 21:30:24 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2011.12.19 21:30:23 | 000,134,856 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2011.12.19 21:30:23 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2011.12.19 21:30:23 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys

[2011.12.19 21:30:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2011.12.19 21:30:22 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2011.12.19 21:17:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2008.06.03 07:41:51 | 000,015,928 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.01.05 22:05:00 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.01.05 21:27:18 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.01.05 21:27:18 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.01.05 18:12:00 | 002,322,184 | ---- | M] (ESET) -- C:\Users\ASUS x72v\Desktop\esetsmartinstaller_enu.exe

[2012.01.05 15:38:43 | 000,000,873 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.01.05 15:36:53 | 010,847,608 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\ASUS x72v\Desktop\mbam-setup-1.60.0.1800.exe

[2012.01.05 13:30:42 | 000,000,378 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20120105_133037.reg

[2012.01.05 13:27:47 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe

[2012.01.05 13:27:42 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.01.05 13:27:26 | 000,121,213 | ---- | M] () -- C:\ProgramData\nvModes.001

[2012.01.05 13:27:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.01.05 13:27:10 | 3220,295,680 | -HS- | M] () -- C:\hiberfil.sys

[2012.01.05 10:24:00 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2012.01.05 09:54:45 | 000,002,225 | ---- | M] () -- C:\Users\ASUS x72v\Desktop\gmer.zip

[2012.01.05 09:38:04 | 000,003,202 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20120105_093755.reg

[2012.01.04 22:21:45 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.01.04 22:21:45 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.01.04 22:21:45 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.01.04 22:21:45 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.01.04 21:29:46 | 001,110,476 | ---- | M] () -- C:\Users\ASUS x72v\Desktop\7z920.exe

[2012.01.04 20:08:31 | 000,302,592 | ---- | M] () -- C:\Users\ASUS x72v\Desktop\lovg4e3u.exe

[2012.01.04 19:49:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\ASUS x72v\Desktop\OTL.exe

[2012.01.04 19:48:39 | 000,000,000 | ---- | M] () -- C:\Users\ASUS x72v\defogger_reenable

[2012.01.04 19:44:46 | 000,050,477 | ---- | M] () -- C:\Users\ASUS x72v\Desktop\Defogger.exe

[2012.01.03 22:58:52 | 000,040,046 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20120103_225837.reg

[2012.01.03 22:06:25 | 000,000,067 | ---- | M] () -- C:\Windows\wininit.ini

[2012.01.03 22:05:01 | 000,000,341 | ---- | M] () -- C:\Windows\SIERRA.INI

[2012.01.03 20:49:54 | 000,450,704 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.01.03 20:42:03 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat

[2012.01.03 20:42:03 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat

[2012.01.03 20:41:52 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf

[2012.01.02 22:39:12 | 000,121,213 | ---- | M] () -- C:\ProgramData\nvModes.dat

[2011.12.22 16:48:05 | 000,000,206 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164801.reg

[2011.12.22 16:47:39 | 000,005,888 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164734.reg

[2011.12.22 16:47:08 | 000,014,124 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164703.reg

[2011.12.22 16:46:24 | 000,218,176 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164557.reg

[2011.12.22 15:29:24 | 000,000,680 | RHS- | M] () -- C:\Users\ASUS x72v\ntuser.pol

[2011.12.19 21:30:36 | 000,001,814 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2011.12.09 12:40:20 | 000,134,856 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2011.12.09 12:40:20 | 000,074,640 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2011.12.09 12:40:20 | 000,036,000 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.01.05 15:38:43 | 000,000,873 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.01.05 13:30:40 | 000,000,378 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20120105_133037.reg

[2012.01.05 09:54:45 | 000,002,225 | ---- | C] () -- C:\Users\ASUS x72v\Desktop\gmer.zip

[2012.01.05 09:38:01 | 000,003,202 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20120105_093755.reg

[2012.01.04 21:29:45 | 001,110,476 | ---- | C] () -- C:\Users\ASUS x72v\Desktop\7z920.exe

[2012.01.04 20:08:30 | 000,302,592 | ---- | C] () -- C:\Users\ASUS x72v\Desktop\lovg4e3u.exe

[2012.01.04 19:48:39 | 000,000,000 | ---- | C] () -- C:\Users\ASUS x72v\defogger_reenable

[2012.01.04 19:44:45 | 000,050,477 | ---- | C] () -- C:\Users\ASUS x72v\Desktop\Defogger.exe

[2012.01.03 22:58:42 | 000,040,046 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20120103_225837.reg

[2012.01.03 22:06:25 | 000,000,067 | ---- | C] () -- C:\Windows\wininit.ini

[2012.01.03 20:41:52 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf

[2011.12.22 16:48:03 | 000,000,206 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164801.reg

[2011.12.22 16:47:36 | 000,005,888 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164734.reg

[2011.12.22 16:47:05 | 000,014,124 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164703.reg

[2011.12.22 16:46:07 | 000,218,176 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164557.reg

[2011.12.19 21:30:36 | 000,001,814 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2011.12.18 23:23:29 | 3220,295,680 | -HS- | C] () -- C:\hiberfil.sys

[2011.08.18 21:00:49 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat

[2011.01.23 14:36:37 | 000,000,341 | ---- | C] () -- C:\Windows\SIERRA.INI

[2010.01.14 17:19:00 | 000,275,742 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\evmeufct_nav.dat

[2010.01.14 17:19:00 | 000,003,485 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\evmeufct.dat

[2010.01.14 17:19:00 | 000,002,249 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\evmeufct_navps.dat

[2009.12.26 17:30:57 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys

[2009.12.26 17:30:57 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys

[2009.11.22 19:56:21 | 000,000,016 | ---- | C] () -- C:\Windows\popcinfo.dat

[2009.10.01 17:02:49 | 000,004,907 | ---- | C] () -- C:\ProgramData\ypkpiykb.yyr

[2009.09.14 15:40:53 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009.09.14 15:40:53 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009.08.13 20:06:07 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2009.08.13 16:44:57 | 000,000,081 | -HS- | C] () -- C:\ProgramData\.zreglib

[2009.08.13 16:26:02 | 000,000,095 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\yqkcuogy.bat

[2009.02.27 09:57:49 | 000,000,680 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\d3d9caps.dat

[2009.02.07 15:04:06 | 000,024,206 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Roaming\UserTile.png

[2009.01.15 18:16:05 | 000,016,896 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008.12.13 12:37:56 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini

[2008.12.06 10:04:44 | 000,121,213 | ---- | C] () -- C:\ProgramData\nvModes.001

[2008.12.05 20:29:39 | 000,121,213 | ---- | C] () -- C:\ProgramData\nvModes.dat

[2008.10.09 08:41:14 | 000,000,024 | ---- | C] () -- C:\Windows\System32\ChkMail.ini

[2008.10.09 08:40:56 | 000,045,056 | ---- | C] () -- C:\Windows\System32\acovcnt.exe

[2008.10.09 08:30:30 | 000,047,672 | ---- | C] () -- C:\Windows\AsScrProlog.exe

[2008.10.09 07:06:39 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2008.10.09 06:16:03 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat

[2008.07.02 03:28:38 | 000,061,440 | ---- | C] () -- C:\Program Files\Common Files\CPInstallAction.dll

[2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files\Common Files\banner.jpg

[2008.04.16 12:11:34 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2008.04.16 12:11:34 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2008.04.16 12:11:34 | 000,126,454 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2008.04.16 12:11:34 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2008.04.16 11:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini

[2007.04.16 11:24:16 | 000,023,752 | ---- | C] () -- C:\Windows\System32\providers.bin

[2007.03.06 07:39:19 | 000,049,152 | ---- | C] () -- C:\Windows\revdevdll.dll

[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 13:47:37 | 000,450,704 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 11:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 11:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2006.03.09 02:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2005.04.03 00:29:59 | 000,110,592 | R--- | C] () -- C:\Windows\System32\scardsyn.dll

[2001.11.14 21:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

[1998.05.06 05:09:59 | 000,069,632 | R--- | C] () -- C:\Windows\System32\ODMA32.dll

 
 ========== LOP Check ==========

 

[2009.03.13 14:49:29 | 000,000,000 | -HSD | M] -- C:\Users\ASUS x72v\AppData\Roaming\.#

[2010.12.23 23:58:49 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\FreeAudioPack

[2011.01.18 21:02:01 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\GOA

[2009.02.07 15:04:06 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\PeerNetworking

[2011.05.07 09:51:25 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\ScummVM

[2012.01.02 22:38:39 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Ubisoft

[2012.01.05 10:24:00 | 000,032,634 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2009.03.13 14:49:29 | 000,000,000 | -HSD | M] -- C:\Users\ASUS x72v\AppData\Roaming\.#

[2011.07.01 14:47:42 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Adobe

[2011.12.22 15:30:32 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Avira

[2009.06.04 17:16:05 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\CyberLink

[2010.07.13 23:06:28 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\DivX

[2009.10.02 11:23:34 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\dvdcss

[2010.12.23 23:58:49 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\FreeAudioPack

[2011.01.18 21:02:01 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\GOA

[2008.12.05 20:29:12 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Identities

[2008.12.05 20:29:36 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Macromedia

[2012.01.05 15:38:58 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Malwarebytes

[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Media Center Programs

[2012.01.03 22:04:16 | 000,000,000 | --SD | M] -- C:\Users\ASUS x72v\AppData\Roaming\Microsoft

[2009.04.11 14:31:53 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Mozilla

[2009.02.07 15:04:06 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\PeerNetworking

[2011.05.07 09:51:25 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\ScummVM

[2009.04.13 16:57:49 | 000,000,000 | RH-D | M] -- C:\Users\ASUS x72v\AppData\Roaming\SecuROM

[2009.11.12 18:56:19 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Skype

[2008.12.05 20:29:50 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Symantec

[2012.01.02 22:38:39 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Ubisoft

[2009.05.10 03:08:31 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\vlc

[2011.12.22 16:42:36 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Winamp

[2009.06.17 14:38:33 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\WinRAR

 
 < %APPDATA%\*.exe /s >

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2008.02.22 05:59:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=76D70915EB81608DC6ACA87887FAB38F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22120_none_ddac250d3ab7a648\atapi.sys

[2008.02.22 06:03:50 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=92210921EEFC081693F649C3631DEEC2 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_3d9c5057\atapi.sys

[2008.02.22 06:03:50 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=92210921EEFC081693F649C3631DEEC2 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18023_none_dd25892021975283\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2008.05.07 10:40:01 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\drivers\iaStor.sys

[2008.05.07 10:40:01 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_1ab0331f\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2012.01.03 20:41:53 | 000,353,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtmsft.dll

[2012.01.03 20:41:53 | 000,223,232 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtrans.dll

 
 <           >

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 24 bytes -> C:\Windows:8B2BC208D720ED33
 

< End of report >

cosinus

05.01.2012 23:00

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2011.10.10 14:54:08 | 002,290,144 | R--- | M] () - E:\Autorun.exe -- [ CDFS ]

O32 - AutoRun File - [2011.10.09 15:23:34 | 000,000,047 | R--- | M] () - E:\Autorun.inf -- [ CDFS ]

O32 - AutoRun File - [2011.10.09 15:23:34 | 000,224,630 | R--- | M] () - E:\autorun.ico -- [ CDFS ]

O33 - MountPoints2\{25fe0021-95d3-11dd-9e8e-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{25fe0021-95d3-11dd-9e8e-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Autorun.exe -- [2011.10.10 14:54:08 | 002,290,144 | R--- | M] ()

[2009.08.13 16:26:02 | 000,000,095 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\yqkcuogy.bat

[2009.03.13 14:49:29 | 000,000,000 | -HSD | M] -- C:\Users\ASUS x72v\AppData\Roaming\.#

@Alternate Data Stream - 24 bytes -> C:\Windows:8B2BC208D720ED33

:Commands

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

nightingale7

05.01.2012 23:20

Ausgeführt. Nach automatischem Neustart hier das Log:

Code:

All processes killed

========== OTL ==========

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\autoexec.bat moved successfully.

File move failed. E:\Autorun.exe scheduled to be moved on reboot.

File move failed. E:\Autorun.inf scheduled to be moved on reboot.

File move failed. E:\autorun.ico scheduled to be moved on reboot.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{25fe0021-95d3-11dd-9e8e-806e6f6e6963}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25fe0021-95d3-11dd-9e8e-806e6f6e6963}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{25fe0021-95d3-11dd-9e8e-806e6f6e6963}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25fe0021-95d3-11dd-9e8e-806e6f6e6963}\ not found.

File move failed. E:\Autorun.exe scheduled to be moved on reboot.

C:\Users\ASUS x72v\AppData\Local\yqkcuogy.bat moved successfully.

C:\Users\ASUS x72v\AppData\Roaming\.# folder moved successfully.

ADS C:\Windows:8B2BC208D720ED33 deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: ASUS x72v

->Temp folder emptied: 217911 bytes

->Temporary Internet Files folder emptied: 1147412 bytes

->Java cache emptied: 48254063 bytes

->FireFox cache emptied: 31836739 bytes

->Google Chrome cache emptied: 92428620 bytes

->Flash cache emptied: 492 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56468 bytes

 

User: Default User

 

User: Nebelkrähe

->Temp folder emptied: 41650 bytes

->Temporary Internet Files folder emptied: 1685295 bytes

->Java cache emptied: 28349535 bytes

->FireFox cache emptied: 503804907 bytes

->Google Chrome cache emptied: 0 bytes

->Flash cache emptied: 57496 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 25293727 bytes

RecycleBin emptied: 94276 bytes

 

Total Files Cleaned = 699,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.31.0 log created on 01052012_231118
 

Files\Folders moved on Reboot...

File move failed. E:\Autorun.exe scheduled to be moved on reboot.

File move failed. E:\Autorun.inf scheduled to be moved on reboot.

File move failed. E:\autorun.ico scheduled to be moved on reboot.
 

Registry entries deleted on Reboot...

cosinus

05.01.2012 23:26

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

nightingale7

05.01.2012 23:39

Jap, auch erledigt. (Unhide war nicht nötig.) Leider wieder ein Fund.

TDSS-Log:

Code:

23:33:42.0626 1364        TDSS rootkit removing tool 2.6.25.0 Dec 23 2011 14:51:16

23:33:42.0813 1364        ============================================================

23:33:42.0813 1364        Current date / time: 2012/01/05 23:33:42.0813

23:33:42.0813 1364        SystemInfo:

23:33:42.0813 1364        

23:33:42.0813 1364        OS Version: 6.0.6002 ServicePack: 2.0

23:33:42.0813 1364        Product type: Workstation

23:33:42.0813 1364        ComputerName: ASUSX72V-PC

23:33:42.0813 1364        UserName: ASUS x72v

23:33:42.0813 1364        Windows directory: C:\Windows

23:33:42.0813 1364        System windows directory: C:\Windows

23:33:42.0813 1364        Processor architecture: Intel x86

23:33:42.0813 1364        Number of processors: 2

23:33:42.0813 1364        Page size: 0x1000

23:33:42.0813 1364        Boot type: Normal boot

23:33:42.0813 1364        ============================================================

23:33:43.0530 1364        Initialize success

23:34:15.0042 5576        ============================================================

23:34:15.0042 5576        Scan started

23:34:15.0042 5576        Mode: Manual; SigCheck; TDLFS; 

23:34:15.0042 5576        ============================================================

23:34:15.0386 5576        61883           (585e64bb6dfbc0a2f1f0b554ded012df) C:\Windows\system32\DRIVERS\61883.sys

23:34:15.0651 5576        61883 - ok

23:34:15.0760 5576        ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

23:34:15.0822 5576        ACPI - ok

23:34:15.0885 5576        adp94xx         (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys

23:34:15.0916 5576        adp94xx - ok

23:34:15.0947 5576        adpahci         (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys

23:34:15.0963 5576        adpahci - ok

23:34:15.0978 5576        adpu160m        (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys

23:34:15.0994 5576        adpu160m - ok

23:34:16.0025 5576        adpu320         (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys

23:34:16.0041 5576        adpu320 - ok

23:34:16.0181 5576        AFD             (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys

23:34:16.0228 5576        AFD - ok

23:34:16.0337 5576        AgereSoftModem  (1cfeba39fc613e45b49d3eddfbcda289) C:\Windows\system32\DRIVERS\AGRSM.sys

23:34:16.0509 5576        AgereSoftModem - ok

23:34:16.0618 5576        agp440          (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys

23:34:16.0634 5576        agp440 - ok

23:34:16.0665 5576        aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

23:34:16.0680 5576        aic78xx - ok

23:34:16.0712 5576        aliide          (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys

23:34:16.0727 5576        aliide - ok

23:34:16.0758 5576        amdagp          (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys

23:34:16.0774 5576        amdagp - ok

23:34:16.0790 5576        amdide          (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys

23:34:16.0805 5576        amdide - ok

23:34:16.0821 5576        AmdK7           (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys

23:34:16.0868 5576        AmdK7 - ok

23:34:16.0899 5576        AmdK8           (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys

23:34:16.0930 5576        AmdK8 - ok

23:34:17.0055 5576        arc             (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys

23:34:17.0070 5576        arc - ok

23:34:17.0102 5576        arcsas          (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys

23:34:17.0117 5576        arcsas - ok

23:34:17.0211 5576        ASMMAP          (7b4d08d2017ac06689d422e06c43f0aa) C:\Program Files\ATKGFNEX\ASMMAP.sys

23:34:17.0258 5576        ASMMAP - ok

23:34:17.0336 5576        AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

23:34:17.0398 5576        AsyncMac - ok

23:34:17.0476 5576        atapi           (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys

23:34:17.0492 5576        atapi - ok

23:34:17.0554 5576        atksgt          (f0d933b42cd0594048e4d5200ae9e417) C:\Windows\system32\DRIVERS\atksgt.sys

23:34:17.0585 5576        atksgt - ok

23:34:17.0648 5576        ATSWPDRV        (f70d2392158cb68e775f8c4cd3d12fbb) C:\Windows\system32\DRIVERS\ATSwpDrv.sys

23:34:17.0663 5576        ATSWPDRV - ok

23:34:17.0726 5576        Avc             (f4b56425a00beb32f5fa6603ff7b0ea2) C:\Windows\system32\DRIVERS\avc.sys

23:34:17.0772 5576        Avc - ok

23:34:17.0788 5576        avgntflt        (7713e4eb0276702faa08e52a6e23f2a6) C:\Windows\system32\DRIVERS\avgntflt.sys

23:34:17.0804 5576        avgntflt - ok

23:34:17.0866 5576        avipbb          (475fbb85956534720858ae72010c0a43) C:\Windows\system32\DRIVERS\avipbb.sys

23:34:17.0866 5576        avipbb - ok

23:34:17.0897 5576        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\Windows\system32\DRIVERS\avkmgr.sys

23:34:17.0913 5576        avkmgr - ok

23:34:17.0960 5576        Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

23:34:18.0022 5576        Beep - ok

23:34:18.0100 5576        blbdrive        (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys

23:34:18.0131 5576        blbdrive - ok

23:34:18.0209 5576        bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys

23:34:18.0256 5576        bowser - ok

23:34:18.0334 5576        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

23:34:18.0412 5576        BrFiltLo - ok

23:34:18.0459 5576        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

23:34:18.0490 5576        BrFiltUp - ok

23:34:18.0552 5576        Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

23:34:18.0724 5576        Brserid - ok

23:34:18.0802 5576        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

23:34:18.0880 5576        BrSerWdm - ok

23:34:18.0896 5576        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

23:34:18.0958 5576        BrUsbMdm - ok

23:34:18.0989 5576        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

23:34:19.0052 5576        BrUsbSer - ok

23:34:19.0176 5576        BthEnum         (6d39c954799b63ba866910234cf7d726) C:\Windows\system32\DRIVERS\BthEnum.sys

23:34:19.0223 5576        BthEnum - ok

23:34:19.0286 5576        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

23:34:19.0348 5576        BTHMODEM - ok

23:34:19.0364 5576        BthPan          (5904efa25f829bf84ea6fb045134a1d8) C:\Windows\system32\DRIVERS\bthpan.sys

23:34:19.0426 5576        BthPan - ok

23:34:19.0488 5576        BTHPORT         (611ff3f2f095c8d4a6d4cfd9dcc09793) C:\Windows\system32\Drivers\BTHport.sys

23:34:19.0613 5576        BTHPORT - ok

23:34:19.0738 5576        BTHUSB          (d330803eab2a15caec7f011f1d4cb30e) C:\Windows\system32\Drivers\BTHUSB.sys

23:34:19.0754 5576        BTHUSB - ok

23:34:19.0785 5576        btwaudio        (f2f7342742180d5060285499dee50f99) C:\Windows\system32\drivers\btwaudio.sys

23:34:19.0800 5576        btwaudio - ok

23:34:19.0847 5576        btwavdt         (32f59f26a30cfc508da11db3ea0f8b77) C:\Windows\system32\drivers\btwavdt.sys

23:34:19.0863 5576        btwavdt - ok

23:34:19.0910 5576        btwl2cap        (ecb98391c756a7b9cfbae89d9d1235e1) C:\Windows\system32\DRIVERS\btwl2cap.sys

23:34:19.0925 5576        btwl2cap - ok

23:34:19.0941 5576        btwrchid        (03658734ef7d0f3b3f4636d3e8a38964) C:\Windows\system32\DRIVERS\btwrchid.sys

23:34:19.0956 5576        btwrchid - ok

23:34:19.0988 5576        cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

23:34:20.0034 5576        cdfs - ok

23:34:20.0112 5576        cdrom           (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

23:34:20.0144 5576        cdrom - ok

23:34:20.0190 5576        circlass        (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys

23:34:20.0222 5576        circlass - ok

23:34:20.0284 5576        CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

23:34:20.0315 5576        CLFS - ok

23:34:20.0471 5576        CmBatt          (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys

23:34:20.0502 5576        CmBatt - ok

23:34:20.0549 5576        cmdide          (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys

23:34:20.0565 5576        cmdide - ok

23:34:20.0580 5576        Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys

23:34:20.0580 5576        Compbatt - ok

23:34:20.0596 5576        crcdisk         (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys

23:34:20.0612 5576        crcdisk - ok

23:34:20.0627 5576        Crusoe          (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys

23:34:20.0674 5576        Crusoe - ok

23:34:20.0768 5576        DCamUSBET       (699ce24fe6b5120af709a0b91582a02d) C:\Windows\system32\DRIVERS\etDevice.sys

23:34:20.0830 5576        DCamUSBET - ok

23:34:20.0908 5576        DfsC            (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys

23:34:20.0955 5576        DfsC - ok

23:34:21.0111 5576        disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

23:34:21.0126 5576        disk - ok

23:34:21.0189 5576        drmkaud         (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

23:34:21.0220 5576        drmkaud - ok

23:34:21.0360 5576        DXGKrnl         (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys

23:34:21.0423 5576        DXGKrnl - ok

23:34:21.0516 5576        E1G60           (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys

23:34:21.0563 5576        E1G60 - ok

23:34:21.0672 5576        Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

23:34:21.0688 5576        Ecache - ok

23:34:21.0750 5576        elxstor         (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys

23:34:21.0766 5576        elxstor - ok

23:34:21.0797 5576        ErrDev          (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys

23:34:21.0844 5576        ErrDev - ok

23:34:21.0891 5576        exfat           (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

23:34:21.0969 5576        exfat - ok

23:34:22.0094 5576        fastfat         (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

23:34:22.0125 5576        fastfat - ok

23:34:22.0172 5576        fdc             (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys

23:34:22.0203 5576        fdc - ok

23:34:22.0296 5576        FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

23:34:22.0312 5576        FileInfo - ok

23:34:22.0343 5576        Filetrace       (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

23:34:22.0374 5576        Filetrace - ok

23:34:22.0468 5576        FiltUSBET       (fd7cb14845a7f91be11f80635b2cd8a6) C:\Windows\system32\DRIVERS\etFilter.sys

23:34:22.0499 5576        FiltUSBET - ok

23:34:22.0515 5576        flpydisk        (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys

23:34:22.0546 5576        flpydisk - ok

23:34:22.0764 5576        FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

23:34:22.0796 5576        FltMgr - ok

23:34:22.0967 5576        Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

23:34:22.0998 5576        Fs_Rec - ok

23:34:23.0030 5576        gagp30kx        (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys

23:34:23.0045 5576        gagp30kx - ok

23:34:23.0139 5576        ghaio           (31b40f40e09513addc460f6a297ad474) C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys

23:34:23.0154 5576        ghaio - ok

23:34:23.0295 5576        HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys

23:34:23.0357 5576        HdAudAddService - ok

23:34:23.0451 5576        HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

23:34:23.0498 5576        HDAudBus - ok

23:34:23.0529 5576        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

23:34:23.0576 5576        HidBth - ok

23:34:23.0591 5576        HidIr           (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys

23:34:23.0607 5576        HidIr - ok

23:34:23.0654 5576        HidUsb          (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

23:34:23.0685 5576        HidUsb - ok

23:34:23.0716 5576        HpCISSs         (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys

23:34:23.0732 5576        HpCISSs - ok

23:34:23.0794 5576        HTTP            (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys

23:34:23.0888 5576        HTTP - ok

23:34:23.0934 5576        i2omp           (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys

23:34:23.0950 5576        i2omp - ok

23:34:23.0981 5576        i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

23:34:24.0028 5576        i8042prt - ok

23:34:24.0059 5576        iaStor          (80c633722da72e97f3f5b3b11325696d) C:\Windows\system32\DRIVERS\iaStor.sys

23:34:24.0075 5576        iaStor - ok

23:34:24.0090 5576        iaStorV         (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys

23:34:24.0106 5576        iaStorV - ok

23:34:24.0137 5576        iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

23:34:24.0153 5576        iirsp - ok

23:34:24.0246 5576        IntcAzAudAddService (58072f5fd95ece78f9fa7bda1210a9e7) C:\Windows\system32\drivers\RTKVHDA.sys

23:34:24.0418 5576        IntcAzAudAddService - ok

23:34:24.0527 5576        intelide        (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys

23:34:24.0543 5576        intelide - ok

23:34:24.0574 5576        intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys

23:34:24.0621 5576        intelppm - ok

23:34:24.0714 5576        IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

23:34:24.0746 5576        IpFilterDriver - ok

23:34:24.0746 5576        IpInIp - ok

23:34:24.0777 5576        IPMIDRV         (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys

23:34:24.0824 5576        IPMIDRV - ok

23:34:24.0886 5576        IPNAT           (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

23:34:24.0933 5576        IPNAT - ok

23:34:24.0964 5576        IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

23:34:24.0995 5576        IRENUM - ok

23:34:25.0011 5576        isapnp          (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys

23:34:25.0026 5576        isapnp - ok

23:34:25.0089 5576        iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

23:34:25.0104 5576        iScsiPrt - ok

23:34:25.0136 5576        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

23:34:25.0136 5576        iteatapi - ok

23:34:25.0182 5576        itecir          (8bcd857c7932ad005d5f9c89329da2e1) C:\Windows\system32\DRIVERS\itecir.sys

23:34:25.0214 5576        itecir - ok

23:34:25.0245 5576        iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

23:34:25.0260 5576        iteraid - ok

23:34:25.0276 5576        kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

23:34:25.0292 5576        kbdclass - ok

23:34:25.0338 5576        kbdhid          (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys

23:34:25.0385 5576        kbdhid - ok

23:34:25.0401 5576        kbfiltr         (27bd4ac228ef6c0d490617c32e86a672) C:\Windows\system32\DRIVERS\kbfiltr.sys

23:34:25.0416 5576        kbfiltr - ok

23:34:25.0448 5576        KSecDD          (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys

23:34:25.0479 5576        KSecDD - ok

23:34:25.0541 5576        lacqsasj - ok

23:34:25.0588 5576        lirsgt          (f8a7212d0864ef5e9185fb95e6623f4d) C:\Windows\system32\DRIVERS\lirsgt.sys

23:34:25.0604 5576        lirsgt - ok

23:34:25.0650 5576        lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

23:34:25.0697 5576        lltdio - ok

23:34:25.0728 5576        LSI_FC          (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys

23:34:25.0744 5576        LSI_FC - ok

23:34:25.0760 5576        LSI_SAS         (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys

23:34:25.0775 5576        LSI_SAS - ok

23:34:25.0791 5576        LSI_SCSI        (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys

23:34:25.0822 5576        LSI_SCSI - ok

23:34:25.0838 5576        luafv           (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

23:34:25.0900 5576        luafv - ok

23:34:26.0009 5576        lullaby         (8039f480c192dd99fed4ebc71ffbf795) C:\Windows\system32\DRIVERS\lullaby.sys

23:34:26.0009 5576        lullaby - ok

23:34:26.0087 5576        MarvinBus       (a3e700d78eec390f1208098cdca5c6b6) C:\Windows\system32\DRIVERS\MarvinBus.sys

23:34:26.0087 5576        MarvinBus ( UnsignedFile.Multi.Generic ) - warning

23:34:26.0087 5576        MarvinBus - detected UnsignedFile.Multi.Generic (1)

23:34:26.0134 5576        megasas         (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys

23:34:26.0150 5576        megasas - ok

23:34:26.0212 5576        MegaSR          (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys

23:34:26.0243 5576        MegaSR - ok

23:34:26.0290 5576        Modem           (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

23:34:26.0337 5576        Modem - ok

23:34:26.0352 5576        MODEMCSA        (cbb59c41f19efea1a000793e08070a62) C:\Windows\system32\drivers\MODEMCSA.sys

23:34:26.0399 5576        MODEMCSA - ok

23:34:26.0430 5576        monitor         (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

23:34:26.0462 5576        monitor - ok

23:34:26.0477 5576        mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

23:34:26.0493 5576        mouclass - ok

23:34:26.0508 5576        mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

23:34:26.0555 5576        mouhid - ok

23:34:26.0571 5576        MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

23:34:26.0586 5576        MountMgr - ok

23:34:26.0664 5576        mpio            (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys

23:34:26.0680 5576        mpio - ok

23:34:26.0696 5576        mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

23:34:26.0727 5576        mpsdrv - ok

23:34:26.0742 5576        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

23:34:26.0758 5576        Mraid35x - ok

23:34:26.0820 5576        MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

23:34:26.0852 5576        MRxDAV - ok

23:34:26.0930 5576        mrxsmb          (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys

23:34:26.0976 5576        mrxsmb - ok

23:34:27.0023 5576        mrxsmb10        (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys

23:34:27.0054 5576        mrxsmb10 - ok

23:34:27.0086 5576        mrxsmb20        (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

23:34:27.0132 5576        mrxsmb20 - ok

23:34:27.0164 5576        msahci          (de77526bde93142bdc90cfa9f5cead36) C:\Windows\system32\drivers\msahci.sys

23:34:27.0179 5576        msahci - ok

23:34:27.0195 5576        msdsm           (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys

23:34:27.0210 5576        msdsm - ok

23:34:27.0257 5576        MSDV            (343291a4dfd7c923c3f71f550830ec1c) C:\Windows\system32\DRIVERS\msdv.sys

23:34:27.0304 5576        MSDV - ok

23:34:27.0382 5576        Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

23:34:27.0413 5576        Msfs - ok

23:34:27.0429 5576        msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

23:34:27.0444 5576        msisadrv - ok

23:34:27.0476 5576        MSKSSRV         (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

23:34:27.0507 5576        MSKSSRV - ok

23:34:27.0538 5576        MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

23:34:27.0554 5576        MSPCLOCK - ok

23:34:27.0569 5576        MSPQM           (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

23:34:27.0600 5576        MSPQM - ok

23:34:27.0663 5576        MsRPC           (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

23:34:27.0678 5576        MsRPC - ok

23:34:27.0725 5576        mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

23:34:27.0741 5576        mssmbios - ok

23:34:27.0756 5576        MSTEE           (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

23:34:27.0788 5576        MSTEE - ok

23:34:27.0881 5576        MTsensor        (97affa9d95ffe20eee6229bc6be166cf) C:\Windows\system32\DRIVERS\ATKACPI.sys

23:34:27.0912 5576        MTsensor - ok

23:34:27.0944 5576        Mup             (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

23:34:27.0959 5576        Mup - ok

23:34:28.0053 5576        NativeWifiP     (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

23:34:28.0100 5576        NativeWifiP - ok

23:34:28.0178 5576        NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

23:34:28.0209 5576        NDIS - ok

23:34:28.0256 5576        NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

23:34:28.0302 5576        NdisTapi - ok

23:34:28.0318 5576        Ndisuio         (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

23:34:28.0349 5576        Ndisuio - ok

23:34:28.0443 5576        NdisWan         (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

23:34:28.0474 5576        NdisWan - ok

23:34:28.0505 5576        NDProxy         (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

23:34:28.0552 5576        NDProxy - ok

23:34:28.0568 5576        NetBIOS         (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

23:34:28.0614 5576        NetBIOS - ok

23:34:28.0677 5576        netbt           (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

23:34:28.0708 5576        netbt - ok

23:34:28.0864 5576        NETw5v32        (f0c42e0cdce558d658fa53a222b4ccb1) C:\Windows\system32\DRIVERS\NETw5v32.sys

23:34:29.0628 5576        NETw5v32 - ok

23:34:29.0738 5576        nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

23:34:29.0769 5576        nfrd960 - ok

23:34:29.0831 5576        Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

23:34:29.0925 5576        Npfs - ok

23:34:30.0003 5576        nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

23:34:30.0034 5576        nsiproxy - ok

23:34:30.0128 5576        Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

23:34:30.0221 5576        Ntfs - ok

23:34:30.0299 5576        ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

23:34:30.0377 5576        ntrigdigi - ok

23:34:30.0393 5576        Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

23:34:30.0424 5576        Null - ok

23:34:30.0455 5576        NVHDA           (11be4b269549173cff542591e4be2c08) C:\Windows\system32\drivers\nvhda32v.sys

23:34:30.0471 5576        NVHDA - ok

23:34:30.0642 5576        nvlddmkm        (7db332f85ab7894c69dfb934eee23eb9) C:\Windows\system32\DRIVERS\nvlddmkm.sys

23:34:30.0939 5576        nvlddmkm - ok

23:34:31.0017 5576        nvraid          (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys

23:34:31.0032 5576        nvraid - ok

23:34:31.0048 5576        nvstor          (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys

23:34:31.0064 5576        nvstor - ok

23:34:31.0095 5576        nv_agp          (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys

23:34:31.0110 5576        nv_agp - ok

23:34:31.0126 5576        NwlnkFlt - ok

23:34:31.0126 5576        NwlnkFwd - ok

23:34:31.0220 5576        ohci1394        (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys

23:34:31.0235 5576        ohci1394 - ok

23:34:31.0282 5576        Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

23:34:31.0329 5576        Parport - ok

23:34:31.0391 5576        partmgr         (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

23:34:31.0407 5576        partmgr - ok

23:34:31.0422 5576        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

23:34:31.0485 5576        Parvdm - ok

23:34:31.0547 5576        pci             (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

23:34:31.0563 5576        pci - ok

23:34:31.0578 5576        pciide          (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys

23:34:31.0594 5576        pciide - ok

23:34:31.0625 5576        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

23:34:31.0641 5576        pcmcia - ok

23:34:31.0688 5576        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

23:34:31.0797 5576        PEAUTH - ok

23:34:31.0922 5576        PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

23:34:31.0968 5576        PptpMiniport - ok

23:34:31.0984 5576        Processor       (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys

23:34:32.0031 5576        Processor - ok

23:34:32.0093 5576        PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

23:34:32.0124 5576        PSched - ok

23:34:32.0202 5576        ql2300          (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys

23:34:32.0280 5576        ql2300 - ok

23:34:32.0343 5576        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

23:34:32.0358 5576        ql40xx - ok

23:34:32.0374 5576        QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

23:34:32.0421 5576        QWAVEdrv - ok

23:34:32.0468 5576        RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

23:34:32.0483 5576        RasAcd - ok

23:34:32.0514 5576        Rasl2tp         (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

23:34:32.0546 5576        Rasl2tp - ok

23:34:32.0624 5576        RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

23:34:32.0655 5576        RasPppoe - ok

23:34:32.0717 5576        RasSstp         (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

23:34:32.0733 5576        RasSstp - ok

23:34:32.0920 5576        rdbss           (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

23:34:32.0967 5576        rdbss - ok

23:34:33.0045 5576        RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

23:34:33.0076 5576        RDPCDD - ok

23:34:33.0107 5576        rdpdr           (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys

23:34:33.0138 5576        rdpdr - ok

23:34:33.0154 5576        RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

23:34:33.0185 5576        RDPENCDD - ok

23:34:33.0248 5576        RDPWD           (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys

23:34:33.0294 5576        RDPWD - ok

23:34:33.0357 5576        RFCOMM          (6482707f9f4da0ecbab43b2e0398a101) C:\Windows\system32\DRIVERS\rfcomm.sys

23:34:33.0388 5576        RFCOMM - ok

23:34:33.0450 5576        rimmptsk        (a5b12a4b3b774432db9b9fa221190e59) C:\Windows\system32\DRIVERS\rimmptsk.sys

23:34:33.0513 5576        rimmptsk - ok

23:34:33.0528 5576        rimsptsk        (c398bca91216755b098679a8da8a2300) C:\Windows\system32\DRIVERS\rimsptsk.sys

23:34:33.0606 5576        rimsptsk - ok

23:34:33.0622 5576        rismxdp         (2a2554cb24506e0a0508fc395c4a1b42) C:\Windows\system32\DRIVERS\rixdptsk.sys

23:34:33.0669 5576        rismxdp - ok

23:34:33.0700 5576        rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

23:34:33.0747 5576        rspndr - ok

23:34:33.0825 5576        RTL8169         (2fc33077f85d7dc0d03678c06d43898c) C:\Windows\system32\DRIVERS\Rtlh86.sys

23:34:33.0887 5576        RTL8169 - ok

23:34:33.0918 5576        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

23:34:33.0934 5576        sbp2port - ok

23:34:33.0981 5576        ScanUSBET       (2393ed056ae02f5dbb3a7d6e40a5fdc2) C:\Windows\system32\DRIVERS\etScan.sys

23:34:33.0996 5576        ScanUSBET - ok

23:34:34.0059 5576        sdbus           (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys

23:34:34.0090 5576        sdbus - ok

23:34:34.0137 5576        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

23:34:34.0184 5576        secdrv - ok

23:34:34.0215 5576        Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys

23:34:34.0262 5576        Serenum - ok

23:34:34.0277 5576        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys

23:34:34.0340 5576        Serial - ok

23:34:34.0418 5576        sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

23:34:34.0464 5576        sermouse - ok

23:34:34.0480 5576        sffdisk         (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys

23:34:34.0511 5576        sffdisk - ok

23:34:34.0527 5576        sffp_mmc        (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys

23:34:34.0574 5576        sffp_mmc - ok

23:34:34.0683 5576        sffp_sd         (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys

23:34:34.0714 5576        sffp_sd - ok

23:34:34.0730 5576        sfloppy         (c33bfbd6e9e41fcd9ffef9729e9faed6) C:\Windows\system32\DRIVERS\sfloppy.sys

23:34:34.0761 5576        sfloppy - ok

23:34:34.0792 5576        sisagp          (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys

23:34:34.0808 5576        sisagp - ok

23:34:34.0808 5576        SiSRaid2        (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys

23:34:34.0823 5576        SiSRaid2 - ok

23:34:34.0854 5576        SiSRaid4        (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys

23:34:34.0870 5576        SiSRaid4 - ok

23:34:34.0932 5576        Smb             (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys

23:34:34.0979 5576        Smb - ok

23:34:35.0042 5576        smserial        (c8a58fc905c9184fa70e37f71060c64d) C:\Windows\system32\DRIVERS\smserial.sys

23:34:35.0166 5576        smserial - ok

23:34:35.0244 5576        spldr           (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

23:34:35.0260 5576        spldr - ok

23:34:35.0354 5576        srv             (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys

23:34:35.0416 5576        srv - ok

23:34:35.0510 5576        srv2            (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys

23:34:35.0556 5576        srv2 - ok

23:34:35.0572 5576        srvnet          (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys

23:34:35.0619 5576        srvnet - ok

23:34:35.0650 5576        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys

23:34:35.0666 5576        ssmdrv - ok

23:34:35.0744 5576        swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

23:34:35.0759 5576        swenum - ok

23:34:35.0775 5576        Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

23:34:35.0790 5576        Symc8xx - ok

23:34:35.0806 5576        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

23:34:35.0822 5576        Sym_hi - ok

23:34:35.0837 5576        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

23:34:35.0853 5576        Sym_u3 - ok

23:34:35.0900 5576        SynTP           (be78198c69135ef1fa157e08fd5c90ff) C:\Windows\system32\DRIVERS\SynTP.sys

23:34:35.0931 5576        SynTP - ok

23:34:35.0993 5576        Tcpip           (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys

23:34:36.0056 5576        Tcpip - ok

23:34:36.0165 5576        Tcpip6          (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys

23:34:36.0212 5576        Tcpip6 - ok

23:34:36.0336 5576        tcpipreg        (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys

23:34:36.0383 5576        tcpipreg - ok

23:34:36.0430 5576        TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

23:34:36.0461 5576        TDPIPE - ok

23:34:36.0492 5576        TDTCP           (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

23:34:36.0539 5576        TDTCP - ok

23:34:36.0664 5576        tdx             (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

23:34:36.0695 5576        tdx - ok

23:34:36.0758 5576        TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

23:34:36.0773 5576        TermDD - ok

23:34:36.0836 5576        tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

23:34:36.0867 5576        tssecsrv - ok

23:34:36.0914 5576        tunmp           (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

23:34:36.0945 5576        tunmp - ok

23:34:37.0007 5576        tunnel          (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys

23:34:37.0038 5576        tunnel - ok

23:34:37.0070 5576        uagp35          (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys

23:34:37.0085 5576        uagp35 - ok

23:34:37.0163 5576        udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

23:34:37.0179 5576        udfs - ok

23:34:37.0210 5576        uliagpkx        (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys

23:34:37.0226 5576        uliagpkx - ok

23:34:37.0257 5576        uliahci         (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys

23:34:37.0272 5576        uliahci - ok

23:34:37.0288 5576        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

23:34:37.0304 5576        UlSata - ok

23:34:37.0335 5576        ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

23:34:37.0350 5576        ulsata2 - ok

23:34:37.0366 5576        umbus           (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

23:34:37.0397 5576        umbus - ok

23:34:37.0460 5576        usbccgp         (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

23:34:37.0506 5576        usbccgp - ok

23:34:37.0538 5576        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

23:34:37.0600 5576        usbcir - ok

23:34:37.0662 5576        usbehci         (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

23:34:37.0694 5576        usbehci - ok

23:34:37.0756 5576        usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

23:34:37.0787 5576        usbhub - ok

23:34:37.0834 5576        usbohci         (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys

23:34:37.0896 5576        usbohci - ok

23:34:37.0928 5576        usbprint        (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys

23:34:37.0974 5576        usbprint - ok

23:34:38.0084 5576        usbscan         (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys

23:34:38.0130 5576        usbscan - ok

23:34:38.0208 5576        USBSTOR         (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

23:34:38.0240 5576        USBSTOR - ok

23:34:38.0318 5576        usbuhci         (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys

23:34:38.0364 5576        usbuhci - ok

23:34:38.0458 5576        usbvideo        (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys

23:34:38.0505 5576        usbvideo - ok

23:34:38.0505 5576        VClone - ok

23:34:38.0552 5576        vga             (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys

23:34:38.0598 5576        vga - ok

23:34:38.0614 5576        VgaSave         (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

23:34:38.0645 5576        VgaSave - ok

23:34:38.0661 5576        viaagp          (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys

23:34:38.0676 5576        viaagp - ok

23:34:38.0692 5576        ViaC7           (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys

23:34:38.0723 5576        ViaC7 - ok

23:34:38.0754 5576        viaide          (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys

23:34:38.0770 5576        viaide - ok

23:34:38.0786 5576        volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

23:34:38.0801 5576        volmgr - ok

23:34:38.0864 5576        volmgrx         (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

23:34:38.0895 5576        volmgrx - ok

23:34:38.0957 5576        volsnap         (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

23:34:38.0973 5576        volsnap - ok

23:34:39.0020 5576        vsmraid         (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys

23:34:39.0035 5576        vsmraid - ok

23:34:39.0066 5576        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

23:34:39.0129 5576        WacomPen - ok

23:34:39.0160 5576        Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

23:34:39.0191 5576        Wanarp - ok

23:34:39.0207 5576        Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

23:34:39.0222 5576        Wanarpv6 - ok

23:34:39.0254 5576        Wd              (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys

23:34:39.0269 5576        Wd - ok

23:34:39.0300 5576        Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys

23:34:39.0332 5576        Wdf01000 - ok

23:34:39.0425 5576        WmiAcpi         (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys

23:34:39.0441 5576        WmiAcpi - ok

23:34:39.0519 5576        WpdUsb          (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys

23:34:39.0550 5576        WpdUsb - ok

23:34:39.0581 5576        ws2ifsl         (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

23:34:39.0628 5576        ws2ifsl - ok

23:34:39.0722 5576        WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

23:34:39.0753 5576        WUDFRd - ok

23:34:39.0800 5576        yukonwlh        (7d1f3b131d503ef43ee594b5a2b9b427) C:\Windows\system32\DRIVERS\yk60x86.sys

23:34:39.0862 5576        yukonwlh - ok

23:34:39.0956 5576        {49DE1C67-83F8-4102-99E0-C16DCC7EEC796} (4d840c6af3c020ed3a35efba9025cf4a) C:\Program Files\ASUS\AI TouchMedia\PlayMovie\000.fcl

23:34:39.0971 5576        {49DE1C67-83F8-4102-99E0-C16DCC7EEC796} - ok

23:34:40.0002 5576        MBR (0x1B8)     (64b1e91c5c6c2157642651010728f90f) \Device\Harddisk0\DR0

23:34:40.0268 5576        \Device\Harddisk0\DR0 - ok

23:34:40.0268 5576        Boot (0x1200)   (af5b5ff1fccf185bb0ab9b9872d8d085) \Device\Harddisk0\DR0\Partition0

23:34:40.0268 5576        \Device\Harddisk0\DR0\Partition0 - ok

23:34:40.0268 5576        Boot (0x1200)   (de5536b84854f571089c49396b585191) \Device\Harddisk0\DR0\Partition1

23:34:40.0268 5576        \Device\Harddisk0\DR0\Partition1 - ok

23:34:40.0268 5576        ============================================================

23:34:40.0268 5576        Scan finished

23:34:40.0268 5576        ============================================================

23:34:40.0283 5292        Detected object count: 1

23:34:40.0283 5292        Actual detected object count: 1

23:35:16.0943 5292        MarvinBus ( UnsignedFile.Multi.Generic ) - skipped by user

23:35:16.0943 5292        MarvinBus ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus

06.01.2012 09:24

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

nightingale7

06.01.2012 10:14

Habe während der Ausführung von ComboFix von Windows die Fehlermeldung bekommen "Das Programm PEV.exe funktioniert nicht mehr". Weiß nicht, ob das von Bedeutung ist. Ansonsten gab es keine Probleme.

Hier das Log:

Code:

ComboFix 12-01-05.04 - ASUS x72v 06.01.2012   9:59.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3070.1686 [GMT 1:00]

ausgeführt von:: c:\users\ASUS x72v\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\ASUS x72v\AppData\Local\evmeufct.dat

c:\users\ASUS x72v\AppData\Local\evmeufct_nav.dat

c:\users\ASUS x72v\AppData\Local\evmeufct_navps.dat

c:\windows\IsUn0407.exe

c:\windows\system32\drivers\etc\hosts.ics

c:\windows\unin0407.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-12-06 bis 2012-01-06  ))))))))))))))))))))))))))))))

.

.

2012-01-06 09:07 . 2012-01-06 09:07        --------        d-----w-        c:\users\ASUS x72v\AppData\Local\temp

2012-01-06 08:34 . 2012-01-06 08:34        --------        d-----w-        c:\users\ASUS x72v\AppData\Local\DDMSettings

2012-01-05 22:11 . 2012-01-05 22:11        --------        d-----w-        C:\_OTL

2012-01-05 17:02 . 2012-01-05 17:02        --------        d-----w-        c:\program files\ESET

2012-01-05 14:38 . 2012-01-05 14:38        --------        d-----w-        c:\users\ASUS x72v\AppData\Roaming\Malwarebytes

2012-01-05 14:38 . 2012-01-05 14:38        --------        d-----w-        c:\programdata\Malwarebytes

2012-01-05 14:38 . 2012-01-05 14:38        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-01-05 14:38 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-01-04 20:30 . 2012-01-04 20:30        --------        d-----w-        c:\program files\7-Zip

2012-01-03 21:56 . 2012-01-03 21:56        --------        d-----w-        c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}

2012-01-03 21:47 . 2011-11-07 08:26        939368        ----a-w-        c:\windows\system32\flash.ocx

2012-01-03 21:46 . 2012-01-03 21:46        --------        d-----w-        c:\users\ASUS x72v\AppData\Local\PackageAware

2012-01-03 19:36 . 2011-11-21 10:47        6823496        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{64A2CD85-29B2-447A-84AD-0E78B6C3F578}\mpengine.dll

2012-01-02 21:48 . 2012-01-02 21:55        --------        d-----w-        c:\users\ASUS x72v\AppData\Local\Ubisoft Game Launcher

2012-01-02 21:47 . 2012-01-02 21:47        --------        d-----w-        c:\programdata\Solidshield

2012-01-02 21:37 . 2010-06-02 03:55        74072        ----a-w-        c:\windows\system32\XAPOFX1_5.dll

2012-01-02 21:37 . 2010-06-02 03:55        527192        ----a-w-        c:\windows\system32\XAudio2_7.dll

2012-01-02 21:37 . 2010-06-02 03:55        239960        ----a-w-        c:\windows\system32\xactengine3_7.dll

2012-01-02 21:37 . 2010-05-26 10:41        2106216        ----a-w-        c:\windows\system32\D3DCompiler_43.dll

2011-12-22 16:13 . 2011-10-27 08:01        3602816        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2011-12-22 16:13 . 2011-10-27 08:01        3550080        ----a-w-        c:\windows\system32\ntoskrnl.exe

2011-12-22 16:13 . 2011-07-29 16:01        293376        ----a-w-        c:\windows\system32\psisdecd.dll

2011-12-22 16:13 . 2011-07-29 16:01        217088        ----a-w-        c:\windows\system32\psisrndr.ax

2011-12-22 16:13 . 2011-07-29 16:00        57856        ----a-w-        c:\windows\system32\MSDvbNP.ax

2011-12-22 16:13 . 2011-07-29 16:00        69632        ----a-w-        c:\windows\system32\Mpeg2Data.ax

2011-12-22 16:12 . 2011-10-14 16:02        429056        ----a-w-        c:\windows\system32\EncDec.dll

2011-12-22 16:12 . 2011-09-20 21:02        905088        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2011-12-22 16:12 . 2011-11-23 13:37        2043904        ----a-w-        c:\windows\system32\win32k.sys

2011-12-22 16:12 . 2011-11-08 12:10        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

2011-12-22 16:12 . 2011-10-25 15:56        49152        ----a-w-        c:\windows\system32\csrsrv.dll

2011-12-22 16:12 . 2011-11-08 14:42        2048        ----a-w-        c:\windows\system32\tzres.dll

2011-12-22 16:12 . 2011-08-25 16:15        555520        ----a-w-        c:\windows\system32\UIAutomationCore.dll

2011-12-22 16:12 . 2011-08-25 16:14        563712        ----a-w-        c:\windows\system32\oleaut32.dll

2011-12-22 16:12 . 2011-08-25 16:14        238080        ----a-w-        c:\windows\system32\oleacc.dll

2011-12-22 16:12 . 2011-08-25 13:31        4096        ----a-w-        c:\windows\system32\oleaccrc.dll

2011-12-22 16:12 . 2011-09-30 15:57        707584        ----a-w-        c:\program files\Common Files\System\wab32.dll

2011-12-22 15:40 . 2011-12-22 15:40        --------        d-----w-        c:\program files\CCleaner

2011-12-22 14:30 . 2011-12-22 14:30        --------        d-----w-        c:\users\ASUS x72v\AppData\Roaming\Avira

2011-12-19 20:35 . 2011-12-19 20:35        --------        d-----w-        c:\users\Nebelkrähe\AppData\Roaming\Avira

2011-12-19 20:34 . 2012-01-01 20:25        --------        d-----w-        c:\users\Nebelkrähe\AppData\Local\Mozilla Firefox

2011-12-19 20:30 . 2011-12-19 20:30        --------        d-----w-        c:\programdata\Avira

2011-12-19 20:30 . 2011-12-09 11:40        74640        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2011-12-19 20:30 . 2011-12-09 11:40        36000        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2011-12-19 20:30 . 2011-12-09 11:40        134856        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2011-12-19 20:30 . 2011-12-19 20:30        --------        d-----w-        c:\program files\Avira

2011-12-19 20:17 . 2011-12-19 20:17        --------        d-----w-        c:\program files\Common Files\Java

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-01-05 22:14 . 2008-10-09 07:40        45056        ----a-w-        c:\windows\system32\acovcnt.exe

2011-11-16 18:55 . 2011-05-22 17:16        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2011-11-15 13:29 . 2009-10-02 23:31        222080        ------w-        c:\windows\system32\MpSigStub.exe

2011-11-10 04:54 . 2010-07-15 12:54        472808        ----a-w-        c:\windows\system32\deployJava1.dll

2011-10-20 23:26 . 2011-10-20 23:26        94208        ----a-w-        c:\windows\system32\dpl100.dll

2008-07-02 02:28 . 2008-07-02 02:28        61440        ----a-w-        c:\program files\Common Files\CPInstallAction.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-01-12 98304]

"ATKOSD2"="c:\program files\ASUS\ATKOSD2\ATKOSD2.exe" [2008-07-15 7651328]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-06-25 13543968]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-06-25 92704]

"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMedia.exe" [2008-06-25 159744]

"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2008-10-09 3054136]

"ASUS Camera ScreenSaver"="c:\windows\AsScrProlog.exe" [2008-10-09 47672]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-07-03 1328424]

"RtHDVCpl"="RtHDVCpl.exe" [2008-06-13 6183456]

"Skytel"="Skytel.exe" [2007-11-20 1826816]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-12-09 258512]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-4-10 752168]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs        REG_MULTI_SZ           BthServ

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-06-09 17:14        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Inhalt des "geplante Tasks" Ordners

.

2012-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-19 10:33]

.

2012-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-19 10:33]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.2.1

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

MSConfigStartUp-evmeufct - c:\users\asus x72v\appdata\local\evmeufct.exe

AddRemove-yqkcuogy - c:\users\asus x72v\appdata\local\yqkcuogy.bat

AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\bm_installer.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2012-01-06 10:07

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]

"ImagePath"="\??\c:\program files\ASUS\AI TouchMedia\PlayMovie\000.fcl"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-2809889056-3464315095-2278337278-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:84,67,d9,a2,ff,ae,6e,7b,1d,cc,9f,08,f3,cb,9d,a3,f6,7f,ca,f1,1c,6e,f5,

   44,24,9e,63,78,20,ad,48,db,de,52,70,e3,50,b2,bf,3c,42,3b,a4,b0,b8,26,e4,43,\

"??"=hex:53,8c,13,17,b3,99,a5,77,93,3c,37,94,03,d3,fc,e4

.

[HKEY_USERS\S-1-5-21-2809889056-3464315095-2278337278-1000\Software\SecuROM\License information*]

"datasecu"=hex:54,af,de,74,4a,75,1b,66,1d,e6,46,c7,33,69,9b,04,1c,6c,8b,4d,a7,

   0d,6e,b8,54,7b,c7,e3,d0,16,08,f4,d0,0d,93,f8,d8,a8,dc,48,d8,6a,44,24,43,ad,\

"rkeysecu"=hex:0c,24,0e,b0,dd,8a,99,17,cd,87,74,4f,08,6f,32,f0

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'Explorer.exe'(3732)

c:\windows\system32\btmmhook.dll

.

Zeit der Fertigstellung: 2012-01-06  10:09:13

ComboFix-quarantined-files.txt  2012-01-06 09:09

.

Vor Suchlauf: 8 Verzeichnis(se), 82.741.362.688 Bytes frei

Nach Suchlauf: 13 Verzeichnis(se), 82.011.377.664 Bytes frei

.

- - End Of File - - 9F8F695D8893A1C1860C74D3ABBF676E

cosinus

06.01.2012 14:40

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

nightingale7

06.01.2012 16:11

Gmer ist mir tatsächlich 2mal abgestürzt. Beim ersten Mal gab's nur ne Fehlermeldung, aber beim zweiten Mal hatte ich nen Bluescreen und anschließend nen automatischen Neustart. Hab dann also mit OSAM weitergemacht.

OSAM-Log:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 15:45:33 on 06.01.2012
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Unable to get information
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"ASMMAP" (ASMMAP) - ? - C:\Program Files\ATKGFNEX\ASMMAP.sys

"atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys

"catchme" (catchme) - ? - C:\Users\ASUSX7~1\AppData\Local\Temp\catchme.sys  (File not found)

"ghaio" (ghaio) - ? - C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys  (File found, but it contains no detailed information)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"lacqsasj" (lacqsasj) - ? - C:\Windows\system32\drivers\lacqsasj.sys  (File not found)

"lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)

"lullaby" (lullaby) - "Windows (R) Codename Longhorn DDK provider" - C:\Windows\System32\DRIVERS\lullaby.sys

"Pinnacle Marvin Bus" (MarvinBus) - "Pinnacle Systems GmbH" - C:\Windows\System32\DRIVERS\MarvinBus.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

"VClone" (VClone) - ? - C:\Windows\System32\DRIVERS\VClone.sys  (File not found)

"{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}" ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) - "Cyberlink Corp." - C:\Program Files\ASUS\AI TouchMedia\PlayMovie\000.fcl
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{10880D85-AAD9-4558-ABDC-2AB1552D831F} "LightScribe Control Panel" - "Hewlett-Packard Company" - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{79BC0345-1015-11D2-A299-006008312725} "///FAST project settings" - ? - C:\Program Files\Pinnacle\Studio 14\Programs\BlueShellExt.dll  (File found, but it contains no detailed information)

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_30.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

{C3F79A2B-B9B4-4A66-B012-3EE46475B072} "MessengerStatsClient Class" - "Microsoft Corporation" - C:\Windows\Downloaded Program Files\MessengerStatsPAClient.dll / hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

{5D6F45B3-9043-443D-A792-115447494D24} "UnoCtrl Class" - "Microsoft" - C:\Windows\Downloaded Program Files\GAME_UNO1.dll / hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

{326E768D-4182-46FD-9C16-1449A49795F4} "DivX Plus Web Player HTML5 <video>" - "DivX, LLC" - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID-Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\ASUS x72v\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"Bluetooth.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"LightScribe Control Panel" - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"ASUS Camera ScreenSaver" - ? - C:\Windows\AsScrProlog.exe  (File found, but it contains no detailed information)

"ASUS Screen Saver Protector" - "ASUS" - C:\Windows\AsScrPro.exe

"ATKMEDIA" - "ASUS" - C:\Program Files\ASUS\ATK Media\DMedia.exe

"ATKOSD2" - "ASUS" - C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe

"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"HControlUser" - ? - C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Adobe LM Service" (Adobe LM Service) - "Adobe Systems" - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

"ASLDR Service" (ASLDRService) - ? - C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe

"ATKGFNEX Service" (ATKGFNEXSrv) - ? - C:\Program Files\ATKGFNEX\GFNEXSrv.exe

"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"spmgr" (spmgr) - ? - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

aswMBR-Log:

Code:

aswMBR version 0.9.9.1156 Copyright(c) 2011 AVAST Software

Run date: 2012-01-06 15:51:40

-----------------------------

15:51:40.570    OS Version: Windows 6.0.6002 Service Pack 2

15:51:40.570    Number of processors: 2 586 0x1706

15:51:40.570    ComputerName: ASUSX72V-PC  UserName: ASUS x72v

15:52:17.417    Initialize success

15:53:13.542    AVAST engine defs: 12010600

15:53:34.306    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

15:53:34.306    Disk 0 Vendor: ST932032 0303 Size: 305245MB BusType: 3

15:53:34.321    Disk 0 MBR read successfully

15:53:34.321    Disk 0 MBR scan

15:53:34.352    Disk 0 unknown MBR code

15:53:34.352    Disk 0 Partition 1 00     1C Hidd FAT32 LBA MSDOS5.0    10001 MB offset 63

15:53:34.368    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS       152617 MB offset 20482875

15:53:34.368    Disk 0 Partition - 00     0F Extended LBA            142623 MB offset 333043515

15:53:34.399    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       142623 MB offset 333043578

15:53:34.415    Disk 0 scanning sectors +625137345

15:53:34.571    Disk 0 scanning C:\Windows\system32\drivers

15:53:54.617    Service scanning

15:53:56.021    Modules scanning

15:54:15.271    Disk 0 trace - called modules:

15:54:15.287    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys dxgkrnl.sys nvlddmkm.sys watchdog.sys ndis.sys NETw5v32.sys tcpip.sys NETIO.SYS 

15:54:15.287    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86aa5910]

15:54:15.302    3 CLASSPNP.SYS[8ada88b3] -> nt!IofCallDriver -> [0x84f86220]

15:54:15.302    5 acpi.sys[806986bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x85943028]

15:54:15.880    AVAST engine scan C:\Windows

15:54:22.104    AVAST engine scan C:\Windows\system32

15:59:00.954    AVAST engine scan C:\Windows\system32\drivers

15:59:33.277    AVAST engine scan C:\Users\ASUS x72v

16:01:30.558    AVAST engine scan C:\ProgramData

16:03:11.194    Scan finished successfully

16:07:30.929    Disk 0 MBR has been saved successfully to "C:\Users\ASUS x72v\Desktop\MBR.dat"

16:07:30.929    The log file has been saved successfully to "C:\Users\ASUS x72v\Desktop\aswMBR.txt"

cosinus

06.01.2012 18:54

Zitat:

"lacqsasj" (lacqsasj) - ? - C:\Windows\system32\drivers\lacqsasj.sys (File not found)

Bitte mit OSAM deaktivieren und löschen. Danach neues Log mit OSAM machen.

Im Anschluss den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.
Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

nightingale7

06.01.2012 20:21

Osam-Log nach Deaktivierung:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 19:40:13 on 06.01.2012
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Unable to get information
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"ASMMAP" (ASMMAP) - ? - C:\Program Files\ATKGFNEX\ASMMAP.sys

"atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys

"catchme" (catchme) - ? - C:\Users\ASUSX7~1\AppData\Local\Temp\catchme.sys  (File not found)

"ghaio" (ghaio) - ? - C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys  (File found, but it contains no detailed information)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)

"lullaby" (lullaby) - "Windows (R) Codename Longhorn DDK provider" - C:\Windows\System32\DRIVERS\lullaby.sys

"Pinnacle Marvin Bus" (MarvinBus) - "Pinnacle Systems GmbH" - C:\Windows\System32\DRIVERS\MarvinBus.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

"VClone" (VClone) - ? - C:\Windows\System32\DRIVERS\VClone.sys  (File not found)

"{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}" ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) - "Cyberlink Corp." - C:\Program Files\ASUS\AI TouchMedia\PlayMovie\000.fcl

(Disabled) "lacqsasj" (lacqsasj) - ? - C:\Windows\system32\drivers\lacqsasj.sys  (File not found)
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{10880D85-AAD9-4558-ABDC-2AB1552D831F} "LightScribe Control Panel" - "Hewlett-Packard Company" - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{79BC0345-1015-11D2-A299-006008312725} "///FAST project settings" - ? - C:\Program Files\Pinnacle\Studio 14\Programs\BlueShellExt.dll  (File found, but it contains no detailed information)

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_30.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

{C3F79A2B-B9B4-4A66-B012-3EE46475B072} "MessengerStatsClient Class" - "Microsoft Corporation" - C:\Windows\Downloaded Program Files\MessengerStatsPAClient.dll / hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

{5D6F45B3-9043-443D-A792-115447494D24} "UnoCtrl Class" - "Microsoft" - C:\Windows\Downloaded Program Files\GAME_UNO1.dll / hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

{326E768D-4182-46FD-9C16-1449A49795F4} "DivX Plus Web Player HTML5 <video>" - "DivX, LLC" - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID-Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\ASUS x72v\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"Bluetooth.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"LightScribe Control Panel" - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"ASUS Camera ScreenSaver" - ? - C:\Windows\AsScrProlog.exe  (File found, but it contains no detailed information)

"ASUS Screen Saver Protector" - "ASUS" - C:\Windows\AsScrPro.exe

"ATKMEDIA" - "ASUS" - C:\Program Files\ASUS\ATK Media\DMedia.exe

"ATKOSD2" - "ASUS" - C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe

"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"HControlUser" - ? - C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Adobe LM Service" (Adobe LM Service) - "Adobe Systems" - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

"ASLDR Service" (ASLDRService) - ? - C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe

"ATKGFNEX Service" (ATKGFNEXSrv) - ? - C:\Program Files\ATKGFNEX\GFNEXSrv.exe

"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"spmgr" (spmgr) - ? - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Osam-Log nach Löschung:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 19:49:07 on 06.01.2012
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Unable to get information
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"ASMMAP" (ASMMAP) - ? - C:\Program Files\ATKGFNEX\ASMMAP.sys

"atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys

"catchme" (catchme) - ? - C:\Users\ASUSX7~1\AppData\Local\Temp\catchme.sys  (File not found)

"ghaio" (ghaio) - ? - C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys  (File found, but it contains no detailed information)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)

"lullaby" (lullaby) - "Windows (R) Codename Longhorn DDK provider" - C:\Windows\System32\DRIVERS\lullaby.sys

"Pinnacle Marvin Bus" (MarvinBus) - "Pinnacle Systems GmbH" - C:\Windows\System32\DRIVERS\MarvinBus.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

"VClone" (VClone) - ? - C:\Windows\System32\DRIVERS\VClone.sys  (File not found)

"{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}" ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) - "Cyberlink Corp." - C:\Program Files\ASUS\AI TouchMedia\PlayMovie\000.fcl
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{10880D85-AAD9-4558-ABDC-2AB1552D831F} "LightScribe Control Panel" - "Hewlett-Packard Company" - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{79BC0345-1015-11D2-A299-006008312725} "///FAST project settings" - ? - C:\Program Files\Pinnacle\Studio 14\Programs\BlueShellExt.dll  (File found, but it contains no detailed information)

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_30.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

{C3F79A2B-B9B4-4A66-B012-3EE46475B072} "MessengerStatsClient Class" - "Microsoft Corporation" - C:\Windows\Downloaded Program Files\MessengerStatsPAClient.dll / hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

{5D6F45B3-9043-443D-A792-115447494D24} "UnoCtrl Class" - "Microsoft" - C:\Windows\Downloaded Program Files\GAME_UNO1.dll / hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

{326E768D-4182-46FD-9C16-1449A49795F4} "DivX Plus Web Player HTML5 <video>" - "DivX, LLC" - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID-Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\ASUS x72v\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"Bluetooth.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"LightScribe Control Panel" - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"ASUS Camera ScreenSaver" - ? - C:\Windows\AsScrProlog.exe  (File found, but it contains no detailed information)

"ASUS Screen Saver Protector" - "ASUS" - C:\Windows\AsScrPro.exe

"ATKMEDIA" - "ASUS" - C:\Program Files\ASUS\ATK Media\DMedia.exe

"ATKOSD2" - "ASUS" - C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe

"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"HControlUser" - ? - C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Adobe LM Service" (Adobe LM Service) - "Adobe Systems" - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

"ASLDR Service" (ASLDRService) - ? - C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe

"ATKGFNEX Service" (ATKGFNEXSrv) - ? - C:\Program Files\ATKGFNEX\GFNEXSrv.exe

"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"spmgr" (spmgr) - ? - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

aswMBR-Log des Fixes:

Code:

aswMBR version 0.9.9.1156 Copyright(c) 2011 AVAST Software

Run date: 2012-01-06 19:50:53

-----------------------------

19:50:53.370    OS Version: Windows 6.0.6002 Service Pack 2

19:50:53.370    Number of processors: 2 586 0x1706

19:50:53.370    ComputerName: ASUSX72V-PC  UserName: ASUS x72v

19:50:54.088    Initialize success

19:51:02.777    AVAST engine defs: 12010600

19:51:40.656    Verifying

19:51:50.671    Disk 0 Windows 600 MBR fixed successfully

19:53:54.753    Disk 0 MBR has been saved successfully to "C:\Users\ASUS x72v\Desktop\MBR.dat"

19:53:54.753    The log file has been saved successfully to "C:\Users\ASUS x72v\Desktop\aswMBR_fixed.txt"

aswMBR-Log des Scans nach Fix und Reboot:

Code:

aswMBR version 0.9.9.1156 Copyright(c) 2011 AVAST Software

Run date: 2012-01-06 19:59:25

-----------------------------

19:59:25.424    OS Version: Windows 6.0.6002 Service Pack 2

19:59:25.424    Number of processors: 2 586 0x1706

19:59:25.439    ComputerName: ASUSX72V-PC  UserName: ASUS x72v

19:59:26.157    Initialize success

19:59:36.079    AVAST engine defs: 12010600

19:59:50.119    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

19:59:50.119    Disk 0 Vendor: ST932032 0303 Size: 305245MB BusType: 3

19:59:50.134    Disk 0 MBR read successfully

19:59:50.134    Disk 0 MBR scan

19:59:50.150    Disk 0 Windows VISTA default MBR code

19:59:50.165    Disk 0 Partition 1 00     1C Hidd FAT32 LBA MSDOS5.0    10001 MB offset 63

19:59:50.181    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS       152617 MB offset 20482875

19:59:50.181    Disk 0 Partition - 00     0F Extended LBA            142623 MB offset 333043515

19:59:50.212    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       142623 MB offset 333043578

19:59:50.228    Disk 0 scanning sectors +625137345

19:59:50.337    Disk 0 scanning C:\Windows\system32\drivers

20:00:14.938    Service scanning

20:00:16.405    Modules scanning

20:00:29.665    Disk 0 trace - called modules:

20:00:29.711    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys 

20:00:29.727    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8699d8b0]

20:00:29.727    3 CLASSPNP.SYS[8adac8b3] -> nt!IofCallDriver -> [0x84f8fb98]

20:00:29.727    5 acpi.sys[8069f6bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x85965028]

20:00:30.476    AVAST engine scan C:\Windows

20:00:42.394    AVAST engine scan C:\Windows\system32

20:05:42.023    AVAST engine scan C:\Windows\system32\drivers

20:05:58.435    AVAST engine scan C:\Users\ASUS x72v

20:07:56.074    AVAST engine scan C:\ProgramData

20:09:38.707    Scan finished successfully

20:13:27.127    Disk 0 MBR has been saved successfully to "C:\Users\ASUS x72v\Desktop\MBR.dat"

20:13:27.127    The log file has been saved successfully to "C:\Users\ASUS x72v\Desktop\aswMBR_after_fix_and_reboot.txt"

Alles richtig soweit? Ich bin mir mit dem aswMBR-Fix nicht ganz sicher. Aus deiner Anweisung schien es nicht hervor zu gehen, aber hätte ich das Programm erst einen Scan machen lassen sollen, damit es überhaupt weiß, was es fixen soll? :confused:

cosinus

06.01.2012 20:27

Hast du gut gemacht :)

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

nightingale7

07.01.2012 22:33

Malwarebytes-Log:

Code:

Malwarebytes Anti-Malware 1.60.0.1800

www.malwarebytes.org
 

Datenbank Version: v2012.01.07.03
 

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

ASUS x72v :: ASUSX72V-PC [Administrator]
 

07.01.2012 17:33:51

mbam-log-2012-01-07 (17-33-51).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 315896

Laufzeit: 1 Stunde(n), 19 Minute(n), 20 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

SUPERAntiSpyware-Log:

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 01/07/2012 at 08:38 PM
 

Application Version : 5.0.1142
 

Core Rules Database Version : 8112

Trace Rules Database Version: 5924
 

Scan type       : Complete Scan

Total Scan Time : 01:29:39
 

Operating System Information

Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)

UAC On - Administrator
 

Memory items scanned      : 668

Memory threats detected   : 0

Registry items scanned    : 37474

Registry threats detected : 0

File items scanned        : 137221

File threats detected     : 93
 

Adware.Tracking Cookie

        .doubleclick.net [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .atdmt.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .atdmt.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adtech.de [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .ads.quartermedia.de [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .ads.quartermedia.de [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.zanox.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .zanox.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        track.effiliation.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        track.effiliation.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        track.effiliation.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        track.effiliation.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        track.effiliation.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        track.effiliation.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .divx.112.2o7.net [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .kontera.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .tribalfusion.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad2.adfarm1.adition.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .apmebf.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .mediaplex.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .statcounter.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .im.banner.t-online.de [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .mediaplex.com [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\ASUS X72V\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .atdmt.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        accounts.google.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        accounts.google.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        accounts.google.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .zanox-affiliate.de [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .tracking.mindshare.de [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        rts.pgmediaserve.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        rts.pgmediaserve.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        rts.pgmediaserve.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .content.yieldmanager.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .zanox.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        tracking.mlsat02.de [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        ad3.adfarm1.adition.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

        .statcounter.com [ C:\USERS\NEBELKRäHE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\COOKIES.SQLITE ]

ESET-Log:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=4b3ba71c57ac5a47b56969e5e5838058

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-01-07 09:20:40

# local_time=2012-01-07 10:20:40 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=1792 16777215 100 0 1642696 1642696 0 0

# compatibility_mode=5892 16776574 100 100 129233 163498447 0 0

# compatibility_mode=8192 67108863 100 0 186365 186365 0 0

# scanned=152795

# found=2

# cleaned=0

# scan_time=5520

D:\Install\Setup19_FreeConverter.exe        Win32/Adware.Toolbar.Dealio application (unable to clean)        00000000000000000000000000000000        I

D:\Install\SoftonicDownloader_fuer_scummvm.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

Uh, schätze, die beiden Sachen, die ESET noch gefunden hat, können gelöscht werden, oder? Bei den Funden von SUPERAntiSpyware hoff ich ja, dass das allermeiste nur falscher Alarm ist...?

cosinus

07.01.2012 23:37

Ja das kann weg. SASW hat nur Cookies gefunden. Das sind keine Schädlinge, aber können so gelöscht werden.

Rechner wieder im Lot?

nightingale7

08.01.2012 09:21

Ich hatte beim Start meines Benutzeraccounts nach dem manuellen Löschen der Funde von Antivir (also, bevor ich diesen Thread eröffnet hatte) immer 2 Fehlermeldungen. Seit du mir hier geholfen hast, habe ich mich nur noch in den Admin-Account eingeloggt. Eben war ich zum ersten Mal seit der ganzen Prozedur wieder in meinem eigenen Acc drin. Eine der Fehlermeldungen erscheint nicht mehr, aber die andere ist noch da:

Fehler beim Laden von
C:\Users\NEBELK~1\AppData\Local\Temp\wpbt0.dll
Das angegebene Modul wurde nicht gefunden.

Das hat doch sicher noch was mit der Kompromittierung des Systems zu tun? Und nachdem wir nun mehrmals die temporären Dateien sowie doch auch die Registry gesäubert haben, wie kann es sein, dass diese Fehlermeldung trotzdem noch kommt?

cosinus

08.01.2012 19:58

Das kommt weil zB bei OTL-Scans das Profil dienes anderen Benutzers nicht mitgescannt wurde. Mach mit diesem Benutzer nochmal ein neues OTL-Log

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

nightingale7

09.01.2012 19:33

Ah, das macht natürlich Sinn. :crazy:

Hier das neue OTL-Log:

Code:

OTL logfile created on: 09.01.2012 19:07:16 - Run 8

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Nebelkrähe\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,80 Gb Available Physical Memory | 59,92% Memory free

6,19 Gb Paging File | 5,05 Gb Available in Paging File | 81,50% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 149,04 Gb Total Space | 83,48 Gb Free Space | 56,01% Space Free | Partition Type: NTFS

Drive D: | 139,28 Gb Total Space | 26,93 Gb Free Space | 19,33% Space Free | Partition Type: NTFS

Drive E: | 4,61 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: ASUSX72V-PC | User Name: ASUS x72v | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.01.09 18:50:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Nebelkrähe\Desktop\OTL.exe

PRC - [2011.12.09 12:40:20 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.12.09 12:40:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2011.12.09 12:39:54 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.12.09 12:39:54 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.08.12 00:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe

PRC - [2011.07.29 00:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe

PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008.10.09 08:30:20 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe

PRC - [2008.07.15 19:29:00 | 007,651,328 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe

PRC - [2008.07.15 19:22:46 | 000,217,088 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControl.exe

PRC - [2008.07.10 01:09:26 | 000,191,032 | ---- | M] (ATK) -- C:\Program Files\P4G\BatteryLife.exe

PRC - [2008.06.25 03:01:08 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Media\DMedia.exe

PRC - [2008.06.24 04:16:24 | 002,482,176 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe

PRC - [2008.06.19 20:18:12 | 000,154,168 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ASUS CopyProtect\ASPG.exe

PRC - [2008.06.13 06:52:51 | 006,183,456 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2008.06.04 01:29:08 | 000,851,968 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe

PRC - [2008.04.10 19:32:18 | 000,752,168 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

PRC - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe

PRC - [2008.01.23 18:51:28 | 000,151,552 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\WDC.exe

PRC - [2008.01.12 06:40:10 | 000,098,304 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

PRC - [2007.11.05 03:48:06 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe

PRC - [2007.10.03 05:53:00 | 000,094,208 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe

PRC - [2007.08.15 19:20:16 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe

PRC - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe

PRC - [2007.08.03 20:24:54 | 000,125,496 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

PRC - [2007.07.06 00:53:44 | 001,040,384 | ---- | M] () -- C:\Program Files\Wireless Console 2\wcourier.exe

PRC - [2005.07.06 23:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.07.29 00:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll

MOD - [2011.07.29 00:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe

MOD - [2008.09.16 19:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll

MOD - [2008.04.10 19:25:54 | 000,126,976 | ---- | M] () -- C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll

MOD - [2008.01.12 06:40:10 | 000,098,304 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

MOD - [2007.11.12 23:41:50 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\MsgTran.dll

MOD - [2007.08.14 21:59:54 | 006,365,184 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtGui4.dll

MOD - [2007.07.12 21:55:52 | 000,131,072 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll

MOD - [2007.07.12 21:55:28 | 001,581,056 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtCore4.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.12.09 12:40:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.12.09 12:39:54 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.08.12 00:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)

SRV - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)

SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.10.03 05:53:00 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService)

SRV - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)

SRV - [2007.08.03 20:24:54 | 000,125,496 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.12.09 12:40:20 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.12.09 12:40:20 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.12.09 12:40:20 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2011.07.22 17:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)

DRV - [2011.07.12 22:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.12.26 17:30:57 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2009.12.26 17:30:57 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2009.05.28 21:41:28 | 004,233,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)

DRV - [2008.06.25 15:58:59 | 007,534,720 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2008.06.25 15:58:59 | 000,043,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)

DRV - [2008.06.03 07:41:51 | 000,015,928 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)

DRV - [2008.05.29 18:21:02 | 000,015,416 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\lullaby.sys -- (lullaby)

DRV - [2008.05.20 01:15:42 | 000,061,424 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Program Files\ASUS\AI TouchMedia\PlayMovie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})

DRV - [2008.05.02 06:59:39 | 000,122,368 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2008.03.21 05:12:59 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2008.02.16 01:42:42 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)

DRV - [2008.02.05 08:52:23 | 000,206,464 | ---- | M] (eMPIA Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etFilter.sys -- (FiltUSBET)

DRV - [2008.01.31 12:18:57 | 000,006,528 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etScan.sys -- (ScanUSBET)

DRV - [2007.12.19 01:12:12 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)

DRV - [2007.09.06 09:43:49 | 000,474,624 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etDevice.sys -- (DCamUSBET)

DRV - [2007.08.03 05:26:21 | 000,020,936 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)

DRV - [2007.07.30 19:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)

DRV - [2007.07.30 18:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)

DRV - [2007.07.24 19:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP)

DRV - [2007.06.17 05:29:08 | 000,146,824 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor)

DRV - [2006.12.14 08:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)

DRV - [2006.11.02 08:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)

DRV - [2005.09.23 21:18:32 | 000,171,520 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MarvinBus.sys -- (MarvinBus)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

IE - HKU\S-1-5-21-2809889056-3464315095-2278337278-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKU\S-1-5-21-2809889056-3464315095-2278337278-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKU\S-1-5-21-2809889056-3464315095-2278337278-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-21-2809889056-3464315095-2278337278-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com

IE - HKU\S-1-5-21-2809889056-3464315095-2278337278-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.schnellsucher.com/?t=Q0908131707&s=h

IE - HKU\S-1-5-21-2809889056-3464315095-2278337278-1001\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKU\S-1-5-21-2809889056-3464315095-2278337278-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledItems: multilinks@plugin:1.0.0.12

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.01.06 09:33:26 | 000,000,000 | ---D | M]

 

[2009.04.11 14:31:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS x72v\AppData\Roaming\mozilla\Extensions

[2011.12.19 17:49:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS x72v\AppData\Roaming\mozilla\Firefox\Profiles\fgey6id2.default\extensions

[2009.11.13 20:48:43 | 000,000,000 | ---D | M] (Multi Links) -- C:\Users\ASUS x72v\AppData\Roaming\mozilla\Firefox\Profiles\fgey6id2.default\extensions\multilinks@plugin

[2011.12.19 17:49:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS x72v\AppData\Roaming\mozilla\Firefox\Profiles\fgey6id2.default\extensions\staged

[2011.12.19 20:56:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2009.09.04 14:09:54 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION

[2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2011.07.11 22:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL

CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll

CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll

CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll

CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: YouTube = C:\Users\ASUS x72v\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\

CHR - Extension: Google-Suche = C:\Users\ASUS x72v\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\

CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\ASUS x72v\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\

CHR - Extension: Google Mail = C:\Users\ASUS x72v\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

 

O1 HOSTS File: ([2012.01.06 10:07:22 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O3 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1001\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe ()

O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS)

O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe ()

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1000..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

O4 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1001..\Run: [EPSON Stylus DX8400 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE (SEIKO EPSON CORPORATION)

O4 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1001..\Run: [EPSON Stylus DX9400F Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICFE.EXE (SEIKO EPSON CORPORATION)

O4 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1001..\Run: [iexploer.exe] C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe File not found

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O7 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)

O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B8A7E2A5-BF27-4014-93AD-F1B3729F6DCE}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EC2AFD73-5775-499D-8010-29CA5974B896}: DhcpNameServer = 192.168.2.1

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)

O24 - Desktop WallPaper: C:\Users\ASUS x72v\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\ASUS x72v\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2011.10.10 14:54:08 | 002,290,144 | R--- | M] () - E:\Autorun.exe -- [ CDFS ]

O32 - AutoRun File - [2011.10.09 15:23:34 | 000,000,047 | R--- | M] () - E:\Autorun.inf -- [ CDFS ]

O32 - AutoRun File - [2011.10.09 15:23:34 | 000,224,630 | R--- | M] () - E:\autorun.ico -- [ CDFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - State: "startup" - 2

 

SafeBootMin: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)

SafeBootMin: AppMgmt -  File not found

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)

SafeBootNet: AppMgmt -  File not found

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfPf - Driver

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F00842BF-035E-6FF4-D37F-9021C12AD969} - Microsoft Windows Media Player 11.0

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\Windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: wave2 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.01.07 18:59:15 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Roaming\SUPERAntiSpyware.com

[2012.01.07 18:58:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

[2012.01.07 18:58:11 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2012.01.07 18:58:11 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware

[2012.01.07 18:55:36 | 013,597,392 | ---- | C] (SUPERAntiSpyware.com) -- C:\Users\ASUS x72v\Desktop\SUPERAntiSpyware.exe

[2012.01.06 19:33:23 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Roaming\Online Solutions

[2012.01.06 15:48:05 | 004,704,768 | ---- | C] (AVAST Software) -- C:\Users\ASUS x72v\Desktop\aswMBR.exe

[2012.01.06 15:13:54 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2012.01.06 15:11:08 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\Desktop\osam_autorun_manager_5_0_portable

[2012.01.06 10:09:15 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Local\temp

[2012.01.06 10:08:42 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2012.01.06 09:56:46 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012.01.06 09:56:46 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012.01.06 09:56:46 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012.01.06 09:56:34 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2012.01.06 09:56:33 | 000,000,000 | ---D | C] -- C:\ComboFix

[2012.01.06 09:56:30 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012.01.06 09:40:20 | 004,372,321 | R--- | C] (Swearware) -- C:\Users\ASUS x72v\Desktop\ComboFix.exe

[2012.01.06 09:34:12 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Local\DDMSettings

[2012.01.05 23:31:35 | 001,578,288 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\ASUS x72v\Desktop\tdsskiller.exe

[2012.01.05 23:11:18 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.01.05 18:12:14 | 002,322,184 | ---- | C] (ESET) -- C:\Users\ASUS x72v\Desktop\esetsmartinstaller_enu.exe

[2012.01.05 18:02:34 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.01.05 15:38:58 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Roaming\Malwarebytes

[2012.01.05 15:38:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.01.05 15:38:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.01.05 15:38:41 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.01.05 15:38:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.01.04 21:30:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

[2012.01.04 21:30:25 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip

[2012.01.04 19:49:41 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\ASUS x72v\Desktop\OTL.exe

[2012.01.03 22:56:53 | 000,000,000 | ---D | C] -- C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}

[2012.01.03 22:47:14 | 000,939,368 | ---- | C] (Macromedia, Inc.) -- C:\Windows\System32\flash.ocx

[2012.01.03 22:46:59 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Local\PackageAware

[2012.01.02 23:34:36 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\Documents\ANNO 2070

[2012.01.02 22:48:12 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Local\Ubisoft Game Launcher

[2012.01.02 22:47:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Solidshield

[2011.12.22 16:40:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2011.12.22 16:40:21 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2011.12.22 15:30:32 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Roaming\Avira

[2011.12.19 21:30:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2011.12.19 21:30:24 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2011.12.19 21:30:23 | 000,134,856 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2011.12.19 21:30:23 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2011.12.19 21:30:23 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys

[2011.12.19 21:30:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2011.12.19 21:30:22 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2011.12.19 21:17:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2008.06.03 07:41:51 | 000,015,928 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.01.09 19:05:07 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.01.09 18:20:43 | 000,121,213 | ---- | M] () -- C:\ProgramData\nvModes.001

[2012.01.09 18:20:33 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe

[2012.01.09 18:20:33 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.01.09 18:11:28 | 000,000,374 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics

[2012.01.09 18:11:15 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.01.09 18:11:15 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.01.09 18:11:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.01.09 18:11:04 | 3220,295,680 | -HS- | M] () -- C:\hiberfil.sys

[2012.01.09 15:03:59 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2012.01.07 18:58:15 | 000,001,767 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012.01.07 18:55:39 | 013,597,392 | ---- | M] (SUPERAntiSpyware.com) -- C:\Users\ASUS x72v\Desktop\SUPERAntiSpyware.exe

[2012.01.06 19:16:42 | 000,019,456 | ---- | M] () -- C:\Users\ASUS x72v\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.01.06 15:48:09 | 004,704,768 | ---- | M] (AVAST Software) -- C:\Users\ASUS x72v\Desktop\aswMBR.exe

[2012.01.06 15:40:35 | 331,832,016 | ---- | M] () -- C:\Windows\MEMORY.DMP

[2012.01.06 10:07:22 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2012.01.06 09:42:18 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.01.06 09:42:18 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.01.06 09:42:18 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.01.06 09:42:18 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.01.06 09:40:33 | 004,372,321 | R--- | M] (Swearware) -- C:\Users\ASUS x72v\Desktop\ComboFix.exe

[2012.01.05 23:31:31 | 001,578,288 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\ASUS x72v\Desktop\tdsskiller.exe

[2012.01.05 18:12:00 | 002,322,184 | ---- | M] (ESET) -- C:\Users\ASUS x72v\Desktop\esetsmartinstaller_enu.exe

[2012.01.05 15:38:43 | 000,000,873 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.01.05 13:30:42 | 000,000,378 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20120105_133037.reg

[2012.01.05 09:38:04 | 000,003,202 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20120105_093755.reg

[2012.01.04 20:08:31 | 000,302,592 | ---- | M] () -- C:\Users\ASUS x72v\Desktop\lovg4e3u.exe

[2012.01.04 19:49:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\ASUS x72v\Desktop\OTL.exe

[2012.01.04 19:48:39 | 000,000,000 | ---- | M] () -- C:\Users\ASUS x72v\defogger_reenable

[2012.01.04 19:44:46 | 000,050,477 | ---- | M] () -- C:\Users\ASUS x72v\Desktop\Defogger.exe

[2012.01.03 22:58:52 | 000,040,046 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20120103_225837.reg

[2012.01.03 22:06:25 | 000,000,067 | ---- | M] () -- C:\Windows\wininit.ini

[2012.01.03 22:05:01 | 000,000,341 | ---- | M] () -- C:\Windows\SIERRA.INI

[2012.01.03 20:49:54 | 000,450,704 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.01.03 20:42:03 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat

[2012.01.03 20:42:03 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat

[2012.01.03 20:41:52 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf

[2012.01.02 22:39:12 | 000,121,213 | ---- | M] () -- C:\ProgramData\nvModes.dat

[2011.12.22 16:48:05 | 000,000,206 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164801.reg

[2011.12.22 16:47:39 | 000,005,888 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164734.reg

[2011.12.22 16:47:08 | 000,014,124 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164703.reg

[2011.12.22 16:46:24 | 000,218,176 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164557.reg

[2011.12.22 15:29:24 | 000,000,680 | RHS- | M] () -- C:\Users\ASUS x72v\ntuser.pol

[2011.12.19 21:30:36 | 000,001,814 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

 
 ========== Files Created - No Company Name ==========

 

[2012.01.07 18:58:15 | 000,001,767 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012.01.06 15:40:35 | 331,832,016 | ---- | C] () -- C:\Windows\MEMORY.DMP

[2012.01.06 09:56:46 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012.01.06 09:56:46 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012.01.06 09:56:46 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012.01.06 09:56:46 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012.01.06 09:56:46 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012.01.05 15:38:43 | 000,000,873 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.01.05 13:30:40 | 000,000,378 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20120105_133037.reg

[2012.01.05 09:38:01 | 000,003,202 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20120105_093755.reg

[2012.01.04 20:08:30 | 000,302,592 | ---- | C] () -- C:\Users\ASUS x72v\Desktop\lovg4e3u.exe

[2012.01.04 19:48:39 | 000,000,000 | ---- | C] () -- C:\Users\ASUS x72v\defogger_reenable

[2012.01.04 19:44:45 | 000,050,477 | ---- | C] () -- C:\Users\ASUS x72v\Desktop\Defogger.exe

[2012.01.03 22:58:42 | 000,040,046 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20120103_225837.reg

[2012.01.03 22:06:25 | 000,000,067 | ---- | C] () -- C:\Windows\wininit.ini

[2012.01.03 20:41:52 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf

[2011.12.22 16:48:03 | 000,000,206 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164801.reg

[2011.12.22 16:47:36 | 000,005,888 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164734.reg

[2011.12.22 16:47:05 | 000,014,124 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164703.reg

[2011.12.22 16:46:07 | 000,218,176 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164557.reg

[2011.12.19 21:30:36 | 000,001,814 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2011.12.18 23:23:29 | 3220,295,680 | -HS- | C] () -- C:\hiberfil.sys

[2011.08.18 21:00:49 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat

[2011.01.23 14:36:37 | 000,000,341 | ---- | C] () -- C:\Windows\SIERRA.INI

[2009.12.26 17:30:57 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys

[2009.12.26 17:30:57 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys

[2009.11.22 19:56:21 | 000,000,016 | ---- | C] () -- C:\Windows\popcinfo.dat

[2009.10.01 17:02:49 | 000,004,907 | ---- | C] () -- C:\ProgramData\ypkpiykb.yyr

[2009.09.14 15:40:53 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009.09.14 15:40:53 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009.08.13 20:06:07 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2009.08.13 16:44:57 | 000,000,081 | -HS- | C] () -- C:\ProgramData\.zreglib

[2009.02.27 09:57:49 | 000,000,680 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\d3d9caps.dat

[2009.02.07 15:04:06 | 000,024,206 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Roaming\UserTile.png

[2009.01.15 18:16:05 | 000,019,456 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008.12.13 12:37:56 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini

[2008.12.06 10:04:44 | 000,121,213 | ---- | C] () -- C:\ProgramData\nvModes.001

[2008.12.05 20:29:39 | 000,121,213 | ---- | C] () -- C:\ProgramData\nvModes.dat

[2008.10.09 08:41:14 | 000,000,024 | ---- | C] () -- C:\Windows\System32\ChkMail.ini

[2008.10.09 08:40:56 | 000,045,056 | ---- | C] () -- C:\Windows\System32\acovcnt.exe

[2008.10.09 08:30:30 | 000,047,672 | ---- | C] () -- C:\Windows\AsScrProlog.exe

[2008.10.09 07:06:39 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2008.10.09 06:16:03 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat

[2008.07.02 03:28:38 | 000,061,440 | ---- | C] () -- C:\Program Files\Common Files\CPInstallAction.dll

[2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files\Common Files\banner.jpg

[2008.04.16 12:11:34 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2008.04.16 12:11:34 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2008.04.16 12:11:34 | 000,126,454 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2008.04.16 12:11:34 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2008.04.16 11:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini

[2007.04.16 11:24:16 | 000,023,752 | ---- | C] () -- C:\Windows\System32\providers.bin

[2007.03.06 07:39:19 | 000,049,152 | ---- | C] () -- C:\Windows\revdevdll.dll

[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 13:47:37 | 000,450,704 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 11:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 11:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2006.03.09 02:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2005.04.03 00:29:59 | 000,110,592 | R--- | C] () -- C:\Windows\System32\scardsyn.dll

[2001.11.14 21:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

[1998.05.06 05:09:59 | 000,069,632 | R--- | C] () -- C:\Windows\System32\ODMA32.dll

 
 ========== LOP Check ==========

 

[2010.12.23 23:58:49 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\FreeAudioPack

[2011.01.18 21:02:01 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\GOA

[2012.01.06 19:37:00 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Online Solutions

[2009.02.07 15:04:06 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\PeerNetworking

[2011.05.07 09:51:25 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\ScummVM

[2012.01.02 22:38:39 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Ubisoft

[2011.07.01 14:47:52 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant

[2011.08.18 21:04:31 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Daedalic Entertainment

[2011.03.19 10:50:57 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\elsterformular

[2010.07.16 16:25:05 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\EPSON

[2010.12.24 00:01:32 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\FreeAudioPack

[2009.10.04 12:59:42 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\GetRightToGo

[2011.01.19 16:33:46 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\GOA

[2009.08.10 15:11:00 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\My Games

[2011.05.07 10:26:56 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\ScummVM

[2009.08.13 12:56:14 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Sega

[2010.01.07 22:05:29 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Ubisoft

[2011.11.25 19:57:41 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\WB Games

[2012.01.09 15:03:59 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.07.01 14:47:42 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Adobe

[2011.12.22 15:30:32 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Avira

[2009.06.04 17:16:05 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\CyberLink

[2012.01.06 19:16:40 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\DivX

[2009.10.02 11:23:34 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\dvdcss

[2010.12.23 23:58:49 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\FreeAudioPack

[2011.01.18 21:02:01 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\GOA

[2008.12.05 20:29:12 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Identities

[2008.12.05 20:29:36 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Macromedia

[2012.01.05 15:38:58 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Malwarebytes

[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Media Center Programs

[2012.01.03 22:04:16 | 000,000,000 | --SD | M] -- C:\Users\ASUS x72v\AppData\Roaming\Microsoft

[2009.04.11 14:31:53 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Mozilla

[2012.01.06 19:37:00 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Online Solutions

[2009.02.07 15:04:06 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\PeerNetworking

[2011.05.07 09:51:25 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\ScummVM

[2009.04.13 16:57:49 | 000,000,000 | RH-D | M] -- C:\Users\ASUS x72v\AppData\Roaming\SecuROM

[2009.11.12 18:56:19 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Skype

[2012.01.07 18:59:15 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\SUPERAntiSpyware.com

[2008.12.05 20:29:50 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Symantec

[2012.01.02 22:38:39 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Ubisoft

[2009.05.10 03:08:31 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\vlc

[2011.12.22 16:42:36 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Winamp

[2009.06.17 14:38:33 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\WinRAR

 
 < %APPDATA%\*.exe /s >

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\ERDNT\cache\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\ERDNT\cache\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2008.02.22 05:59:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=76D70915EB81608DC6ACA87887FAB38F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22120_none_ddac250d3ab7a648\atapi.sys

[2008.02.22 06:03:50 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=92210921EEFC081693F649C3631DEEC2 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_3d9c5057\atapi.sys

[2008.02.22 06:03:50 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=92210921EEFC081693F649C3631DEEC2 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18023_none_dd25892021975283\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\ERDNT\cache\cngaudit.dll

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2008.05.07 10:40:01 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\drivers\iaStor.sys

[2008.05.07 10:40:01 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_1ab0331f\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\ERDNT\cache\netlogon.dll

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\ERDNT\cache\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\ERDNT\cache\user32.dll

[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\ERDNT\cache\userinit.exe

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\ERDNT\cache\wininit.exe

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\ERDNT\cache\winlogon.exe

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

cosinus

09.01.2012 21:55

Code:

:OTL

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O3 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1001\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

O4 - HKU\S-1-5-21-2809889056-3464315095-2278337278-1001..\Run: [iexploer.exe] C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe File not found

:Commands

[emptytemp]

[resethosts]

nightingale7

09.01.2012 23:36

Leider erscheint die besagte Fehlermeldung nach dem Fix beim Neustart immer noch.

Hier das Log:

Code:

All processes killed

========== OTL ==========

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.

Registry value HKEY_USERS\S-1-5-21-2809889056-3464315095-2278337278-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.

Registry value HKEY_USERS\S-1-5-21-2809889056-3464315095-2278337278-1001\Software\Microsoft\Windows\CurrentVersion\Run\\iexploer.exe deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: ASUS x72v

->Temp folder emptied: 50419037 bytes

->Temporary Internet Files folder emptied: 950522 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 0 bytes

->Google Chrome cache emptied: 294631734 bytes

->Flash cache emptied: 976 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Default User

 

User: Nebelkrähe

->Temp folder emptied: 33917 bytes

->Temporary Internet Files folder emptied: 67988 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 165761236 bytes

->Google Chrome cache emptied: 0 bytes

->Flash cache emptied: 531 bytes

 

User: Public

->Temp folder emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 663274 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 489,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.31.0 log created on 01092012_232301
 

Files\Folders moved on Reboot...
 

Registry entries deleted on Reboot...

cosinus

10.01.2012 00:03

BHast du mit dem betroffenen Benutzerkonto das OTL-Log erstellt? :wtf:

nightingale7

10.01.2012 08:02

Ja. Ich hab mir OTL.exe ein zweites Mal runtergeladen und es auf den Desktop des betroffenen Benutzerkontos gelegt. Habe aber die erste OTL.exe auf dem Desktop des Admins vorher nicht deinstallieren können, weil Windows es nicht in der Übersicht der installierten Programme auflistet. Sind die beiden sich in die Quere gekommen? Gescannt habe ich jedenfalls vom betroffenen Konto.

cosinus

10.01.2012 10:01

Nein OTL wird nicht installiert. Es muss einfach nur ausgeführt werden

Zitat:

C:\Users\NEBELK~1\AppData\Local\Temp\wpbt0.dll
Das angegebene Modul wurde nicht gefunden.

Ich glaube du hast da was durcheinander bekommen. Anscheinend ist der User "NEBELK~1" betroffen, soll wohl "Nebelkrähe" bedeuten. Das letzte Log wurde aber mit User "ASUS x72v" erstellt...

Zitat:

Computer Name: ASUSX72V-PC | User Name: ASUS x72v | Logged in as Administrator.

nightingale7

10.01.2012 19:40

Vorab: Antivir hat mir vorhin wie wild Folgendes gemeldet:

Zitat:

C:\Users\ASUS x72v\Desktop\ComboFix.exe
[FUND] Enthält Erkennungsmuster des Rootkits RKIT/Agent.4372321

Ist das bedenklich, oder hat Antivir nur ein Problem mit ComboFix? Ich hab den Fund erstmal in Quarantäne verschieben lassen, weil das AV-Programm ständig mit der Meldung kam.

Hier zur Sicherheit das Report-Log:

Code:



Avira Free Antivirus

Erstellungsdatum der Reportdatei: Dienstag, 10. Januar 2012  19:07
 

Es wird nach 3054522 Virenstämmen gesucht.
 

Das Programm läuft als uneingeschränkte Vollversion.

Online-Dienste stehen zur Verfügung.
 

Lizenznehmer   : Avira AntiVir Personal - Free Antivirus

Seriennummer   : 0000149996-ADJIE-0000001

Plattform      : Windows Vista

Windowsversion : (Service Pack 2)  [6.0.6002]

Boot Modus     : Normal gebootet

Benutzername   : SYSTEM

Computername   : ASUSX72V-PC
 

Versionsinformationen:

BUILD.DAT      : 12.0.0.872     41826 Bytes  15.12.2011 16:24:00

AVSCAN.EXE     : 12.1.0.18     490448 Bytes  09.12.2011 11:39:55

AVSCAN.DLL     : 12.1.0.17      65744 Bytes  09.12.2011 11:40:16

LUKE.DLL       : 12.1.0.17      68304 Bytes  09.12.2011 11:40:03

AVSCPLR.DLL    : 12.1.0.21      99536 Bytes  09.12.2011 11:39:56

AVREG.DLL      : 12.1.0.27     227536 Bytes  09.12.2011 12:10:20

VBASE000.VDF   : 7.10.0.0    19875328 Bytes  06.11.2009 18:18:34

VBASE001.VDF   : 7.11.0.0    13342208 Bytes  14.12.2010 09:07:39

VBASE002.VDF   : 7.11.19.170 14374912 Bytes  20.12.2011 20:35:10

VBASE003.VDF   : 7.11.19.171     2048 Bytes  20.12.2011 20:35:10

VBASE004.VDF   : 7.11.19.172     2048 Bytes  20.12.2011 20:35:10

VBASE005.VDF   : 7.11.19.173     2048 Bytes  20.12.2011 20:35:10

VBASE006.VDF   : 7.11.19.174     2048 Bytes  20.12.2011 20:35:10

VBASE007.VDF   : 7.11.19.175     2048 Bytes  20.12.2011 20:35:11

VBASE008.VDF   : 7.11.19.176     2048 Bytes  20.12.2011 20:35:11

VBASE009.VDF   : 7.11.19.177     2048 Bytes  20.12.2011 20:35:11

VBASE010.VDF   : 7.11.19.178     2048 Bytes  20.12.2011 20:35:11

VBASE011.VDF   : 7.11.19.179     2048 Bytes  20.12.2011 20:35:11

VBASE012.VDF   : 7.11.19.180     2048 Bytes  20.12.2011 20:35:11

VBASE013.VDF   : 7.11.19.217   182784 Bytes  22.12.2011 14:32:57

VBASE014.VDF   : 7.11.19.255   148480 Bytes  24.12.2011 18:00:54

VBASE015.VDF   : 7.11.20.29    164352 Bytes  27.12.2011 18:00:54

VBASE016.VDF   : 7.11.20.70    180224 Bytes  29.12.2011 18:00:55

VBASE017.VDF   : 7.11.20.102   240640 Bytes  02.01.2012 21:19:17

VBASE018.VDF   : 7.11.20.139   164864 Bytes  04.01.2012 12:59:49

VBASE019.VDF   : 7.11.20.178   167424 Bytes  06.01.2012 07:32:18

VBASE020.VDF   : 7.11.20.207   230400 Bytes  10.01.2012 17:59:22

VBASE021.VDF   : 7.11.20.208     2048 Bytes  10.01.2012 17:59:22

VBASE022.VDF   : 7.11.20.209     2048 Bytes  10.01.2012 17:59:23

VBASE023.VDF   : 7.11.20.210     2048 Bytes  10.01.2012 17:59:23

VBASE024.VDF   : 7.11.20.211     2048 Bytes  10.01.2012 17:59:23

VBASE025.VDF   : 7.11.20.212     2048 Bytes  10.01.2012 17:59:23

VBASE026.VDF   : 7.11.20.213     2048 Bytes  10.01.2012 17:59:23

VBASE027.VDF   : 7.11.20.214     2048 Bytes  10.01.2012 17:59:23

VBASE028.VDF   : 7.11.20.215     2048 Bytes  10.01.2012 17:59:23

VBASE029.VDF   : 7.11.20.216     2048 Bytes  10.01.2012 17:59:23

VBASE030.VDF   : 7.11.20.217     2048 Bytes  10.01.2012 17:59:23

VBASE031.VDF   : 7.11.20.226    78336 Bytes  10.01.2012 17:59:27

Engineversion  : 8.2.8.22  

AEVDF.DLL      : 8.1.2.2       106868 Bytes  09.12.2011 11:39:53

AESCRIPT.DLL   : 8.1.3.96      434554 Bytes  10.01.2012 18:00:26

AESCN.DLL      : 8.1.7.2       127349 Bytes  01.09.2011 21:46:02

AESBX.DLL      : 8.2.4.5       434549 Bytes  09.12.2011 11:39:52

AERDL.DLL      : 8.1.9.15      639348 Bytes  08.09.2011 21:16:06

AEPACK.DLL     : 8.2.15.1      770423 Bytes  19.12.2011 20:31:11

AEOFFICE.DLL   : 8.1.2.25      201084 Bytes  01.01.2012 18:00:58

AEHEUR.DLL     : 8.1.3.15     4264310 Bytes  10.01.2012 18:00:11

AEHELP.DLL     : 8.1.18.0      254327 Bytes  09.12.2011 11:39:50

AEGEN.DLL      : 8.1.5.17      405877 Bytes  19.12.2011 20:31:09

AEEMU.DLL      : 8.1.3.0       393589 Bytes  01.09.2011 21:46:01

AECORE.DLL     : 8.1.24.3      201079 Bytes  01.01.2012 18:00:57

AEBB.DLL       : 8.1.1.0        53618 Bytes  01.09.2011 21:46:01

AVWINLL.DLL    : 12.1.0.17      27344 Bytes  09.12.2011 11:39:57

AVPREF.DLL     : 12.1.0.17      51920 Bytes  09.12.2011 11:39:55

AVREP.DLL      : 12.1.0.17     179408 Bytes  09.12.2011 11:39:55

AVARKT.DLL     : 12.1.0.19     208848 Bytes  09.12.2011 11:39:53

AVEVTLOG.DLL   : 12.1.0.17     169168 Bytes  09.12.2011 11:39:54

SQLITE3.DLL    : 3.7.0.0       398288 Bytes  09.12.2011 11:40:07

AVSMTP.DLL     : 12.1.0.17      62928 Bytes  09.12.2011 11:39:56

NETNT.DLL      : 12.1.0.17      17104 Bytes  09.12.2011 11:40:03

RCIMAGE.DLL    : 12.1.0.17    4447952 Bytes  09.12.2011 11:40:18

RCTEXT.DLL     : 12.1.0.16      98512 Bytes  09.12.2011 11:40:19
 

Konfiguration für den aktuellen Suchlauf:

Job Name..............................: AVGuardAsyncScan

Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_4f0c7c56\guard_slideup.avp

Protokollierung.......................: standard

Primäre Aktion........................: interaktiv

Sekundäre Aktion......................: quarantäne

Durchsuche Masterbootsektoren.........: ein

Durchsuche Bootsektoren...............: aus

Durchsuche aktive Programme...........: ein

Durchsuche Registrierung..............: aus

Suche nach Rootkits...................: aus

Integritätsprüfung von Systemdateien..: aus

Datei Suchmodus.......................: Alle Dateien

Durchsuche Archive....................: ein

Rekursionstiefe einschränken..........: 20

Archiv Smart Extensions...............: ein

Makrovirenheuristik...................: ein

Dateiheuristik........................: vollständig
 

Beginn des Suchlaufs: Dienstag, 10. Januar 2012  19:07
 

Der Suchlauf über gestartete Prozesse wird begonnen:

Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SynTPHelper.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'firefox.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ehmsas.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmpnetwk.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmpnscfg.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'BTTray.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ehtray.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'LightScribeControlPanel.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'sidebar.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'DivXUpdate.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'WDC.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'KBFiltr.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'RtHDVCpl.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SynTPEnh.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'AsScrPro.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'DMedia.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ATKOSD.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ACEngSvr.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ATKOSD2.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'HControlUser.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'aspg.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ACMON.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'BatteryLife.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wcourier.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'HControl.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'MsgTranAgt.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'Explorer.EXE' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'Dwm.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'alg.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'TrustedInstaller.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avshadow.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'WLIDSvcM.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SearchIndexer.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'WLIDSVC.EXE' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'spmgr.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'LSSrvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'btwdins.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'agrsmsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SASCORE.EXE' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'spoolsv.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'GFNEXSrv.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ASLDRSrv.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SLsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'nvvsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'winlogon.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'lsm.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'lsass.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'services.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wininit.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'smss.exe' - '1' Modul(e) wurden durchsucht
 

Der Suchlauf über die ausgewählten Dateien wird begonnen:
 

Beginne mit der Suche in 'C:\Users\ASUS x72v\Desktop\ComboFix.exe'

C:\Users\ASUS x72v\Desktop\ComboFix.exe
 

Beginne mit der Desinfektion:

C:\Users\ASUS x72v\Desktop\ComboFix.exe

  [FUND]      Enthält Erkennungsmuster des Rootkits RKIT/Agent.4372321

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4ac4d09a.qua' verschoben!
 
 

Ende des Suchlaufs: Dienstag, 10. Januar 2012  19:07

Benötigte Zeit: 00:02 Minute(n)
 

Der Suchlauf wurde vollständig durchgeführt.
 

      0 Verzeichnisse wurden überprüft

    306 Dateien wurden geprüft

      1 Viren bzw. unerwünschte Programme wurden gefunden

      0 Dateien wurden als verdächtig eingestuft

      0 Dateien wurden gelöscht

      0 Viren bzw. unerwünschte Programme wurden repariert

      1 Dateien wurden in die Quarantäne verschoben

      0 Dateien wurden umbenannt

      0 Dateien konnten nicht durchsucht werden

    305 Dateien ohne Befall

      6 Archive wurden durchsucht

      0 Warnungen

      1 Hinweise
 
 

Die Suchergebnisse werden an den Guard übermittelt.

Was OTL angeht, kann ich mir das echt nicht erklären. Ich hab jetzt vom betroffenen Benutzerkonto (Nebelkrähe) aus noch einen Scan machen lassen, aber wieder zeigt das Log, dass ich angeblich mit dem Usernamen "ASUS x72v" angemeldet sei. Was mach ich denn falsch?

Hier das Log, falls du selbst nochmal schauen magst:

Code:

OTL logfile created on: 10.01.2012 19:12:04 - Run 9

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Nebelkrähe\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,04 Gb Available Physical Memory | 67,99% Memory free

6,19 Gb Paging File | 5,18 Gb Available in Paging File | 83,64% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 149,04 Gb Total Space | 82,57 Gb Free Space | 55,40% Space Free | Partition Type: NTFS

Drive D: | 139,28 Gb Total Space | 26,93 Gb Free Space | 19,33% Space Free | Partition Type: NTFS

Drive E: | 4,61 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: ASUSX72V-PC | User Name: ASUS x72v | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.01.09 18:50:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Nebelkrähe\Desktop\OTL.exe

PRC - [2011.12.09 12:40:20 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.12.09 12:40:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2011.12.09 12:39:54 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.12.09 12:39:54 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.08.12 00:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe

PRC - [2011.07.29 00:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe

PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008.10.09 08:30:20 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe

PRC - [2008.07.15 19:29:00 | 007,651,328 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe

PRC - [2008.07.15 19:22:46 | 000,217,088 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControl.exe

PRC - [2008.07.10 01:09:26 | 000,191,032 | ---- | M] (ATK) -- C:\Program Files\P4G\BatteryLife.exe

PRC - [2008.06.25 03:01:08 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Media\DMedia.exe

PRC - [2008.06.24 04:16:24 | 002,482,176 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe

PRC - [2008.06.19 20:18:12 | 000,154,168 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ASUS CopyProtect\ASPG.exe

PRC - [2008.06.13 06:52:51 | 006,183,456 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2008.06.04 01:29:08 | 000,851,968 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe

PRC - [2008.04.10 19:32:18 | 000,752,168 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

PRC - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe

PRC - [2008.01.23 18:51:28 | 000,151,552 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\WDC.exe

PRC - [2008.01.12 06:40:10 | 000,098,304 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

PRC - [2007.11.05 03:48:06 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe

PRC - [2007.10.03 05:53:00 | 000,094,208 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe

PRC - [2007.08.15 19:20:16 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe

PRC - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe

PRC - [2007.08.03 20:24:54 | 000,125,496 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

PRC - [2007.07.06 00:53:44 | 001,040,384 | ---- | M] () -- C:\Program Files\Wireless Console 2\wcourier.exe

PRC - [2005.07.06 23:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.07.29 00:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll

MOD - [2011.07.29 00:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe

MOD - [2008.04.10 19:25:54 | 000,126,976 | ---- | M] () -- C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll

MOD - [2008.01.12 06:40:10 | 000,098,304 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

MOD - [2007.11.12 23:41:50 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\MsgTran.dll

MOD - [2007.08.14 21:59:54 | 006,365,184 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtGui4.dll

MOD - [2007.07.12 21:55:52 | 000,131,072 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll

MOD - [2007.07.12 21:55:28 | 001,581,056 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtCore4.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.12.09 12:40:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.12.09 12:39:54 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.08.12 00:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)

SRV - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)

SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.10.03 05:53:00 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService)

SRV - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)

SRV - [2007.08.03 20:24:54 | 000,125,496 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.12.09 12:40:20 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.12.09 12:40:20 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.12.09 12:40:20 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2011.07.22 17:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)

DRV - [2011.07.12 22:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.12.26 17:30:57 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2009.12.26 17:30:57 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2009.05.28 21:41:28 | 004,233,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)

DRV - [2008.06.25 15:58:59 | 007,534,720 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2008.06.25 15:58:59 | 000,043,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)

DRV - [2008.06.03 07:41:51 | 000,015,928 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)

DRV - [2008.05.29 18:21:02 | 000,015,416 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\lullaby.sys -- (lullaby)

DRV - [2008.05.20 01:15:42 | 000,061,424 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Program Files\ASUS\AI TouchMedia\PlayMovie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})

DRV - [2008.05.02 06:59:39 | 000,122,368 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2008.03.21 05:12:59 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2008.02.16 01:42:42 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)

DRV - [2008.02.05 08:52:23 | 000,206,464 | ---- | M] (eMPIA Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etFilter.sys -- (FiltUSBET)

DRV - [2008.01.31 12:18:57 | 000,006,528 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etScan.sys -- (ScanUSBET)

DRV - [2007.12.19 01:12:12 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)

DRV - [2007.09.06 09:43:49 | 000,474,624 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etDevice.sys -- (DCamUSBET)

DRV - [2007.08.03 05:26:21 | 000,020,936 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)

DRV - [2007.07.30 19:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)

DRV - [2007.07.30 18:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)

DRV - [2007.07.24 19:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP)

DRV - [2007.06.17 05:29:08 | 000,146,824 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor)

DRV - [2006.12.14 08:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)

DRV - [2006.11.02 08:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)

DRV - [2005.09.23 21:18:32 | 000,171,520 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MarvinBus.sys -- (MarvinBus)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledItems: multilinks@plugin:1.0.0.12

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.01.06 09:33:26 | 000,000,000 | ---D | M]

 

[2009.04.11 14:31:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS x72v\AppData\Roaming\mozilla\Extensions

[2011.12.19 17:49:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS x72v\AppData\Roaming\mozilla\Firefox\Profiles\fgey6id2.default\extensions

[2009.11.13 20:48:43 | 000,000,000 | ---D | M] (Multi Links) -- C:\Users\ASUS x72v\AppData\Roaming\mozilla\Firefox\Profiles\fgey6id2.default\extensions\multilinks@plugin

[2011.12.19 17:49:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS x72v\AppData\Roaming\mozilla\Firefox\Profiles\fgey6id2.default\extensions\staged

[2011.12.19 20:56:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2009.09.04 14:09:54 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION

[2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2011.07.11 22:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL

CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll

CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll

CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll

CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: YouTube = C:\Users\ASUS x72v\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\

CHR - Extension: Google-Suche = C:\Users\ASUS x72v\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\

CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\ASUS x72v\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\

CHR - Extension: Google Mail = C:\Users\ASUS x72v\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

 

O1 HOSTS File: ([2012.01.09 23:25:27 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe ()

O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS)

O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe ()

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)

O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B8A7E2A5-BF27-4014-93AD-F1B3729F6DCE}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EC2AFD73-5775-499D-8010-29CA5974B896}: DhcpNameServer = 192.168.2.1

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)

O24 - Desktop WallPaper: C:\Users\ASUS x72v\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\ASUS x72v\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2011.10.10 14:54:08 | 002,290,144 | R--- | M] () - E:\Autorun.exe -- [ CDFS ]

O32 - AutoRun File - [2011.10.09 15:23:34 | 000,000,047 | R--- | M] () - E:\Autorun.inf -- [ CDFS ]

O32 - AutoRun File - [2011.10.09 15:23:34 | 000,224,630 | R--- | M] () - E:\autorun.ico -- [ CDFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - State: "startup" - 2

 

SafeBootMin: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)

SafeBootMin: AppMgmt -  File not found

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)

SafeBootNet: AppMgmt -  File not found

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfPf - Driver

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F00842BF-035E-6FF4-D37F-9021C12AD969} - Microsoft Windows Media Player 11.0

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\Windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: wave2 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.01.07 18:59:15 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Roaming\SUPERAntiSpyware.com

[2012.01.07 18:58:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

[2012.01.07 18:58:11 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2012.01.07 18:58:11 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware

[2012.01.07 18:55:36 | 013,597,392 | ---- | C] (SUPERAntiSpyware.com) -- C:\Users\ASUS x72v\Desktop\SUPERAntiSpyware.exe

[2012.01.06 19:33:23 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Roaming\Online Solutions

[2012.01.06 15:48:05 | 004,704,768 | ---- | C] (AVAST Software) -- C:\Users\ASUS x72v\Desktop\aswMBR.exe

[2012.01.06 15:13:54 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2012.01.06 15:11:08 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\Desktop\osam_autorun_manager_5_0_portable

[2012.01.06 10:09:15 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Local\temp

[2012.01.06 10:08:42 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2012.01.06 09:56:46 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012.01.06 09:56:46 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012.01.06 09:56:46 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012.01.06 09:56:34 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2012.01.06 09:56:33 | 000,000,000 | ---D | C] -- C:\ComboFix

[2012.01.06 09:56:30 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012.01.06 09:34:12 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Local\DDMSettings

[2012.01.05 23:31:35 | 001,578,288 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\ASUS x72v\Desktop\tdsskiller.exe

[2012.01.05 23:11:18 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.01.05 18:12:14 | 002,322,184 | ---- | C] (ESET) -- C:\Users\ASUS x72v\Desktop\esetsmartinstaller_enu.exe

[2012.01.05 18:02:34 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.01.05 15:38:58 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Roaming\Malwarebytes

[2012.01.05 15:38:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.01.05 15:38:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.01.05 15:38:41 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.01.05 15:38:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.01.04 21:30:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

[2012.01.04 21:30:25 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip

[2012.01.04 19:49:41 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\ASUS x72v\Desktop\OTL.exe

[2012.01.03 22:56:53 | 000,000,000 | ---D | C] -- C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}

[2012.01.03 22:47:14 | 000,939,368 | ---- | C] (Macromedia, Inc.) -- C:\Windows\System32\flash.ocx

[2012.01.03 22:46:59 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Local\PackageAware

[2012.01.02 23:34:36 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\Documents\ANNO 2070

[2012.01.02 22:48:12 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Local\Ubisoft Game Launcher

[2012.01.02 22:47:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Solidshield

[2011.12.22 16:40:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2011.12.22 16:40:21 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2011.12.22 15:30:32 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Roaming\Avira

[2011.12.19 21:30:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2011.12.19 21:30:24 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2011.12.19 21:30:23 | 000,134,856 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2011.12.19 21:30:23 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2011.12.19 21:30:23 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys

[2011.12.19 21:30:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2011.12.19 21:30:22 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2011.12.19 21:17:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2008.06.03 07:41:51 | 000,015,928 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.01.10 19:05:02 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.01.10 18:59:49 | 000,121,244 | ---- | M] () -- C:\ProgramData\nvModes.001

[2012.01.10 18:59:06 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.01.10 18:58:59 | 000,000,374 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics

[2012.01.10 18:58:45 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.01.10 18:58:45 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.01.10 18:58:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.01.10 18:58:34 | 3220,295,680 | -HS- | M] () -- C:\hiberfil.sys

[2012.01.10 08:03:24 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2012.01.10 07:40:48 | 000,121,244 | ---- | M] () -- C:\ProgramData\nvModes.dat

[2012.01.09 23:28:05 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe

[2012.01.09 23:25:27 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts

[2012.01.07 18:58:15 | 000,001,767 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012.01.07 18:55:39 | 013,597,392 | ---- | M] (SUPERAntiSpyware.com) -- C:\Users\ASUS x72v\Desktop\SUPERAntiSpyware.exe

[2012.01.06 19:16:42 | 000,019,456 | ---- | M] () -- C:\Users\ASUS x72v\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.01.06 15:48:09 | 004,704,768 | ---- | M] (AVAST Software) -- C:\Users\ASUS x72v\Desktop\aswMBR.exe

[2012.01.06 15:40:35 | 331,832,016 | ---- | M] () -- C:\Windows\MEMORY.DMP

[2012.01.06 09:42:18 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.01.06 09:42:18 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.01.06 09:42:18 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.01.06 09:42:18 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.01.05 23:31:31 | 001,578,288 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\ASUS x72v\Desktop\tdsskiller.exe

[2012.01.05 18:12:00 | 002,322,184 | ---- | M] (ESET) -- C:\Users\ASUS x72v\Desktop\esetsmartinstaller_enu.exe

[2012.01.05 15:38:43 | 000,000,873 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.01.05 13:30:42 | 000,000,378 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20120105_133037.reg

[2012.01.05 09:38:04 | 000,003,202 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20120105_093755.reg

[2012.01.04 20:08:31 | 000,302,592 | ---- | M] () -- C:\Users\ASUS x72v\Desktop\lovg4e3u.exe

[2012.01.04 19:49:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\ASUS x72v\Desktop\OTL.exe

[2012.01.04 19:48:39 | 000,000,000 | ---- | M] () -- C:\Users\ASUS x72v\defogger_reenable

[2012.01.04 19:44:46 | 000,050,477 | ---- | M] () -- C:\Users\ASUS x72v\Desktop\Defogger.exe

[2012.01.03 22:58:52 | 000,040,046 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20120103_225837.reg

[2012.01.03 22:06:25 | 000,000,067 | ---- | M] () -- C:\Windows\wininit.ini

[2012.01.03 22:05:01 | 000,000,341 | ---- | M] () -- C:\Windows\SIERRA.INI

[2012.01.03 20:49:54 | 000,450,704 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.01.03 20:42:03 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat

[2012.01.03 20:42:03 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat

[2012.01.03 20:41:52 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf

[2011.12.22 16:48:05 | 000,000,206 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164801.reg

[2011.12.22 16:47:39 | 000,005,888 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164734.reg

[2011.12.22 16:47:08 | 000,014,124 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164703.reg

[2011.12.22 16:46:24 | 000,218,176 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164557.reg

[2011.12.22 15:29:24 | 000,000,680 | RHS- | M] () -- C:\Users\ASUS x72v\ntuser.pol

[2011.12.19 21:30:36 | 000,001,814 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

 
 ========== Files Created - No Company Name ==========

 

[2012.01.07 18:58:15 | 000,001,767 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012.01.06 15:40:35 | 331,832,016 | ---- | C] () -- C:\Windows\MEMORY.DMP

[2012.01.06 09:56:46 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012.01.06 09:56:46 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012.01.06 09:56:46 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012.01.06 09:56:46 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012.01.06 09:56:46 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012.01.05 15:38:43 | 000,000,873 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.01.05 13:30:40 | 000,000,378 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20120105_133037.reg

[2012.01.05 09:38:01 | 000,003,202 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20120105_093755.reg

[2012.01.04 20:08:30 | 000,302,592 | ---- | C] () -- C:\Users\ASUS x72v\Desktop\lovg4e3u.exe

[2012.01.04 19:48:39 | 000,000,000 | ---- | C] () -- C:\Users\ASUS x72v\defogger_reenable

[2012.01.04 19:44:45 | 000,050,477 | ---- | C] () -- C:\Users\ASUS x72v\Desktop\Defogger.exe

[2012.01.03 22:58:42 | 000,040,046 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20120103_225837.reg

[2012.01.03 22:06:25 | 000,000,067 | ---- | C] () -- C:\Windows\wininit.ini

[2012.01.03 20:41:52 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf

[2011.12.22 16:48:03 | 000,000,206 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164801.reg

[2011.12.22 16:47:36 | 000,005,888 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164734.reg

[2011.12.22 16:47:05 | 000,014,124 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164703.reg

[2011.12.22 16:46:07 | 000,218,176 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164557.reg

[2011.12.19 21:30:36 | 000,001,814 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2011.12.18 23:23:29 | 3220,295,680 | -HS- | C] () -- C:\hiberfil.sys

[2011.08.18 21:00:49 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat

[2011.01.23 14:36:37 | 000,000,341 | ---- | C] () -- C:\Windows\SIERRA.INI

[2009.12.26 17:30:57 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys

[2009.12.26 17:30:57 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys

[2009.11.22 19:56:21 | 000,000,016 | ---- | C] () -- C:\Windows\popcinfo.dat

[2009.10.01 17:02:49 | 000,004,907 | ---- | C] () -- C:\ProgramData\ypkpiykb.yyr

[2009.09.14 15:40:53 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009.09.14 15:40:53 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009.08.13 20:06:07 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2009.08.13 16:44:57 | 000,000,081 | -HS- | C] () -- C:\ProgramData\.zreglib

[2009.02.27 09:57:49 | 000,000,680 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\d3d9caps.dat

[2009.02.07 15:04:06 | 000,024,206 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Roaming\UserTile.png

[2009.01.15 18:16:05 | 000,019,456 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008.12.13 12:37:56 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini

[2008.12.06 10:04:44 | 000,121,244 | ---- | C] () -- C:\ProgramData\nvModes.001

[2008.12.05 20:29:39 | 000,121,244 | ---- | C] () -- C:\ProgramData\nvModes.dat

[2008.10.09 08:41:14 | 000,000,024 | ---- | C] () -- C:\Windows\System32\ChkMail.ini

[2008.10.09 08:40:56 | 000,045,056 | ---- | C] () -- C:\Windows\System32\acovcnt.exe

[2008.10.09 08:30:30 | 000,047,672 | ---- | C] () -- C:\Windows\AsScrProlog.exe

[2008.10.09 07:06:39 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2008.10.09 06:16:03 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat

[2008.07.02 03:28:38 | 000,061,440 | ---- | C] () -- C:\Program Files\Common Files\CPInstallAction.dll

[2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files\Common Files\banner.jpg

[2008.04.16 12:11:34 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2008.04.16 12:11:34 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2008.04.16 12:11:34 | 000,126,454 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2008.04.16 12:11:34 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2008.04.16 11:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini

[2007.04.16 11:24:16 | 000,023,752 | ---- | C] () -- C:\Windows\System32\providers.bin

[2007.03.06 07:39:19 | 000,049,152 | ---- | C] () -- C:\Windows\revdevdll.dll

[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 13:47:37 | 000,450,704 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 11:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 11:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2006.03.09 02:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2005.04.03 00:29:59 | 000,110,592 | R--- | C] () -- C:\Windows\System32\scardsyn.dll

[2001.11.14 21:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

[1998.05.06 05:09:59 | 000,069,632 | R--- | C] () -- C:\Windows\System32\ODMA32.dll

 
 ========== LOP Check ==========

 

[2010.12.23 23:58:49 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\FreeAudioPack

[2011.01.18 21:02:01 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\GOA

[2012.01.06 19:37:00 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Online Solutions

[2009.02.07 15:04:06 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\PeerNetworking

[2011.05.07 09:51:25 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\ScummVM

[2012.01.02 22:38:39 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Ubisoft

[2012.01.10 08:03:25 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.07.01 14:47:42 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Adobe

[2011.12.22 15:30:32 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Avira

[2009.06.04 17:16:05 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\CyberLink

[2012.01.06 19:16:40 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\DivX

[2009.10.02 11:23:34 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\dvdcss

[2010.12.23 23:58:49 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\FreeAudioPack

[2011.01.18 21:02:01 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\GOA

[2008.12.05 20:29:12 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Identities

[2008.12.05 20:29:36 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Macromedia

[2012.01.05 15:38:58 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Malwarebytes

[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Media Center Programs

[2012.01.03 22:04:16 | 000,000,000 | --SD | M] -- C:\Users\ASUS x72v\AppData\Roaming\Microsoft

[2009.04.11 14:31:53 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Mozilla

[2012.01.06 19:37:00 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Online Solutions

[2009.02.07 15:04:06 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\PeerNetworking

[2011.05.07 09:51:25 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\ScummVM

[2009.04.13 16:57:49 | 000,000,000 | RH-D | M] -- C:\Users\ASUS x72v\AppData\Roaming\SecuROM

[2009.11.12 18:56:19 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Skype

[2012.01.07 18:59:15 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\SUPERAntiSpyware.com

[2008.12.05 20:29:50 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Symantec

[2012.01.02 22:38:39 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Ubisoft

[2009.05.10 03:08:31 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\vlc

[2011.12.22 16:42:36 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Winamp

[2009.06.17 14:38:33 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\WinRAR

 
 < %APPDATA%\*.exe /s >

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\ERDNT\cache\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\ERDNT\cache\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2008.02.22 05:59:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=76D70915EB81608DC6ACA87887FAB38F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22120_none_ddac250d3ab7a648\atapi.sys

[2008.02.22 06:03:50 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=92210921EEFC081693F649C3631DEEC2 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_3d9c5057\atapi.sys

[2008.02.22 06:03:50 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=92210921EEFC081693F649C3631DEEC2 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18023_none_dd25892021975283\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\ERDNT\cache\cngaudit.dll

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2008.05.07 10:40:01 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\drivers\iaStor.sys

[2008.05.07 10:40:01 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_1ab0331f\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\ERDNT\cache\netlogon.dll

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\ERDNT\cache\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\ERDNT\cache\user32.dll

[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\ERDNT\cache\userinit.exe

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\ERDNT\cache\wininit.exe

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\ERDNT\cache\winlogon.exe

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

cosinus

10.01.2012 21:16

In Combofix die Meldung ist ein Fehlalarm. Deswegen muss ja auch der Virenscanner abgestellt werden wenn CF arbeiten soll.

Kommt die Meldung zu wpbt0.dll immer noch?

nightingale7

10.01.2012 22:04

Ja, die Meldung erscheint immer noch. :(

cosinus

10.01.2012 22:20

Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.

Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
Lege eine leere CD in Deinen Brenner.
ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
Du kannst nun die Fenster des Brennprogramms schließen.

Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD

Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
Mache einen Doppelklick auf das OTLPE Icon.
Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
OTLpe sollte nun starten.
Drücke Run Scan, um den Scan zu starten.
Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
Bitte poste den Inhalt von C:\OTL.Txt und Extras.Txt.

nightingale7

10.01.2012 22:54

Uff, da hast du mir aber ne harte Nuss zu knacken gegeben. Da ich im Moment nix weiter als das infizierte Notebook hier habe und dieser Tage erst abends von der Arbeit komme, muss ich erstmal sehen, wie und wann und wo ich an einen PC komme, an dem ich mir das Programm brennen kann.

Gibt's derweil noch eine Alternative oder ist das zwingend der nächste Schritt?

cosinus

11.01.2012 10:40

Wüsste ich so erstmal nicht.
Die Meldung zu "wpbt0.dll nicht gefunden" ist ein eindeutiger Hinweis, dass es noch einen EIntrag geben muss der wieauch immer diese Datei beim Starten bzw. Einloggen dieses Users verarbeitet. Diese seh ich so aber nicht im OTL-Log :(

Vllt könntest du vorher nochmal neue Logs mit GMER und OSAM machen wenn ich da auch nichts sehe müsste man mal mit OTLPE ran

nightingale7

12.01.2012 10:34

GMER stürzt mir nach wie vor ständig ab, aber hier ist zumindest das OSAM-Log:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 10:28:27 on 12.01.2012
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Unable to get information
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"ASMMAP" (ASMMAP) - ? - C:\Program Files\ATKGFNEX\ASMMAP.sys

"atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys

"catchme" (catchme) - ? - C:\Users\ASUSX7~1\AppData\Local\Temp\catchme.sys  (File not found)

"ghaio" (ghaio) - ? - C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys  (File found, but it contains no detailed information)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)

"lullaby" (lullaby) - "Windows (R) Codename Longhorn DDK provider" - C:\Windows\System32\DRIVERS\lullaby.sys

"pgdiqkoc" (pgdiqkoc) - ? - C:\Users\ASUSX7~1\AppData\Local\Temp\pgdiqkoc.sys  (Hidden registry entry, rootkit activity | File not found)

"Pinnacle Marvin Bus" (MarvinBus) - "Pinnacle Systems GmbH" - C:\Windows\System32\DRIVERS\MarvinBus.sys

"SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS

"SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

"VClone" (VClone) - ? - C:\Windows\System32\DRIVERS\VClone.sys  (File not found)

"{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}" ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) - "Cyberlink Corp." - C:\Program Files\ASUS\AI TouchMedia\PlayMovie\000.fcl
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{10880D85-AAD9-4558-ABDC-2AB1552D831F} "LightScribe Control Panel" - "Hewlett-Packard Company" - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "SABShellExecuteHook Class" - "SuperAdBlocker.com" - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{79BC0345-1015-11D2-A299-006008312725} "///FAST project settings" - ? - C:\Program Files\Pinnacle\Studio 14\Programs\BlueShellExt.dll  (File found, but it contains no detailed information)

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_30.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

{C3F79A2B-B9B4-4A66-B012-3EE46475B072} "MessengerStatsClient Class" - "Microsoft Corporation" - C:\Windows\Downloaded Program Files\MessengerStatsPAClient.dll / hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

{5D6F45B3-9043-443D-A792-115447494D24} "UnoCtrl Class" - "Microsoft" - C:\Windows\Downloaded Program Files\GAME_UNO1.dll / hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

{326E768D-4182-46FD-9C16-1449A49795F4} "DivX Plus Web Player HTML5 <video>" - "DivX, LLC" - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID-Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\ASUS x72v\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"Bluetooth.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"LightScribe Control Panel" - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

"SUPERAntiSpyware" - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"ASUS Camera ScreenSaver" - ? - C:\Windows\AsScrProlog.exe  (File found, but it contains no detailed information)

"ASUS Screen Saver Protector" - "ASUS" - C:\Windows\AsScrPro.exe

"ATKMEDIA" - "ASUS" - C:\Program Files\ASUS\ATK Media\DMedia.exe

"ATKOSD2" - "ASUS" - C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe

"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"HControlUser" - ? - C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Adobe LM Service" (Adobe LM Service) - "Adobe Systems" - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

"ASLDR Service" (ASLDRService) - ? - C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe

"ATKGFNEX Service" (ATKGFNEXSrv) - ? - C:\Program Files\ATKGFNEX\GFNEXSrv.exe

"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"SAS Core Service" (!SASCORE) - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

"spmgr" (spmgr) - ? - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
 

[Winlogon]

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"!SASWinLogon" - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

cosinus

12.01.2012 19:23

Auch da seh ich den nicht.
Hast du OSAM mit dem betroffenen User ausgeführt? Der bteroffene User hat auch Adminrechte?

nightingale7

13.01.2012 15:21

Ja, mit dem betroffenen User ausgeführt. Dieser hat keine Admin-Rechte. Aber vielleicht liegt es daran, dass ich die Programme generell nicht ohne Admin-Rechte öffnen kann?

Hab's jedenfalls zuwege gebracht mit OTLPE von CD zu booten. Extras.txt scheint irgendwie wieder nicht vorhanden zu sein, aber hier das Log des Scans:

Code:

OTL logfile created on: 1/13/2012 8:54:02 AM - Run 

OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE

Windows Vista (TM) Home Premium Service Pack 2 (Version = 6.0.6002) - Type = System

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free

3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 149.04 Gb Total Space | 80.12 Gb Free Space | 53.75% Space Free | Partition Type: NTFS

Drive D: | 139.28 Gb Total Space | 28.20 Gb Free Space | 20.25% Space Free | Partition Type: NTFS

Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

 

Computer Name: REATOGO | User Name: SYSTEM

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

Using ControlSet: ControlSet001

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011/12/09 06:40:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011/12/09 06:39:54 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011/08/11 18:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)

SRV - [2008/03/17 23:27:11 | 000,013,312 | ---- | M] (Agere Systems) [Auto] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)

SRV - [2008/01/20 21:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007/10/02 23:53:00 | 000,094,208 | ---- | M] () [Auto] -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService)

SRV - [2007/08/08 02:08:40 | 000,094,208 | ---- | M] () [Auto] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)

SRV - [2007/08/03 14:24:54 | 000,125,496 | ---- | M] () [Auto] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand] --  -- (VClone)

DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFlt)

DRV - File not found [Kernel | On_Demand] --  -- (IpInIp)

DRV - File not found [Kernel | On_Demand] --  -- (catchme)

DRV - [2011/12/09 06:40:20 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011/12/09 06:40:20 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011/12/09 06:40:20 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2011/07/22 11:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)

DRV - [2011/07/12 16:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2010/06/17 08:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009/12/26 11:30:57 | 000,281,760 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2009/12/26 11:30:57 | 000,025,888 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2009/05/28 15:41:28 | 004,233,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)

DRV - [2008/06/25 09:58:59 | 007,534,720 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2008/06/25 09:58:59 | 000,043,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)

DRV - [2008/06/03 01:41:51 | 000,015,928 | ---- | M] ( ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)

DRV - [2008/05/29 12:21:02 | 000,015,416 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | Boot] -- C:\Windows\System32\drivers\lullaby.sys -- (lullaby)

DRV - [2008/05/19 19:15:42 | 000,061,424 | ---- | M] (Cyberlink Corp.) [Kernel | Auto] -- C:\Program Files\ASUS\AI TouchMedia\PlayMovie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})

DRV - [2008/05/02 00:59:39 | 000,122,368 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2008/03/20 23:12:59 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2008/02/15 19:42:42 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)

DRV - [2008/02/05 02:52:23 | 000,206,464 | ---- | M] (eMPIA Technology Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\etFilter.sys -- (FiltUSBET)

DRV - [2008/01/31 06:18:57 | 000,006,528 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\etScan.sys -- (ScanUSBET)

DRV - [2007/12/18 19:12:12 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)

DRV - [2007/09/06 03:43:49 | 000,474,624 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\etDevice.sys -- (DCamUSBET)

DRV - [2007/08/02 23:26:21 | 000,020,936 | ---- | M] () [Kernel | Auto] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)

DRV - [2007/07/30 13:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)

DRV - [2007/07/30 12:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)

DRV - [2007/07/24 13:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP)

DRV - [2007/06/16 23:29:08 | 000,146,824 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor)

DRV - [2006/12/14 02:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)

DRV - [2006/11/02 02:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)

DRV - [2005/09/23 15:18:32 | 000,171,520 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand] -- C:\Windows\System32\drivers\MarvinBus.sys -- (MarvinBus)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\ASUS_x72v_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKU\ASUS_x72v_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKU\ASUS_x72v_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\Nebelkrähe_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com

IE - HKU\Nebelkrähe_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.schnellsucher.com/?t=Q0908131707&s=h

IE - HKU\Nebelkrähe_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKU\Nebelkrähe_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledItems: multilinks@plugin:1.0.0.12

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/01/06 03:33:26 | 000,000,000 | ---D | M]

 

[2009/04/11 08:31:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS x72v\AppData\Roaming\Mozilla\Extensions

[2011/12/19 11:49:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS x72v\AppData\Roaming\Mozilla\Firefox\Profiles\fgey6id2.default\extensions

[2009/11/13 14:48:43 | 000,000,000 | ---D | M] (Multi Links) -- C:\Users\ASUS x72v\AppData\Roaming\Mozilla\Firefox\Profiles\fgey6id2.default\extensions\multilinks@plugin

[2011/12/19 11:49:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS x72v\AppData\Roaming\Mozilla\Firefox\Profiles\fgey6id2.default\extensions\staged

[2011/12/19 14:56:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

File not found (No name found) -- 

[2009/09/04 08:09:54 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION

[2011/05/03 21:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2011/07/11 16:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll

 

O1 HOSTS File: ([2012/01/09 17:25:27 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe ()

O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS)

O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe ()

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKU\ASUS_x72v_ON_C..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

O4 - HKU\Nebelkrähe_ON_C..\Run: [EPSON Stylus DX8400 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE (SEIKO EPSON CORPORATION)

O4 - HKU\Nebelkrähe_ON_C..\Run: [EPSON Stylus DX9400F Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICFE.EXE (SEIKO EPSON CORPORATION)

O4 - Startup: C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpbt0.dll.lnk = X:\I386\SYSTEM32\RUNDLL32.EXE (Microsoft Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\ASUS_x72v_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\ASUS_x72v_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\ASUS_x72v_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\ASUS_x72v_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKU\ASUS_x72v_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O7 - HKU\LocalService_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\Nebelkrähe_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\Nebelkrähe_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\Nebelkrähe_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKU\Nebelkrähe_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O7 - HKU\NetworkService_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\systemprofile_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)

O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)

O24 - Desktop WallPaper: 

O24 - Desktop BackupWallPaper: 

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012/01/11 15:07:07 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciseq.dll

[2012/01/11 15:07:05 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll

[2012/01/11 15:07:04 | 000,376,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll

[2012/01/11 15:07:02 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll

[2012/01/11 15:07:02 | 000,497,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll

[2012/01/09 14:42:47 | 000,000,000 | ---D | C] -- C:\Users\Nebelkrähe\AppData\Local\Ubisoft Game Launcher

[2012/01/09 12:50:27 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Nebelkrähe\Desktop\OTL.exe

[2012/01/07 12:59:15 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Roaming\SUPERAntiSpyware.com

[2012/01/07 12:58:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

[2012/01/07 12:58:11 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2012/01/07 12:58:11 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware

[2012/01/07 12:55:36 | 013,597,392 | ---- | C] (SUPERAntiSpyware.com) -- C:\Users\ASUS x72v\Desktop\SUPERAntiSpyware.exe

[2012/01/06 13:33:23 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Roaming\Online Solutions

[2012/01/06 09:48:05 | 004,704,768 | ---- | C] (AVAST Software) -- C:\Users\ASUS x72v\Desktop\aswMBR.exe

[2012/01/06 09:13:54 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2012/01/06 09:11:08 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\Desktop\osam_autorun_manager_5_0_portable

[2012/01/06 04:09:15 | 000,000,000 | ---D | C] -- C:\Users\Nebelkrähe\AppData\Local\temp

[2012/01/06 04:09:15 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Local\temp

[2012/01/06 04:08:42 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2012/01/06 03:56:46 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012/01/06 03:56:46 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012/01/06 03:56:46 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012/01/06 03:56:34 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2012/01/06 03:56:33 | 000,000,000 | ---D | C] -- C:\ComboFix

[2012/01/06 03:56:30 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012/01/06 03:34:12 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Local\DDMSettings

[2012/01/05 17:31:35 | 001,578,288 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\ASUS x72v\Desktop\tdsskiller.exe

[2012/01/05 17:11:18 | 000,000,000 | ---D | C] -- C:\_OTL

[2012/01/05 12:12:14 | 002,322,184 | ---- | C] (ESET) -- C:\Users\ASUS x72v\Desktop\esetsmartinstaller_enu.exe

[2012/01/05 12:02:34 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012/01/05 09:38:58 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Roaming\Malwarebytes

[2012/01/05 09:38:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012/01/05 09:38:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012/01/05 09:38:41 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012/01/05 09:38:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012/01/04 15:30:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

[2012/01/04 15:30:25 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip

[2012/01/04 13:49:41 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\ASUS x72v\Desktop\OTL.exe

[2012/01/03 16:56:53 | 000,000,000 | ---D | C] -- C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}

[2012/01/03 16:47:14 | 000,939,368 | ---- | C] (Macromedia, Inc.) -- C:\Windows\System32\flash.ocx

[2012/01/03 16:46:59 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Local\PackageAware

[2012/01/03 14:41:55 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll

[2012/01/03 14:41:54 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll

[2012/01/03 14:41:54 | 000,162,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll

[2012/01/03 14:41:54 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll

[2012/01/03 14:41:54 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe

[2012/01/03 14:41:54 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe

[2012/01/03 14:41:54 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll

[2012/01/03 14:41:54 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll

[2012/01/03 14:41:53 | 000,367,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec

[2012/01/03 14:41:53 | 000,353,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll

[2012/01/03 14:41:53 | 000,223,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll

[2012/01/03 14:41:52 | 003,695,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat

[2012/01/03 14:41:52 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl

[2012/01/03 14:41:52 | 000,434,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll

[2012/01/03 14:41:52 | 000,353,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll

[2012/01/03 14:41:52 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll

[2012/01/03 14:41:52 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe

[2012/01/03 14:41:52 | 000,078,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll

[2012/01/03 14:41:52 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll

[2012/01/03 14:41:52 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe

[2012/01/03 14:41:52 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll

[2012/01/03 14:41:52 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll

[2012/01/03 14:41:51 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb

[2012/01/03 14:41:51 | 001,798,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll

[2012/01/03 14:41:51 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll

[2012/01/03 14:41:51 | 000,580,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll

[2012/01/03 14:41:51 | 000,420,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll

[2012/01/03 14:41:51 | 000,227,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll

[2012/01/03 14:41:51 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll

[2012/01/03 14:41:51 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe

[2012/01/03 14:41:51 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe

[2012/01/03 14:41:51 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll

[2012/01/03 14:41:51 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll

[2012/01/03 14:41:51 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll

[2012/01/03 14:41:51 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll

[2012/01/03 14:41:50 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll

[2012/01/03 14:41:50 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll

[2012/01/03 14:41:50 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll

[2012/01/03 14:41:50 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe

[2012/01/02 17:34:36 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\Documents\ANNO 2070

[2012/01/02 16:48:12 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Local\Ubisoft Game Launcher

[2012/01/02 16:47:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Solidshield

[2012/01/02 16:37:01 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_7.dll

[2012/01/02 16:37:01 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_5.dll

[2012/01/02 16:37:00 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_43.dll

[2012/01/02 16:37:00 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_7.dll

[2012/01/02 16:36:59 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_43.dll

[2012/01/02 16:36:59 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_43.dll

[2012/01/02 16:36:59 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_43.dll

[2012/01/02 16:36:58 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_43.dll

[2012/01/02 16:36:58 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_6.dll

[2012/01/02 16:36:58 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_6.dll

[2012/01/02 16:36:58 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_4.dll

[2012/01/02 16:36:58 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_7.dll

[2012/01/02 16:36:57 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_5.dll

[2012/01/02 16:36:57 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_5.dll

[2012/01/02 16:36:56 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_42.dll

[2012/01/02 16:36:55 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_42.dll

[2012/01/02 16:36:54 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_42.dll

[2012/01/02 16:36:54 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_42.dll

[2012/01/02 16:36:53 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_42.dll

[2012/01/02 16:36:52 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_3.dll

[2012/01/02 16:36:50 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_3.dll

[2012/01/02 16:36:50 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_2.dll

[2012/01/02 16:36:49 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_3.dll

[2012/01/02 16:36:49 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_1.dll

[2012/01/02 16:36:49 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_5.dll

[2012/01/02 16:36:48 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_2.dll

[2012/01/02 16:36:48 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_2.dll

[2011/12/22 11:13:01 | 003,602,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe

[2011/12/22 11:13:01 | 003,550,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe

[2011/12/22 11:13:00 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll

[2011/12/22 11:13:00 | 000,217,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax

[2011/12/22 11:13:00 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Mpeg2Data.ax

[2011/12/22 11:13:00 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSDvbNP.ax

[2011/12/22 11:12:59 | 000,429,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll

[2011/12/22 11:12:27 | 002,043,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

[2011/12/22 11:12:24 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll

[2011/12/22 11:12:18 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll

[2011/12/22 11:12:09 | 000,555,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAutomationCore.dll

[2011/12/22 11:12:08 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oleaccrc.dll

[2011/12/22 10:40:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2011/12/22 10:40:21 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2011/12/22 09:30:32 | 000,000,000 | ---D | C] -- C:\Users\ASUS x72v\AppData\Roaming\Avira

[2011/12/19 15:35:56 | 000,000,000 | ---D | C] -- C:\Users\Nebelkrähe\AppData\Roaming\Avira

[2011/12/19 15:34:47 | 000,000,000 | ---D | C] -- C:\Users\Nebelkrähe\AppData\Local\Mozilla Firefox

[2011/12/19 15:30:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2011/12/19 15:30:24 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2011/12/19 15:30:23 | 000,134,856 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2011/12/19 15:30:23 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2011/12/19 15:30:23 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys

[2011/12/19 15:30:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2011/12/19 15:30:22 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2011/12/19 15:17:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2011/12/19 15:16:38 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe

[2011/12/19 15:16:38 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe

[2011/12/19 15:16:38 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe

[2008/06/03 01:41:51 | 000,015,928 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys

 
 ========== Files - Modified Within 30 Days ==========

 

[2012/01/12 16:00:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012/01/12 16:00:14 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2012/01/12 15:59:21 | 000,000,374 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics

[2012/01/12 15:59:12 | 000,121,244 | ---- | M] () -- C:\ProgramData\nvModes.001

[2012/01/12 15:59:07 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012/01/12 15:59:07 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012/01/12 15:58:57 | 3220,295,680 | -HS- | M] () -- C:\hiberfil.sys

[2012/01/12 15:08:05 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe

[2012/01/12 15:07:58 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012/01/12 11:05:10 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012/01/12 07:58:31 | 000,002,591 | ---- | M] () -- C:\Users\Nebelkrähe\Desktop\Microsoft Office Word 2007.lnk

[2012/01/12 03:54:52 | 000,017,626 | ---- | M] () -- C:\Users\Nebelkrähe\Documents\cc_20120112_095439.reg

[2012/01/10 01:40:48 | 000,121,244 | ---- | M] () -- C:\ProgramData\nvModes.dat

[2012/01/09 17:25:27 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts

[2012/01/09 12:50:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Nebelkrähe\Desktop\OTL.exe

[2012/01/07 12:58:15 | 000,001,767 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012/01/07 12:58:15 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

[2012/01/07 12:55:39 | 013,597,392 | ---- | M] (SUPERAntiSpyware.com) -- C:\Users\ASUS x72v\Desktop\SUPERAntiSpyware.exe

[2012/01/06 13:16:42 | 000,019,456 | ---- | M] () -- C:\Users\ASUS x72v\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012/01/06 09:48:09 | 004,704,768 | ---- | M] (AVAST Software) -- C:\Users\ASUS x72v\Desktop\aswMBR.exe

[2012/01/06 09:40:35 | 331,832,016 | ---- | M] () -- C:\Windows\MEMORY.DMP

[2012/01/06 03:42:18 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012/01/06 03:42:18 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012/01/06 03:42:18 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012/01/06 03:42:18 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012/01/06 03:32:50 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX Plus

[2012/01/05 17:31:31 | 001,578,288 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\ASUS x72v\Desktop\tdsskiller.exe

[2012/01/05 12:12:00 | 002,322,184 | ---- | M] (ESET) -- C:\Users\ASUS x72v\Desktop\esetsmartinstaller_enu.exe

[2012/01/05 09:38:43 | 000,000,873 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012/01/05 09:38:43 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012/01/05 07:30:42 | 000,000,378 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20120105_133037.reg

[2012/01/05 03:38:04 | 000,003,202 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20120105_093755.reg

[2012/01/04 15:30:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

[2012/01/04 14:08:31 | 000,302,592 | ---- | M] () -- C:\Users\ASUS x72v\Desktop\lovg4e3u.exe

[2012/01/04 13:49:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\ASUS x72v\Desktop\OTL.exe

[2012/01/04 13:44:46 | 000,050,477 | ---- | M] () -- C:\Users\ASUS x72v\Desktop\Defogger.exe

[2012/01/03 17:14:52 | 000,000,910 | ---- | M] () -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

[2012/01/03 16:58:52 | 000,040,046 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20120103_225837.reg

[2012/01/03 16:08:51 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Daedalic Entertainment

[2012/01/03 16:06:25 | 000,000,067 | ---- | M] () -- C:\Windows\wininit.ini

[2012/01/03 16:05:01 | 000,000,341 | ---- | M] () -- C:\Windows\SIERRA.INI

[2012/01/03 16:04:59 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sierra

[2012/01/03 14:55:28 | 000,000,910 | ---- | M] () -- C:\Users\ASUS x72v\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

[2012/01/03 14:49:54 | 000,450,704 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012/01/03 14:43:46 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

[2012/01/03 14:42:03 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat

[2012/01/03 14:42:03 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat

[2012/01/03 14:41:55 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll

[2012/01/03 14:41:54 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll

[2012/01/03 14:41:54 | 000,162,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll

[2012/01/03 14:41:54 | 000,086,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll

[2012/01/03 14:41:54 | 000,076,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe

[2012/01/03 14:41:54 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe

[2012/01/03 14:41:54 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll

[2012/01/03 14:41:54 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll

[2012/01/03 14:41:53 | 000,367,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\html.iec

[2012/01/03 14:41:53 | 000,353,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll

[2012/01/03 14:41:53 | 000,223,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll

[2012/01/03 14:41:52 | 003,695,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat

[2012/01/03 14:41:52 | 001,427,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl

[2012/01/03 14:41:52 | 000,434,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll

[2012/01/03 14:41:52 | 000,353,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll

[2012/01/03 14:41:52 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\url.dll

[2012/01/03 14:41:52 | 000,152,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe

[2012/01/03 14:41:52 | 000,078,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll

[2012/01/03 14:41:52 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll

[2012/01/03 14:41:52 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe

[2012/01/03 14:41:52 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf

[2012/01/03 14:41:52 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll

[2012/01/03 14:41:52 | 000,023,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll

[2012/01/03 14:41:51 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb

[2012/01/03 14:41:51 | 001,798,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll

[2012/01/03 14:41:51 | 000,716,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll

[2012/01/03 14:41:51 | 000,580,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll

[2012/01/03 14:41:51 | 000,420,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll

[2012/01/03 14:41:51 | 000,227,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll

[2012/01/03 14:41:51 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll

[2012/01/03 14:41:51 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe

[2012/01/03 14:41:51 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe

[2012/01/03 14:41:51 | 000,118,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll

[2012/01/03 14:41:51 | 000,101,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll

[2012/01/03 14:41:51 | 000,054,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll

[2012/01/03 14:41:51 | 000,035,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll

[2012/01/03 14:41:50 | 000,130,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll

[2012/01/03 14:41:50 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll

[2012/01/03 14:41:50 | 000,041,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll

[2012/01/03 14:41:50 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe

[2011/12/22 10:48:05 | 000,000,206 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164801.reg

[2011/12/22 10:47:39 | 000,005,888 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164734.reg

[2011/12/22 10:47:08 | 000,014,124 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164703.reg

[2011/12/22 10:46:24 | 000,218,176 | ---- | M] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164557.reg

[2011/12/22 10:40:22 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2011/12/22 09:36:12 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox

[2011/12/22 09:11:01 | 000,000,871 | ---- | M] () -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpbt0.dll.lnk

[2011/12/19 15:34:48 | 000,000,921 | ---- | M] () -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

[2011/12/19 15:34:48 | 000,000,919 | ---- | M] () -- C:\Users\Nebelkrähe\Desktop\Mozilla Firefox.lnk

[2011/12/19 15:30:36 | 000,001,814 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2011/12/19 15:30:36 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2011/12/19 14:57:23 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft

 
 ========== Files Created - No Company Name ==========

 

[2012/01/12 03:54:41 | 000,017,626 | ---- | C] () -- C:\Users\Nebelkrähe\Documents\cc_20120112_095439.reg

[2012/01/07 12:58:15 | 000,001,767 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012/01/06 09:40:35 | 331,832,016 | ---- | C] () -- C:\Windows\MEMORY.DMP

[2012/01/06 03:56:46 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012/01/06 03:56:46 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012/01/06 03:56:46 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012/01/06 03:56:46 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012/01/06 03:56:46 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012/01/05 09:38:43 | 000,000,873 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012/01/05 07:30:40 | 000,000,378 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20120105_133037.reg

[2012/01/05 03:38:01 | 000,003,202 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20120105_093755.reg

[2012/01/04 14:08:30 | 000,302,592 | ---- | C] () -- C:\Users\ASUS x72v\Desktop\lovg4e3u.exe

[2012/01/04 13:44:45 | 000,050,477 | ---- | C] () -- C:\Users\ASUS x72v\Desktop\Defogger.exe

[2012/01/03 16:58:42 | 000,040,046 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20120103_225837.reg

[2012/01/03 16:06:25 | 000,000,067 | ---- | C] () -- C:\Windows\wininit.ini

[2012/01/03 14:41:52 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf

[2011/12/22 10:48:03 | 000,000,206 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164801.reg

[2011/12/22 10:47:36 | 000,005,888 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164734.reg

[2011/12/22 10:47:05 | 000,014,124 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164703.reg

[2011/12/22 10:46:07 | 000,218,176 | ---- | C] () -- C:\Users\ASUS x72v\Documents\cc_20111222_164557.reg

[2011/12/22 09:11:01 | 000,000,871 | ---- | C] () -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpbt0.dll.lnk

[2011/12/19 15:34:48 | 000,000,927 | ---- | C] () -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2011/12/19 15:34:48 | 000,000,921 | ---- | C] () -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

[2011/12/19 15:34:48 | 000,000,919 | ---- | C] () -- C:\Users\Nebelkrähe\Desktop\Mozilla Firefox.lnk

[2011/12/19 15:30:36 | 000,001,814 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2011/12/18 17:23:29 | 3220,295,680 | -HS- | C] () -- C:\hiberfil.sys

[2011/08/18 15:00:49 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat

[2011/01/23 08:36:37 | 000,000,341 | ---- | C] () -- C:\Windows\SIERRA.INI

[2009/12/26 11:30:57 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys

[2009/12/26 11:30:57 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys

[2009/11/22 13:56:21 | 000,000,016 | ---- | C] () -- C:\Windows\popcinfo.dat

[2009/10/01 11:02:49 | 000,004,907 | ---- | C] () -- C:\ProgramData\ypkpiykb.yyr

[2009/09/14 09:40:53 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009/09/14 09:40:53 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009/08/13 14:06:07 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2009/08/13 10:44:57 | 000,000,081 | -HS- | C] () -- C:\ProgramData\.zreglib

[2009/05/09 19:32:00 | 000,136,704 | ---- | C] () -- C:\Users\Nebelkrähe\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009/04/11 08:17:22 | 000,007,592 | ---- | C] () -- C:\Users\Nebelkrähe\AppData\Local\d3d9caps.dat

[2009/02/27 03:57:49 | 000,000,680 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\d3d9caps.dat

[2009/02/07 09:04:06 | 000,024,206 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Roaming\UserTile.png

[2009/01/15 12:16:05 | 000,019,456 | ---- | C] () -- C:\Users\ASUS x72v\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008/12/13 06:37:56 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini

[2008/12/06 04:04:44 | 000,121,244 | ---- | C] () -- C:\ProgramData\nvModes.001

[2008/12/05 14:29:39 | 000,121,244 | ---- | C] () -- C:\ProgramData\nvModes.dat

[2008/10/09 02:41:14 | 000,000,024 | ---- | C] () -- C:\Windows\System32\ChkMail.ini

[2008/10/09 02:40:56 | 000,045,056 | ---- | C] () -- C:\Windows\System32\acovcnt.exe

[2008/10/09 02:30:30 | 000,047,672 | ---- | C] () -- C:\Windows\AsScrProlog.exe

[2008/10/09 01:06:39 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2008/10/09 00:16:03 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat

[2008/07/01 21:28:38 | 000,061,440 | ---- | C] () -- C:\Program Files\Common Files\CPInstallAction.dll

[2008/05/22 11:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files\Common Files\banner.jpg

[2008/04/16 06:11:34 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2008/04/16 06:11:34 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2008/04/16 06:11:34 | 000,126,454 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2008/04/16 06:11:34 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2008/04/16 05:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini

[2007/04/16 05:24:16 | 000,023,752 | ---- | C] () -- C:\Windows\System32\providers.bin

[2007/03/06 01:39:19 | 000,049,152 | ---- | C] () -- C:\Windows\revdevdll.dll

[2006/11/02 07:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006/11/02 07:47:37 | 000,450,704 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006/11/02 05:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006/11/02 05:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006/11/02 05:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006/11/02 05:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006/11/02 05:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006/11/02 03:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006/11/02 03:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006/11/02 02:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2006/03/08 20:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2005/04/02 18:29:59 | 000,110,592 | R--- | C] () -- C:\Windows\System32\scardsyn.dll

[2001/11/14 15:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

[1998/05/05 23:09:59 | 000,069,632 | R--- | C] () -- C:\Windows\System32\ODMA32.dll

 
 ========== LOP Check ==========

 

[2010/12/23 17:58:49 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\FreeAudioPack

[2011/01/18 15:02:01 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\GOA

[2012/01/06 13:37:00 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Online Solutions

[2009/02/07 09:04:06 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\PeerNetworking

[2011/05/07 03:51:25 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\ScummVM

[2012/01/02 16:38:39 | 000,000,000 | ---D | M] -- C:\Users\ASUS x72v\AppData\Roaming\Ubisoft

[2011/07/01 08:47:52 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant

[2011/08/18 15:04:31 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Daedalic Entertainment

[2011/03/19 04:50:57 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\elsterformular

[2010/07/16 10:25:05 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\EPSON

[2010/12/23 18:01:32 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\FreeAudioPack

[2009/10/04 06:59:42 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\GetRightToGo

[2011/01/19 10:33:46 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\GOA

[2009/08/10 09:11:00 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\My Games

[2011/05/07 04:26:56 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\ScummVM

[2009/08/13 06:56:14 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Sega

[2012/01/09 14:42:39 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Ubisoft

[2011/11/25 13:57:41 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\WB Games

[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data

[2008/12/13 05:51:23 | 000,000,000 | ---D | M] -- C:\ProgramData\ASUS

[2009/05/13 14:59:33 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonBJ

[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop

[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents

[2011/03/19 04:48:11 | 000,000,000 | ---D | M] -- C:\ProgramData\elsterformular

[2010/09/07 08:19:28 | 000,000,000 | ---D | M] -- C:\ProgramData\EPSON

[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites

[2011/01/18 15:02:01 | 000,000,000 | ---D | M] -- C:\ProgramData\GOA

[2010/10/18 15:44:54 | 000,000,000 | ---D | M] -- C:\ProgramData\InterAction studios

[2009/06/10 14:16:01 | 000,000,000 | ---D | M] -- C:\ProgramData\LightScribe

[2008/10/09 02:29:40 | 000,000,000 | ---D | M] -- C:\ProgramData\P4G

[2009/10/04 07:35:28 | 000,000,000 | ---D | M] -- C:\ProgramData\Pinnacle

[2009/10/04 07:36:02 | 000,000,000 | ---D | M] -- C:\ProgramData\Pinnacle Studio HD

[2009/10/04 07:29:38 | 000,000,000 | ---D | M] -- C:\ProgramData\Pinnacle Studio Plus

[2009/10/02 05:41:35 | 000,000,000 | ---D | M] -- C:\ProgramData\SlySoft

[2012/01/02 16:47:29 | 000,000,000 | ---D | M] -- C:\ProgramData\Solidshield

[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu

[2009/10/04 07:29:38 | 000,000,000 | ---D | M] -- C:\ProgramData\Studio 14

[2009/12/26 12:40:33 | 000,000,000 | ---D | M] -- C:\ProgramData\Tages

[2008/10/09 00:37:42 | 000,000,000 | ---D | M] -- C:\ProgramData\Temp

[2006/11/02 08:02:04 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates

[2008/10/09 00:31:03 | 000,000,000 | ---D | M] -- C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}

[2012/01/03 16:56:53 | 000,000,000 | ---D | M] -- C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}

[2012/01/12 16:00:14 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

< End of report >

Mann, ich hoffe, dass du diesmal was sehen kannst. :-/

cosinus

13.01.2012 16:37

Zitat:

Dieser hat keine Admin-Rechte. Aber vielleicht liegt es daran, dass ich die Programme generell nicht ohne Admin-Rechte öffnen kann?

Ja daran liegt es. Wenn der keine Adminrechte hat, führt ein anderer User das eben aus und schon kannst du nicht mehr sehen, was userbezogen für "nebelkrähe" ist. Gib diesem User temporär Adminrechte, log diese wieder neu mit diesem Nebenkrähe User ein und mach neue Logs mit OTL und OSAM

nightingale7

16.01.2012 20:57

Juhu, endlich sind wir zumindest dem Problem mit den Admin-Rechten auf die Spur gekommen. ;)

Neuestes OTL-Log:

Code:

OTL logfile created on: 16.01.2012 20:43:11 - Run 12

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Nebelkrähe\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,88 Gb Available Physical Memory | 62,55% Memory free

6,19 Gb Paging File | 5,00 Gb Available in Paging File | 80,78% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 149,04 Gb Total Space | 82,56 Gb Free Space | 55,40% Space Free | Partition Type: NTFS

Drive D: | 139,28 Gb Total Space | 28,20 Gb Free Space | 20,24% Space Free | Partition Type: NTFS

Drive E: | 4,61 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: ASUSX72V-PC | User Name: Nebelkrähe | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.01.09 18:50:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Nebelkrähe\Desktop\OTL.exe

PRC - [2011.12.09 12:40:20 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.12.09 12:40:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2011.12.09 12:39:54 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.12.09 12:39:54 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.08.12 00:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe

PRC - [2011.07.29 00:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe

PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008.10.09 08:30:20 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe

PRC - [2008.07.15 19:29:00 | 007,651,328 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe

PRC - [2008.07.15 19:22:46 | 000,217,088 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControl.exe

PRC - [2008.07.10 01:09:26 | 000,191,032 | ---- | M] (ATK) -- C:\Program Files\P4G\BatteryLife.exe

PRC - [2008.06.25 03:01:08 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Media\DMedia.exe

PRC - [2008.06.24 04:16:24 | 002,482,176 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe

PRC - [2008.06.19 20:18:12 | 000,154,168 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ASUS CopyProtect\ASPG.exe

PRC - [2008.06.18 06:10:24 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files\ASUS\SmartLogon\sensorsrv.exe

PRC - [2008.06.13 06:52:51 | 006,183,456 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2008.06.04 01:29:08 | 000,851,968 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe

PRC - [2008.04.10 19:32:18 | 000,752,168 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

PRC - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe

PRC - [2008.01.23 18:51:28 | 000,151,552 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\WDC.exe

PRC - [2008.01.12 06:40:10 | 000,098,304 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

PRC - [2007.11.30 19:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe

PRC - [2007.11.05 03:48:06 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe

PRC - [2007.10.03 05:53:00 | 000,094,208 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe

PRC - [2007.08.15 19:20:16 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe

PRC - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe

PRC - [2007.08.03 20:24:54 | 000,125,496 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

PRC - [2007.07.06 00:53:44 | 001,040,384 | ---- | M] () -- C:\Program Files\Wireless Console 2\wcourier.exe

PRC - [2005.07.06 23:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.07.29 00:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll

MOD - [2011.07.29 00:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe

MOD - [2008.09.16 19:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll

MOD - [2008.04.10 19:25:54 | 000,126,976 | ---- | M] () -- C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll

MOD - [2008.01.12 06:40:10 | 000,098,304 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

MOD - [2007.11.30 19:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe

MOD - [2007.11.12 23:41:50 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\MsgTran.dll

MOD - [2007.08.14 21:59:54 | 006,365,184 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtGui4.dll

MOD - [2007.07.12 21:55:52 | 000,131,072 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll

MOD - [2007.07.12 21:55:28 | 001,581,056 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtCore4.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.12.09 12:40:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.12.09 12:39:54 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.08.12 00:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)

SRV - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)

SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.10.03 05:53:00 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService)

SRV - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)

SRV - [2007.08.03 20:24:54 | 000,125,496 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.12.09 12:40:20 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.12.09 12:40:20 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.12.09 12:40:20 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2011.07.22 17:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)

DRV - [2011.07.12 22:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.12.26 17:30:57 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2009.12.26 17:30:57 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2009.05.28 21:41:28 | 004,233,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)

DRV - [2008.06.25 15:58:59 | 007,534,720 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2008.06.25 15:58:59 | 000,043,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)

DRV - [2008.06.03 07:41:51 | 000,015,928 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)

DRV - [2008.05.29 18:21:02 | 000,015,416 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\lullaby.sys -- (lullaby)

DRV - [2008.05.20 01:15:42 | 000,061,424 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Program Files\ASUS\AI TouchMedia\PlayMovie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})

DRV - [2008.05.02 06:59:39 | 000,122,368 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2008.03.21 05:12:59 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2008.02.16 01:42:42 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)

DRV - [2008.02.05 08:52:23 | 000,206,464 | ---- | M] (eMPIA Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etFilter.sys -- (FiltUSBET)

DRV - [2008.01.31 12:18:57 | 000,006,528 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etScan.sys -- (ScanUSBET)

DRV - [2007.12.19 01:12:12 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)

DRV - [2007.09.06 09:43:49 | 000,474,624 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etDevice.sys -- (DCamUSBET)

DRV - [2007.08.03 05:26:21 | 000,020,936 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)

DRV - [2007.07.30 19:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)

DRV - [2007.07.30 18:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)

DRV - [2007.07.24 19:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP)

DRV - [2007.06.17 05:29:08 | 000,146,824 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor)

DRV - [2006.12.14 08:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)

DRV - [2006.11.02 08:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)

DRV - [2005.09.23 21:18:32 | 000,171,520 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MarvinBus.sys -- (MarvinBus)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.schnellsucher.com/?t=Q0908131707&s=h

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "www.google.de"

FF - prefs.js..extensions.enabledItems: {59c81df5-4b7a-477b-912d-4e0fdf64e5f2}:0.9.86.1

FF - prefs.js..extensions.enabledItems: {3d7eb24f-2740-49df-8937-200b1cc08f8a}:1.5.15.1

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: multilinks@plugin:3.0.0.16

FF - prefs.js..extensions.enabledItems: {888d99e7-e8b5-46a3-851e-1ec45da1e644}:4.0.3

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.01.06 09:33:26 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Users\Nebelkrähe\AppData\Local\Mozilla Firefox\components [2011.12.23 08:47:37 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Users\Nebelkrähe\AppData\Local\Mozilla Firefox\plugins

 

[2009.04.11 15:06:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nebelkrähe\AppData\Roaming\mozilla\Extensions

[2012.01.03 23:15:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nebelkrähe\AppData\Roaming\mozilla\Firefox\Profiles\rv376t07.default\extensions

[2011.03.19 10:26:14 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Nebelkrähe\AppData\Roaming\mozilla\Firefox\Profiles\rv376t07.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.07.18 13:16:57 | 000,000,000 | ---D | M] (Flashblock) -- C:\Users\Nebelkrähe\AppData\Roaming\mozilla\Firefox\Profiles\rv376t07.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}

[2011.12.23 08:47:41 | 000,000,000 | ---D | M] (ChatZilla) -- C:\Users\Nebelkrähe\AppData\Roaming\mozilla\Firefox\Profiles\rv376t07.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}

[2009.08.13 16:26:14 | 000,002,375 | ---- | M] () -- C:\Users\Nebelkrähe\AppData\Roaming\Mozilla\Firefox\Profiles\rv376t07.default\searchplugins\Schnell Sucher.xml

[2011.12.19 20:56:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

File not found (No name found) -- C:\USERS\NEBELKRÃ¤HE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\EXTENSIONS\{3D7EB24F-2740-49DF-8937-200B1CC08F8A}

File not found (No name found) -- C:\USERS\NEBELKRÃ¤HE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\EXTENSIONS\{59C81DF5-4B7A-477B-912D-4E0FDF64E5F2}

File not found (No name found) -- C:\USERS\NEBELKRÃ¤HE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\EXTENSIONS\{888D99E7-E8B5-46A3-851E-1EC45DA1E644}.XPI

File not found (No name found) -- C:\USERS\NEBELKRÃ¤HE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\EXTENSIONS\MULTILINKS@PLUGIN.XPI

File not found (No name found) -- C:\USERS\NEBELKRÃ¤HE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\EXTENSIONS\OLDFACTORY_OPTIONS@WWW.THEME-OASIS.ORG.XPI

[2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2011.07.11 22:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll

CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL

CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\pdf.dll

CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll

CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll

CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: YouTube = C:\Users\Nebelkrähe\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.3_0\

CHR - Extension: Google-Suche = C:\Users\Nebelkrähe\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\

CHR - Extension: Snap Links Lite = C:\Users\Nebelkrähe\AppData\Local\Google\Chrome\User Data\Default\Extensions\idmmhhijggcmbeejedibpdcahpkneegg\1.2.4_0\

CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\Nebelkrähe\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\

CHR - Extension: Google Mail = C:\Users\Nebelkrähe\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

 

O1 HOSTS File: ([2012.01.09 23:25:27 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe ()

O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS)

O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe ()

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKCU..\Run: [EPSON Stylus DX8400 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE (SEIKO EPSON CORPORATION)

O4 - HKCU..\Run: [EPSON Stylus DX9400F Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICFE.EXE (SEIKO EPSON CORPORATION)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)

O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B8A7E2A5-BF27-4014-93AD-F1B3729F6DCE}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EC2AFD73-5775-499D-8010-29CA5974B896}: DhcpNameServer = 192.168.2.1

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)

O24 - Desktop WallPaper: C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2011.10.10 14:54:08 | 002,290,144 | R--- | M] () - E:\Autorun.exe -- [ CDFS ]

O32 - AutoRun File - [2011.10.09 15:23:34 | 000,000,047 | R--- | M] () - E:\Autorun.inf -- [ CDFS ]

O32 - AutoRun File - [2011.10.09 15:23:34 | 000,224,630 | R--- | M] () - E:\autorun.ico -- [ CDFS ]

O33 - MountPoints2\{aa57d325-d666-11de-8854-0023543d4c06}\Shell - "" = AutoRun

O33 - MountPoints2\{aa57d325-d666-11de-8854-0023543d4c06}\Shell\AutoRun\command - "" = F:\setup.exe AUTORUN=1

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.01.11 21:07:07 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciseq.dll

[2012.01.11 21:07:05 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll

[2012.01.11 21:07:04 | 000,376,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll

[2012.01.11 21:07:02 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll

[2012.01.11 21:07:02 | 000,497,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll

[2012.01.09 20:42:47 | 000,000,000 | ---D | C] -- C:\Users\Nebelkrähe\AppData\Local\Ubisoft Game Launcher

[2012.01.09 18:50:27 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Nebelkrähe\Desktop\OTL.exe

[2012.01.07 18:58:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

[2012.01.07 18:58:11 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2012.01.07 18:58:11 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware

[2012.01.06 15:13:54 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2012.01.06 10:09:15 | 000,000,000 | ---D | C] -- C:\Users\Nebelkrähe\AppData\Local\temp

[2012.01.06 10:08:42 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2012.01.06 09:56:46 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012.01.06 09:56:46 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012.01.06 09:56:46 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012.01.06 09:56:34 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2012.01.06 09:56:33 | 000,000,000 | ---D | C] -- C:\ComboFix

[2012.01.06 09:56:30 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012.01.05 23:11:18 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.01.05 18:02:34 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.01.05 15:38:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.01.05 15:38:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.01.05 15:38:41 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.01.05 15:38:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.01.04 21:30:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

[2012.01.04 21:30:25 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip

[2012.01.03 22:56:53 | 000,000,000 | ---D | C] -- C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}

[2012.01.03 22:47:14 | 000,939,368 | ---- | C] (Macromedia, Inc.) -- C:\Windows\System32\flash.ocx

[2012.01.03 20:41:55 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll

[2012.01.03 20:41:54 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll

[2012.01.03 20:41:54 | 000,162,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll

[2012.01.03 20:41:54 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll

[2012.01.03 20:41:54 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe

[2012.01.03 20:41:54 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe

[2012.01.03 20:41:54 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll

[2012.01.03 20:41:54 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll

[2012.01.03 20:41:53 | 000,367,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec

[2012.01.03 20:41:53 | 000,353,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll

[2012.01.03 20:41:53 | 000,223,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll

[2012.01.03 20:41:52 | 003,695,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat

[2012.01.03 20:41:52 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl

[2012.01.03 20:41:52 | 000,434,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll

[2012.01.03 20:41:52 | 000,353,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll

[2012.01.03 20:41:52 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll

[2012.01.03 20:41:52 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe

[2012.01.03 20:41:52 | 000,078,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll

[2012.01.03 20:41:52 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll

[2012.01.03 20:41:52 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe

[2012.01.03 20:41:52 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll

[2012.01.03 20:41:52 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll

[2012.01.03 20:41:51 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb

[2012.01.03 20:41:51 | 001,798,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll

[2012.01.03 20:41:51 | 000,580,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll

[2012.01.03 20:41:51 | 000,227,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll

[2012.01.03 20:41:51 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll

[2012.01.03 20:41:51 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe

[2012.01.03 20:41:51 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe

[2012.01.03 20:41:51 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll

[2012.01.03 20:41:51 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll

[2012.01.03 20:41:51 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll

[2012.01.03 20:41:51 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll

[2012.01.03 20:41:50 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll

[2012.01.03 20:41:50 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll

[2012.01.03 20:41:50 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll

[2012.01.03 20:41:50 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe

[2012.01.02 22:47:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Solidshield

[2012.01.02 22:37:01 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_7.dll

[2012.01.02 22:37:01 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_5.dll

[2012.01.02 22:37:00 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_43.dll

[2012.01.02 22:37:00 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_7.dll

[2012.01.02 22:36:59 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_43.dll

[2012.01.02 22:36:59 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_43.dll

[2012.01.02 22:36:59 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_43.dll

[2012.01.02 22:36:58 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_43.dll

[2012.01.02 22:36:58 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_6.dll

[2012.01.02 22:36:58 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_6.dll

[2012.01.02 22:36:58 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_4.dll

[2012.01.02 22:36:58 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_7.dll

[2012.01.02 22:36:57 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_5.dll

[2012.01.02 22:36:57 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_5.dll

[2012.01.02 22:36:56 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_42.dll

[2012.01.02 22:36:55 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_42.dll

[2012.01.02 22:36:54 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_42.dll

[2012.01.02 22:36:54 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_42.dll

[2012.01.02 22:36:53 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_42.dll

[2012.01.02 22:36:52 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_3.dll

[2012.01.02 22:36:50 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_3.dll

[2012.01.02 22:36:50 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_2.dll

[2012.01.02 22:36:49 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_3.dll

[2012.01.02 22:36:49 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_1.dll

[2012.01.02 22:36:49 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_5.dll

[2012.01.02 22:36:48 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_2.dll

[2012.01.02 22:36:48 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_2.dll

[2011.12.22 17:13:01 | 003,602,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe

[2011.12.22 17:13:01 | 003,550,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe

[2011.12.22 17:13:00 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll

[2011.12.22 17:13:00 | 000,217,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax

[2011.12.22 17:13:00 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Mpeg2Data.ax

[2011.12.22 17:13:00 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSDvbNP.ax

[2011.12.22 17:12:59 | 000,429,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll

[2011.12.22 17:12:27 | 002,043,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

[2011.12.22 17:12:24 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll

[2011.12.22 17:12:18 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll

[2011.12.22 17:12:09 | 000,555,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAutomationCore.dll

[2011.12.22 17:12:08 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oleaccrc.dll

[2011.12.22 16:40:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2011.12.22 16:40:21 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2011.12.19 21:35:56 | 000,000,000 | ---D | C] -- C:\Users\Nebelkrähe\AppData\Roaming\Avira

[2011.12.19 21:34:47 | 000,000,000 | ---D | C] -- C:\Users\Nebelkrähe\AppData\Local\Mozilla Firefox

[2011.12.19 21:30:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2011.12.19 21:30:24 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2011.12.19 21:30:23 | 000,134,856 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2011.12.19 21:30:23 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2011.12.19 21:30:23 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys

[2011.12.19 21:30:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2011.12.19 21:30:22 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2011.12.19 21:17:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2011.12.19 21:16:38 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe

[2011.12.19 21:16:38 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe

[2011.12.19 21:16:38 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe

[2008.06.03 07:41:51 | 000,015,928 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.01.16 20:05:00 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.01.16 19:10:09 | 000,121,244 | ---- | M] () -- C:\ProgramData\nvModes.001

[2012.01.16 19:10:07 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.01.16 19:10:06 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.01.16 19:10:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.01.16 14:09:41 | 000,002,591 | ---- | M] () -- C:\Users\Nebelkrähe\Desktop\Microsoft Office Word 2007.lnk

[2012.01.16 13:58:24 | 000,000,374 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics

[2012.01.16 13:58:12 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.01.16 13:57:46 | 3218,247,680 | -HS- | M] () -- C:\hiberfil.sys

[2012.01.15 21:45:25 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2012.01.15 12:12:21 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe

[2012.01.15 12:10:17 | 000,001,010 | RHS- | M] () -- C:\Users\Nebelkrähe\ntuser.pol

[2012.01.12 09:54:52 | 000,017,626 | ---- | M] () -- C:\Users\Nebelkrähe\Documents\cc_20120112_095439.reg

[2012.01.10 07:40:48 | 000,121,244 | ---- | M] () -- C:\ProgramData\nvModes.dat

[2012.01.09 23:25:27 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts

[2012.01.09 18:50:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Nebelkrähe\Desktop\OTL.exe

[2012.01.06 09:42:18 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.01.06 09:42:18 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.01.06 09:42:18 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.01.06 09:42:18 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.01.03 22:06:25 | 000,000,067 | ---- | M] () -- C:\Windows\wininit.ini

[2012.01.03 22:05:01 | 000,000,341 | ---- | M] () -- C:\Windows\SIERRA.INI

[2012.01.03 20:49:54 | 000,450,704 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.01.03 20:42:03 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat

[2012.01.03 20:42:03 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat

[2012.01.03 20:41:55 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll

[2012.01.03 20:41:54 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll

[2012.01.03 20:41:54 | 000,162,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll

[2012.01.03 20:41:54 | 000,086,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll

[2012.01.03 20:41:54 | 000,076,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe

[2012.01.03 20:41:54 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe

[2012.01.03 20:41:54 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll

[2012.01.03 20:41:54 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll

[2012.01.03 20:41:53 | 000,367,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\html.iec

[2012.01.03 20:41:53 | 000,353,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll

[2012.01.03 20:41:53 | 000,223,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll

[2012.01.03 20:41:52 | 003,695,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat

[2012.01.03 20:41:52 | 001,427,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl

[2012.01.03 20:41:52 | 000,434,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll

[2012.01.03 20:41:52 | 000,353,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll

[2012.01.03 20:41:52 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\url.dll

[2012.01.03 20:41:52 | 000,152,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe

[2012.01.03 20:41:52 | 000,078,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll

[2012.01.03 20:41:52 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll

[2012.01.03 20:41:52 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe

[2012.01.03 20:41:52 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf

[2012.01.03 20:41:52 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll

[2012.01.03 20:41:52 | 000,023,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll

[2012.01.03 20:41:51 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb

[2012.01.03 20:41:51 | 001,798,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll

[2012.01.03 20:41:51 | 000,580,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll

[2012.01.03 20:41:51 | 000,227,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll

[2012.01.03 20:41:51 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll

[2012.01.03 20:41:51 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe

[2012.01.03 20:41:51 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe

[2012.01.03 20:41:51 | 000,118,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll

[2012.01.03 20:41:51 | 000,101,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll

[2012.01.03 20:41:51 | 000,054,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll

[2012.01.03 20:41:51 | 000,035,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll

[2012.01.03 20:41:50 | 000,130,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll

[2012.01.03 20:41:50 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll

[2012.01.03 20:41:50 | 000,041,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll

[2012.01.03 20:41:50 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe

[2011.12.22 15:11:01 | 000,000,871 | ---- | M] () -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpbt0.dll.lnk

[2011.12.19 21:34:48 | 000,000,919 | ---- | M] () -- C:\Users\Nebelkrähe\Desktop\Mozilla Firefox.lnk

 
 ========== Files Created - No Company Name ==========

 

[2012.01.12 09:54:41 | 000,017,626 | ---- | C] () -- C:\Users\Nebelkrähe\Documents\cc_20120112_095439.reg

[2012.01.06 09:56:46 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012.01.06 09:56:46 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012.01.06 09:56:46 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012.01.06 09:56:46 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012.01.06 09:56:46 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012.01.03 22:06:25 | 000,000,067 | ---- | C] () -- C:\Windows\wininit.ini

[2012.01.03 20:41:52 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf

[2011.12.22 15:11:01 | 000,000,871 | ---- | C] () -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpbt0.dll.lnk

[2011.12.19 21:34:48 | 000,000,927 | ---- | C] () -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2011.12.19 21:34:48 | 000,000,919 | ---- | C] () -- C:\Users\Nebelkrähe\Desktop\Mozilla Firefox.lnk

[2011.12.18 23:23:29 | 3218,247,680 | -HS- | C] () -- C:\hiberfil.sys

[2011.08.18 21:00:49 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat

[2011.01.23 14:36:37 | 000,000,341 | ---- | C] () -- C:\Windows\SIERRA.INI

[2009.12.26 17:30:57 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys

[2009.12.26 17:30:57 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys

[2009.11.22 19:56:21 | 000,000,016 | ---- | C] () -- C:\Windows\popcinfo.dat

[2009.10.01 17:02:49 | 000,004,907 | ---- | C] () -- C:\ProgramData\ypkpiykb.yyr

[2009.09.14 15:40:53 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009.09.14 15:40:53 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009.08.13 20:06:07 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2009.08.13 16:44:57 | 000,000,081 | -HS- | C] () -- C:\ProgramData\.zreglib

[2009.05.10 01:32:00 | 000,136,704 | ---- | C] () -- C:\Users\Nebelkrähe\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.04.11 14:17:22 | 000,007,592 | ---- | C] () -- C:\Users\Nebelkrähe\AppData\Local\d3d9caps.dat

[2008.12.13 12:37:56 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini

[2008.12.06 10:04:44 | 000,121,244 | ---- | C] () -- C:\ProgramData\nvModes.001

[2008.12.05 20:29:39 | 000,121,244 | ---- | C] () -- C:\ProgramData\nvModes.dat

[2008.10.09 08:41:14 | 000,000,024 | ---- | C] () -- C:\Windows\System32\ChkMail.ini

[2008.10.09 08:40:56 | 000,045,056 | ---- | C] () -- C:\Windows\System32\acovcnt.exe

[2008.10.09 08:30:30 | 000,047,672 | ---- | C] () -- C:\Windows\AsScrProlog.exe

[2008.10.09 07:06:39 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2008.10.09 06:16:03 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat

[2008.07.02 03:28:38 | 000,061,440 | ---- | C] () -- C:\Program Files\Common Files\CPInstallAction.dll

[2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files\Common Files\banner.jpg

[2008.04.16 12:11:34 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2008.04.16 12:11:34 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2008.04.16 12:11:34 | 000,126,454 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2008.04.16 12:11:34 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2008.04.16 11:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini

[2007.04.16 11:24:16 | 000,023,752 | ---- | C] () -- C:\Windows\System32\providers.bin

[2007.03.06 07:39:19 | 000,049,152 | ---- | C] () -- C:\Windows\revdevdll.dll

[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 13:47:37 | 000,450,704 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 11:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 11:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2006.03.09 02:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2005.04.03 00:29:59 | 000,110,592 | R--- | C] () -- C:\Windows\System32\scardsyn.dll

[2001.11.14 21:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

[1998.05.06 05:09:59 | 000,069,632 | R--- | C] () -- C:\Windows\System32\ODMA32.dll
 

< End of report >

Und das OSAM-Log:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 20:50:39 on 16.01.2012
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Mozilla Corporation Firefox 9.0.1
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"ASMMAP" (ASMMAP) - ? - C:\Program Files\ATKGFNEX\ASMMAP.sys

"atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys

"catchme" (catchme) - ? - C:\Users\ASUSX7~1\AppData\Local\Temp\catchme.sys  (File not found)

"ghaio" (ghaio) - ? - C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys  (File found, but it contains no detailed information)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)

"lullaby" (lullaby) - "Windows (R) Codename Longhorn DDK provider" - C:\Windows\System32\DRIVERS\lullaby.sys

"Pinnacle Marvin Bus" (MarvinBus) - "Pinnacle Systems GmbH" - C:\Windows\System32\DRIVERS\MarvinBus.sys

"SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS

"SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

"VClone" (VClone) - ? - C:\Windows\System32\DRIVERS\VClone.sys  (File not found)

"{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}" ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) - "Cyberlink Corp." - C:\Program Files\ASUS\AI TouchMedia\PlayMovie\000.fcl
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{10880D85-AAD9-4558-ABDC-2AB1552D831F} "LightScribe Control Panel" - "Hewlett-Packard Company" - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "SABShellExecuteHook Class" - "SuperAdBlocker.com" - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{79BC0345-1015-11D2-A299-006008312725} "///FAST project settings" - ? - C:\Program Files\Pinnacle\Studio 14\Programs\BlueShellExt.dll  (File found, but it contains no detailed information)

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_30.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

{C3F79A2B-B9B4-4A66-B012-3EE46475B072} "MessengerStatsClient Class" - "Microsoft Corporation" - C:\Windows\Downloaded Program Files\MessengerStatsPAClient.dll / hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

{5D6F45B3-9043-443D-A792-115447494D24} "UnoCtrl Class" - "Microsoft" - C:\Windows\Downloaded Program Files\GAME_UNO1.dll / hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

{326E768D-4182-46FD-9C16-1449A49795F4} "DivX Plus Web Player HTML5 <video>" - "DivX, LLC" - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID-Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"Bluetooth.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"LightScribe Control Panel" - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"ASUS Camera ScreenSaver" - ? - C:\Windows\AsScrProlog.exe  (File found, but it contains no detailed information)

"ASUS Screen Saver Protector" - "ASUS" - C:\Windows\AsScrPro.exe

"ATKMEDIA" - "ASUS" - C:\Program Files\ASUS\ATK Media\DMedia.exe

"ATKOSD2" - "ASUS" - C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe

"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"HControlUser" - ? - C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Adobe LM Service" (Adobe LM Service) - "Adobe Systems" - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

"ASLDR Service" (ASLDRService) - ? - C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe

"ATKGFNEX Service" (ATKGFNEXSrv) - ? - C:\Program Files\ATKGFNEX\GFNEXSrv.exe

"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"SAS Core Service" (!SASCORE) - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

"spmgr" (spmgr) - ? - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
 

[Winlogon]

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"!SASWinLogon" - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Kannst du jetzt sehen, wo's noch hängt?

cosinus

16.01.2012 21:01

Sry das OTL-Log machst du bitte nochmal, es war leider kein CustomScan :(

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

nightingale7

16.01.2012 21:46

Ah, hab ich mir fast schon gedacht... Dann hier nochmal richtig:

Code:

OTL logfile created on: 16.01.2012 21:08:28 - Run 13

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Nebelkrähe\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,87 Gb Available Physical Memory | 62,44% Memory free

6,19 Gb Paging File | 5,02 Gb Available in Paging File | 80,96% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 149,04 Gb Total Space | 82,57 Gb Free Space | 55,40% Space Free | Partition Type: NTFS

Drive D: | 139,28 Gb Total Space | 28,20 Gb Free Space | 20,24% Space Free | Partition Type: NTFS

Drive E: | 4,61 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: ASUSX72V-PC | User Name: Nebelkrähe | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.01.09 18:50:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Nebelkrähe\Desktop\OTL.exe

PRC - [2011.12.09 12:40:20 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.12.09 12:40:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2011.12.09 12:39:54 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.12.09 12:39:54 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.08.12 00:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe

PRC - [2011.07.29 00:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe

PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008.10.09 08:30:20 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe

PRC - [2008.07.15 19:29:00 | 007,651,328 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe

PRC - [2008.07.15 19:22:46 | 000,217,088 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControl.exe

PRC - [2008.07.10 01:09:26 | 000,191,032 | ---- | M] (ATK) -- C:\Program Files\P4G\BatteryLife.exe

PRC - [2008.06.25 03:01:08 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Media\DMedia.exe

PRC - [2008.06.24 04:16:24 | 002,482,176 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe

PRC - [2008.06.19 20:18:12 | 000,154,168 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ASUS CopyProtect\ASPG.exe

PRC - [2008.06.18 06:10:24 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files\ASUS\SmartLogon\sensorsrv.exe

PRC - [2008.06.13 06:52:51 | 006,183,456 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2008.06.04 01:29:08 | 000,851,968 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe

PRC - [2008.04.10 19:32:18 | 000,752,168 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

PRC - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe

PRC - [2008.01.23 18:51:28 | 000,151,552 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\WDC.exe

PRC - [2008.01.12 06:40:10 | 000,098,304 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

PRC - [2007.11.30 19:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe

PRC - [2007.11.05 03:48:06 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe

PRC - [2007.10.03 05:53:00 | 000,094,208 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe

PRC - [2007.08.15 19:20:16 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe

PRC - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe

PRC - [2007.08.03 20:24:54 | 000,125,496 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

PRC - [2007.07.06 00:53:44 | 001,040,384 | ---- | M] () -- C:\Program Files\Wireless Console 2\wcourier.exe

PRC - [2005.07.06 23:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.07.29 00:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll

MOD - [2011.07.29 00:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe

MOD - [2008.09.16 19:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll

MOD - [2008.04.10 19:25:54 | 000,126,976 | ---- | M] () -- C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll

MOD - [2008.01.12 06:40:10 | 000,098,304 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

MOD - [2007.11.30 19:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe

MOD - [2007.11.12 23:41:50 | 000,106,496 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\MsgTran.dll

MOD - [2007.08.14 21:59:54 | 006,365,184 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtGui4.dll

MOD - [2007.07.12 21:55:52 | 000,131,072 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll

MOD - [2007.07.12 21:55:28 | 001,581,056 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtCore4.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.12.09 12:40:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.12.09 12:39:54 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.08.12 00:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)

SRV - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)

SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.10.03 05:53:00 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService)

SRV - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)

SRV - [2007.08.03 20:24:54 | 000,125,496 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.12.09 12:40:20 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.12.09 12:40:20 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.12.09 12:40:20 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2011.07.22 17:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)

DRV - [2011.07.12 22:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.12.26 17:30:57 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2009.12.26 17:30:57 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2009.05.28 21:41:28 | 004,233,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)

DRV - [2008.06.25 15:58:59 | 007,534,720 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2008.06.25 15:58:59 | 000,043,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)

DRV - [2008.06.03 07:41:51 | 000,015,928 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)

DRV - [2008.05.29 18:21:02 | 000,015,416 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\lullaby.sys -- (lullaby)

DRV - [2008.05.20 01:15:42 | 000,061,424 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Program Files\ASUS\AI TouchMedia\PlayMovie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})

DRV - [2008.05.02 06:59:39 | 000,122,368 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2008.03.21 05:12:59 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2008.02.16 01:42:42 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)

DRV - [2008.02.05 08:52:23 | 000,206,464 | ---- | M] (eMPIA Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etFilter.sys -- (FiltUSBET)

DRV - [2008.01.31 12:18:57 | 000,006,528 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etScan.sys -- (ScanUSBET)

DRV - [2007.12.19 01:12:12 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)

DRV - [2007.09.06 09:43:49 | 000,474,624 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\etDevice.sys -- (DCamUSBET)

DRV - [2007.08.03 05:26:21 | 000,020,936 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)

DRV - [2007.07.30 19:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)

DRV - [2007.07.30 18:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)

DRV - [2007.07.24 19:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP)

DRV - [2007.06.17 05:29:08 | 000,146,824 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor)

DRV - [2006.12.14 08:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)

DRV - [2006.11.02 08:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)

DRV - [2005.09.23 21:18:32 | 000,171,520 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MarvinBus.sys -- (MarvinBus)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.schnellsucher.com/?t=Q0908131707&s=h

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "www.google.de"

FF - prefs.js..extensions.enabledItems: {59c81df5-4b7a-477b-912d-4e0fdf64e5f2}:0.9.86.1

FF - prefs.js..extensions.enabledItems: {3d7eb24f-2740-49df-8937-200b1cc08f8a}:1.5.15.1

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: multilinks@plugin:3.0.0.16

FF - prefs.js..extensions.enabledItems: {888d99e7-e8b5-46a3-851e-1ec45da1e644}:4.0.3

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.01.06 09:33:26 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Users\Nebelkrähe\AppData\Local\Mozilla Firefox\components [2011.12.23 08:47:37 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Users\Nebelkrähe\AppData\Local\Mozilla Firefox\plugins

 

[2009.04.11 15:06:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nebelkrähe\AppData\Roaming\mozilla\Extensions

[2012.01.03 23:15:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nebelkrähe\AppData\Roaming\mozilla\Firefox\Profiles\rv376t07.default\extensions

[2011.03.19 10:26:14 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Nebelkrähe\AppData\Roaming\mozilla\Firefox\Profiles\rv376t07.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.07.18 13:16:57 | 000,000,000 | ---D | M] (Flashblock) -- C:\Users\Nebelkrähe\AppData\Roaming\mozilla\Firefox\Profiles\rv376t07.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}

[2011.12.23 08:47:41 | 000,000,000 | ---D | M] (ChatZilla) -- C:\Users\Nebelkrähe\AppData\Roaming\mozilla\Firefox\Profiles\rv376t07.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}

[2009.08.13 16:26:14 | 000,002,375 | ---- | M] () -- C:\Users\Nebelkrähe\AppData\Roaming\Mozilla\Firefox\Profiles\rv376t07.default\searchplugins\Schnell Sucher.xml

[2011.12.19 20:56:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

File not found (No name found) -- C:\USERS\NEBELKRÃ¤HE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\EXTENSIONS\{3D7EB24F-2740-49DF-8937-200B1CC08F8A}

File not found (No name found) -- C:\USERS\NEBELKRÃ¤HE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\EXTENSIONS\{59C81DF5-4B7A-477B-912D-4E0FDF64E5F2}

File not found (No name found) -- C:\USERS\NEBELKRÃ¤HE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\EXTENSIONS\{888D99E7-E8B5-46A3-851E-1EC45DA1E644}.XPI

File not found (No name found) -- C:\USERS\NEBELKRÃ¤HE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\EXTENSIONS\MULTILINKS@PLUGIN.XPI

File not found (No name found) -- C:\USERS\NEBELKRÃ¤HE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RV376T07.DEFAULT\EXTENSIONS\OLDFACTORY_OPTIONS@WWW.THEME-OASIS.ORG.XPI

[2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2011.07.11 22:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll

CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL

CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\pdf.dll

CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll

CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll

CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: YouTube = C:\Users\Nebelkrähe\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.3_0\

CHR - Extension: Google-Suche = C:\Users\Nebelkrähe\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\

CHR - Extension: Snap Links Lite = C:\Users\Nebelkrähe\AppData\Local\Google\Chrome\User Data\Default\Extensions\idmmhhijggcmbeejedibpdcahpkneegg\1.2.4_0\

CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\Nebelkrähe\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\

CHR - Extension: Google Mail = C:\Users\Nebelkrähe\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

 

O1 HOSTS File: ([2012.01.09 23:25:27 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe ()

O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS)

O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe ()

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKCU..\Run: [EPSON Stylus DX8400 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE (SEIKO EPSON CORPORATION)

O4 - HKCU..\Run: [EPSON Stylus DX9400F Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICFE.EXE (SEIKO EPSON CORPORATION)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)

O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B8A7E2A5-BF27-4014-93AD-F1B3729F6DCE}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EC2AFD73-5775-499D-8010-29CA5974B896}: DhcpNameServer = 192.168.2.1

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)

O24 - Desktop WallPaper: C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2011.10.10 14:54:08 | 002,290,144 | R--- | M] () - E:\Autorun.exe -- [ CDFS ]

O32 - AutoRun File - [2011.10.09 15:23:34 | 000,000,047 | R--- | M] () - E:\Autorun.inf -- [ CDFS ]

O32 - AutoRun File - [2011.10.09 15:23:34 | 000,224,630 | R--- | M] () - E:\autorun.ico -- [ CDFS ]

O33 - MountPoints2\{aa57d325-d666-11de-8854-0023543d4c06}\Shell - "" = AutoRun

O33 - MountPoints2\{aa57d325-d666-11de-8854-0023543d4c06}\Shell\AutoRun\command - "" = F:\setup.exe AUTORUN=1

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - State: "startup" - 2

 

SafeBootMin: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)

SafeBootMin: AppMgmt -  File not found

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)

SafeBootNet: AppMgmt -  File not found

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfPf - Driver

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F00842BF-035E-6FF4-D37F-9021C12AD969} - Microsoft Windows Media Player 11.0

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\Windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: wave2 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.01.09 20:42:47 | 000,000,000 | ---D | C] -- C:\Users\Nebelkrähe\AppData\Local\Ubisoft Game Launcher

[2012.01.09 18:50:27 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Nebelkrähe\Desktop\OTL.exe

[2012.01.07 18:58:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

[2012.01.07 18:58:11 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2012.01.07 18:58:11 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware

[2012.01.06 15:13:54 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2012.01.06 10:09:15 | 000,000,000 | ---D | C] -- C:\Users\Nebelkrähe\AppData\Local\temp

[2012.01.06 10:08:42 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2012.01.06 09:56:46 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012.01.06 09:56:46 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012.01.06 09:56:46 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012.01.06 09:56:34 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2012.01.06 09:56:33 | 000,000,000 | ---D | C] -- C:\ComboFix

[2012.01.06 09:56:30 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012.01.05 23:11:18 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.01.05 18:02:34 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.01.05 15:38:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.01.05 15:38:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.01.05 15:38:41 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.01.05 15:38:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.01.04 21:30:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

[2012.01.04 21:30:25 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip

[2012.01.03 22:56:53 | 000,000,000 | ---D | C] -- C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}

[2012.01.03 22:47:14 | 000,939,368 | ---- | C] (Macromedia, Inc.) -- C:\Windows\System32\flash.ocx

[2012.01.02 22:47:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Solidshield

[2011.12.22 16:40:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2011.12.22 16:40:21 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2011.12.19 21:35:56 | 000,000,000 | ---D | C] -- C:\Users\Nebelkrähe\AppData\Roaming\Avira

[2011.12.19 21:34:47 | 000,000,000 | ---D | C] -- C:\Users\Nebelkrähe\AppData\Local\Mozilla Firefox

[2011.12.19 21:30:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2011.12.19 21:30:24 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2011.12.19 21:30:23 | 000,134,856 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2011.12.19 21:30:23 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2011.12.19 21:30:23 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys

[2011.12.19 21:30:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2011.12.19 21:30:22 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2011.12.19 21:17:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2008.06.03 07:41:51 | 000,015,928 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.01.16 21:10:07 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.01.16 21:10:07 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.01.16 21:05:00 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.01.16 19:10:09 | 000,121,244 | ---- | M] () -- C:\ProgramData\nvModes.001

[2012.01.16 19:10:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.01.16 14:09:41 | 000,002,591 | ---- | M] () -- C:\Users\Nebelkrähe\Desktop\Microsoft Office Word 2007.lnk

[2012.01.16 13:58:24 | 000,000,374 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics

[2012.01.16 13:58:12 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.01.16 13:57:46 | 3218,247,680 | -HS- | M] () -- C:\hiberfil.sys

[2012.01.15 21:45:25 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2012.01.15 12:12:21 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe

[2012.01.15 12:10:17 | 000,001,010 | RHS- | M] () -- C:\Users\Nebelkrähe\ntuser.pol

[2012.01.12 09:54:52 | 000,017,626 | ---- | M] () -- C:\Users\Nebelkrähe\Documents\cc_20120112_095439.reg

[2012.01.10 07:40:48 | 000,121,244 | ---- | M] () -- C:\ProgramData\nvModes.dat

[2012.01.09 23:25:27 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts

[2012.01.09 18:50:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Nebelkrähe\Desktop\OTL.exe

[2012.01.06 09:42:18 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.01.06 09:42:18 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.01.06 09:42:18 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.01.06 09:42:18 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.01.03 22:06:25 | 000,000,067 | ---- | M] () -- C:\Windows\wininit.ini

[2012.01.03 22:05:01 | 000,000,341 | ---- | M] () -- C:\Windows\SIERRA.INI

[2012.01.03 20:49:54 | 000,450,704 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.01.03 20:42:03 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat

[2012.01.03 20:42:03 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat

[2012.01.03 20:41:52 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf

[2011.12.22 15:11:01 | 000,000,871 | ---- | M] () -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpbt0.dll.lnk

[2011.12.19 21:34:48 | 000,000,919 | ---- | M] () -- C:\Users\Nebelkrähe\Desktop\Mozilla Firefox.lnk

 
 ========== Files Created - No Company Name ==========

 

[2012.01.12 09:54:41 | 000,017,626 | ---- | C] () -- C:\Users\Nebelkrähe\Documents\cc_20120112_095439.reg

[2012.01.06 09:56:46 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012.01.06 09:56:46 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012.01.06 09:56:46 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012.01.06 09:56:46 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012.01.06 09:56:46 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012.01.03 22:06:25 | 000,000,067 | ---- | C] () -- C:\Windows\wininit.ini

[2012.01.03 20:41:52 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf

[2011.12.22 15:11:01 | 000,000,871 | ---- | C] () -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpbt0.dll.lnk

[2011.12.19 21:34:48 | 000,000,927 | ---- | C] () -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2011.12.19 21:34:48 | 000,000,919 | ---- | C] () -- C:\Users\Nebelkrähe\Desktop\Mozilla Firefox.lnk

[2011.12.18 23:23:29 | 3218,247,680 | -HS- | C] () -- C:\hiberfil.sys

[2011.08.18 21:00:49 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat

[2011.01.23 14:36:37 | 000,000,341 | ---- | C] () -- C:\Windows\SIERRA.INI

[2009.12.26 17:30:57 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys

[2009.12.26 17:30:57 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys

[2009.11.22 19:56:21 | 000,000,016 | ---- | C] () -- C:\Windows\popcinfo.dat

[2009.10.01 17:02:49 | 000,004,907 | ---- | C] () -- C:\ProgramData\ypkpiykb.yyr

[2009.09.14 15:40:53 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009.09.14 15:40:53 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2009.08.13 20:06:07 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2009.08.13 16:44:57 | 000,000,081 | -HS- | C] () -- C:\ProgramData\.zreglib

[2009.05.10 01:32:00 | 000,136,704 | ---- | C] () -- C:\Users\Nebelkrähe\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.04.11 14:17:22 | 000,007,592 | ---- | C] () -- C:\Users\Nebelkrähe\AppData\Local\d3d9caps.dat

[2008.12.13 12:37:56 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini

[2008.12.06 10:04:44 | 000,121,244 | ---- | C] () -- C:\ProgramData\nvModes.001

[2008.12.05 20:29:39 | 000,121,244 | ---- | C] () -- C:\ProgramData\nvModes.dat

[2008.10.09 08:41:14 | 000,000,024 | ---- | C] () -- C:\Windows\System32\ChkMail.ini

[2008.10.09 08:40:56 | 000,045,056 | ---- | C] () -- C:\Windows\System32\acovcnt.exe

[2008.10.09 08:30:30 | 000,047,672 | ---- | C] () -- C:\Windows\AsScrProlog.exe

[2008.10.09 07:06:39 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2008.10.09 06:16:03 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat

[2008.07.02 03:28:38 | 000,061,440 | ---- | C] () -- C:\Program Files\Common Files\CPInstallAction.dll

[2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files\Common Files\banner.jpg

[2008.04.16 12:11:34 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2008.04.16 12:11:34 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2008.04.16 12:11:34 | 000,126,454 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2008.04.16 12:11:34 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2008.04.16 11:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini

[2007.04.16 11:24:16 | 000,023,752 | ---- | C] () -- C:\Windows\System32\providers.bin

[2007.03.06 07:39:19 | 000,049,152 | ---- | C] () -- C:\Windows\revdevdll.dll

[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 13:47:37 | 000,450,704 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 11:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 11:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2006.03.09 02:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2005.04.03 00:29:59 | 000,110,592 | R--- | C] () -- C:\Windows\System32\scardsyn.dll

[2001.11.14 21:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

[1998.05.06 05:09:59 | 000,069,632 | R--- | C] () -- C:\Windows\System32\ODMA32.dll

 
 ========== LOP Check ==========

 

[2011.07.01 14:47:52 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant

[2011.08.18 21:04:31 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Daedalic Entertainment

[2011.03.19 10:50:57 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\elsterformular

[2010.07.16 16:25:05 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\EPSON

[2010.12.24 00:01:32 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\FreeAudioPack

[2009.10.04 12:59:42 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\GetRightToGo

[2011.01.19 16:33:46 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\GOA

[2009.08.10 15:11:00 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\My Games

[2011.05.07 10:26:56 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\ScummVM

[2009.08.13 12:56:14 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Sega

[2012.01.09 20:42:39 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Ubisoft

[2011.11.25 19:57:41 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\WB Games

[2012.01.15 21:45:26 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.07.01 14:46:55 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Adobe

[2011.12.19 21:35:56 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Avira

[2009.10.01 17:31:01 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\AVS4YOU

[2011.07.01 14:47:52 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant

[2009.04.14 09:00:10 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\CyberLink

[2011.08.18 21:04:31 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Daedalic Entertainment

[2010.12.18 21:19:18 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\DivX

[2011.12.13 11:57:41 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\dvdcss

[2011.03.19 10:50:57 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\elsterformular

[2010.07.16 16:25:05 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\EPSON

[2010.12.24 00:01:32 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\FreeAudioPack

[2009.10.04 12:59:42 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\GetRightToGo

[2011.01.19 16:33:46 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\GOA

[2009.04.11 14:17:03 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Identities

[2009.04.11 14:17:26 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Macromedia

[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Media Center Programs

[2009.10.05 13:10:16 | 000,000,000 | --SD | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft

[2009.04.11 15:06:28 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Mozilla

[2009.08.10 15:11:00 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\My Games

[2011.05.07 10:26:56 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\ScummVM

[2009.04.13 23:48:30 | 000,000,000 | RH-D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\SecuROM

[2009.08.13 12:56:14 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Sega

[2010.10.31 18:14:10 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Skype

[2010.10.31 17:05:23 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\skypePM

[2009.04.11 14:17:26 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Symantec

[2012.01.09 20:42:39 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Ubisoft

[2009.05.10 12:13:14 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\vlc

[2011.11.25 19:57:41 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\WB Games

[2012.01.16 20:42:48 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\Winamp

[2009.04.15 10:40:11 | 000,000,000 | ---D | M] -- C:\Users\Nebelkrähe\AppData\Roaming\WinRAR

 
 < %APPDATA%\*.exe /s >

[2009.10.05 13:10:16 | 000,046,376 | R--- | M] (Acresso Software Inc.) -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Installer\{AADD1C8F-D59F-4D55-A726-768C71A205A8}\SC_AMCap.exe

[2009.10.05 13:10:16 | 000,054,568 | R--- | M] (Acresso Software Inc.) -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Installer\{AADD1C8F-D59F-4D55-A726-768C71A205A8}\SC_Check3D.exe

[2009.10.05 13:10:16 | 000,075,048 | R--- | M] (Acresso Software Inc.) -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Installer\{AADD1C8F-D59F-4D55-A726-768C71A205A8}\SC_ContentTransfer.exe

[2009.10.05 13:10:16 | 000,439,592 | R--- | M] (Acresso Software Inc.) -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Installer\{AADD1C8F-D59F-4D55-A726-768C71A205A8}\SC_GuidedTour.exe

[2009.10.05 13:10:16 | 000,050,472 | R--- | M] (Acresso Software Inc.) -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Installer\{AADD1C8F-D59F-4D55-A726-768C71A205A8}\SC_Help_HH.exe

[2009.10.05 13:10:16 | 000,070,952 | R--- | M] (Acresso Software Inc.) -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Installer\{AADD1C8F-D59F-4D55-A726-768C71A205A8}\SC_ReadMe.exe

[2009.10.05 13:10:16 | 000,234,792 | R--- | M] (Acresso Software Inc.) -- C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Installer\{AADD1C8F-D59F-4D55-A726-768C71A205A8}\Studio.exe

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\ERDNT\cache\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\ERDNT\cache\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2008.02.22 05:59:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=76D70915EB81608DC6ACA87887FAB38F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22120_none_ddac250d3ab7a648\atapi.sys

[2008.02.22 06:03:50 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=92210921EEFC081693F649C3631DEEC2 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_3d9c5057\atapi.sys

[2008.02.22 06:03:50 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=92210921EEFC081693F649C3631DEEC2 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18023_none_dd25892021975283\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\ERDNT\cache\cngaudit.dll

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2008.05.07 10:40:01 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\drivers\iaStor.sys

[2008.05.07 10:40:01 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_1ab0331f\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\ERDNT\cache\netlogon.dll

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\ERDNT\cache\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\ERDNT\cache\user32.dll

[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\ERDNT\cache\userinit.exe

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\ERDNT\cache\wininit.exe

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\ERDNT\cache\winlogon.exe

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

cosinus

16.01.2012 21:56

Code:

:OTL

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.schnellsucher.com/?t=Q0908131707&s=h

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

[2009.08.13 16:26:14 | 000,002,375 | ---- | M] () -- C:\Users\Nebelkrähe\AppData\Roaming\Mozilla\Firefox\Profiles\rv376t07.default\searchplugins\Schnell Sucher.xml

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2011.10.10 14:54:08 | 002,290,144 | R--- | M] () - E:\Autorun.exe -- [ CDFS ]

O32 - AutoRun File - [2011.10.09 15:23:34 | 000,000,047 | R--- | M] () - E:\Autorun.inf -- [ CDFS ]

O32 - AutoRun File - [2011.10.09 15:23:34 | 000,224,630 | R--- | M] () - E:\autorun.ico -- [ CDFS ]

O33 - MountPoints2\{aa57d325-d666-11de-8854-0023543d4c06}\Shell - "" = AutoRun

O33 - MountPoints2\{aa57d325-d666-11de-8854-0023543d4c06}\Shell\AutoRun\command - "" = F:\setup.exe AUTORUN=1

C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpbt0.dll.lnk

C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

:Commands

[emptytemp]

[resethosts]

nightingale7

17.01.2012 01:12

OTL-Log nach dem Fix:

Code:

All processes killed

========== OTL ==========

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\StartPageCache| /E : value set successfully!

C:\Users\Nebelkrähe\AppData\Roaming\Mozilla\Firefox\Profiles\rv376t07.default\searchplugins\Schnell Sucher.xml moved successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

File move failed. E:\Autorun.exe scheduled to be moved on reboot.

File move failed. E:\Autorun.inf scheduled to be moved on reboot.

File move failed. E:\autorun.ico scheduled to be moved on reboot.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{aa57d325-d666-11de-8854-0023543d4c06}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aa57d325-d666-11de-8854-0023543d4c06}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{aa57d325-d666-11de-8854-0023543d4c06}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aa57d325-d666-11de-8854-0023543d4c06}\ not found.

File F:\setup.exe AUTORUN=1 not found.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: ASUS x72v

->Temp folder emptied: 69613 bytes

->Temporary Internet Files folder emptied: 33300 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 0 bytes

->Google Chrome cache emptied: 45235644 bytes

->Flash cache emptied: 560 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Default User

 

User: Nebelkrähe

->Temp folder emptied: 35307 bytes

->Temporary Internet Files folder emptied: 84234 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 60221661 bytes

->Google Chrome cache emptied: 0 bytes

->Flash cache emptied: 545 bytes

 

User: Public

->Temp folder emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 47644 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 101,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.31.0 log created on 01172012_010227
 

Files\Folders moved on Reboot...

File move failed. E:\Autorun.exe scheduled to be moved on reboot.

File move failed. E:\Autorun.inf scheduled to be moved on reboot.

File move failed. E:\autorun.ico scheduled to be moved on reboot.
 

Registry entries deleted on Reboot...

Die Fehlermeldung erscheint leider immer noch.

Und da ich es jetzt erst sehe: Ich hab in Laufwerk E:\ eine legal erworbene CD-R mit ANNO 2070 zu liegen. Darauf sollte nix Schädliches sein.

cosinus

17.01.2012 13:25

Es ging ja auch darum den Mounpointeintrag wegzumachen und nicht Dateien von einer CD. Das funktioniert ja auch nicht, da eine CD oder DVD schreibgeschützt ist!

Hatte leider eine Zeile im Script vergessen. Mach den Fix bitte mit diesem Script nochmal:

Code:

:Files

C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpbt0.dll.lnk

C:\Users\Nebelkrähe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

nightingale7

17.01.2012 20:48

Beide Aktionen sind erfolgreich ausgeführt worden. Leider ist das kurze Fix-Log net automatisch gespeichert worden - und ich wollte erst einen Neustart machen, bevor ich es poste. Aber es stand auch nix weiter da.

Die Fehlermeldung erschien nach dem Neustart nicht mehr. Kann ich jetzt aufatmen? :)

cosinus

17.01.2012 22:05

Ja, der Eintrag ist jetzt weg.
War nur ein verwaister Autostart.
Rechner wieder im Lot?

nightingale7

17.01.2012 23:10

Würde nie meine Hand dafür ins Feuer legen, dass der Rechner wieder im Lot is - aber zumindest macht sich jetzt nix mehr bemerkbar. ;)

Vielen, vielen Dank für deine Hilfe und Geduld. Wenn ich die Passwörter ausgetauscht hab und mich wieder in meinen Paypal-Account reintraue, werd ich dem Forum meinen Dank auch in materieller Form zukommen lassen - in der Hoffnung, dass du auf die eine oder andere Art auch was davon hast. :bussi:

cosinus

18.01.2012 11:53

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Alle Zeitangaben in WEZ +1. Es ist jetzt 16:10 Uhr.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58