GVU Trojaner (abgesicherter modus nicht möglich)
 

Hey leute
hab gestern mir beim streamen nen gvu trojaner eingefangen und nun mit otlpe versucht das problem zu lösen.
OTL.txteinen extra.txt hab ich nicht gefunden in dem ordner.
kann mir jemand erklären was ich als nächstes zu tun hab?
mfg devil94

Hallo und :hallo:

Ich bin Christoph und möchte dir bei deinem Problem helfen.
Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.

• Bitte arbeite alle Schritte der Reihe nach ab.
• Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
• Nur Scans durchführen zu denen Du von einem Helfer aufgefordert wirst.
• Bitte kein Crossposting (Posten in mehreren Foren).
• Installiere oder Deinstalliere während der Bereinigung keine Software außer Du wurdest dazu aufgefordert.
• Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
• Poste die Logfiles direkt in deinen Thread. Nicht anhängen außer ich fordere Dich dazu auf. Erschwert mir nämlich das Auswerten.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass dein PC clean ist.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einem USB Stick:
Farbar Recovery Scan Tool 32-Bit-Version
Farbar Recovery Scan Tool 64-Bit-Version

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Über den Boot Manager

• Starte den Rechner neu auf.
• Während dem Hochfahren drücke mehrmals die F8 Taste
• Wähle nun Computer reparieren.
• Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD

• Lege die Windows CD in dein Laufwerk.
• Starte den Rechner neu auf und starte von der CD
• Wähle die Spracheinstellungen und klicke "Weiter".
• Klicke auf Computerreparaturoptionen !!
• Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen Eingabeaufforderung

• Gib nun bitte notepad ein und drücke Enter.
• Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer
  Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt.
• Schließe Notepad wieder
• Gib nun bitte folgenden Befehl ein.
  e:\frst.exe bzw. e:\frst64.exe
  Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Gegebenfalls anpassen.
• Akzeptiere den Disclaimer mit Yes und klicke Scan

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Hallo und danke für die schnelle Antwort!
habe alles durchgeführt.

oh mist sorry! :S

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2013 (ATTENTION: FRST version is 17 days old)
Ran by SYSTEM at 30-03-2013 22:09:07
Running from F:\
Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\FRITZWLANMini.exe [283136 2007-02-02] (AVM Berlin)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [8120864 2009-12-08] (Realtek Semiconductor)
HKLM\...\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM\...\Run: [NUSB3MON] "C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [106496 2009-11-20] (NEC Electronics Corporation)
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [636032 2012-02-14] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [37296 2012-03-27] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-03] (Adobe Systems Incorporated)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\mssecex.exe" -hide -runkey [x]
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM\...\Run: [BlueStacks Agent] C:\Program Files\BlueStacks\HD-Agent.exe [577400 2012-09-14] (BlueStack Systems, Inc.)
HKLM\...\Run: [SDTray] "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" [3825176 2012-11-13] (Safer-Networking Ltd.)
HKU\Administrator\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18705664 2013-01-08] (Skype Technologies S.A.)
HKU\Administrator\...\Run: [pkgndjozfpgpfzz] C:\Windows\pkgndjoz.exe [x]
HKU\Administrator\...\Winlogon: [Shell] explorer.exe,C:\Users\Administrator\AppData\Roaming\skype.dat [84480 2011-11-17] ()
HKU\Robert\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18705664 2013-01-08] (Skype Technologies S.A.)
HKU\Robert\...\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun [3673728 2012-11-06] (DT Soft Ltd)
HKU\Robert\...\Winlogon: [Shell] explorer.exe [x]
HKLM\...\Winlogon: [Shell] explorer.exe [2616320 2011-02-25] ()
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
Startup: C:\ProgramData\Start Menu\Programs\Startup\AML Device Install.lnk
ShortcutTarget: AML Device Install.lnk -> C:\Program Files\AMD AVT\bin\kdbsync.exe ()
Startup: C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Tom Clancy's Rainbow Six ()

==================== Services (Whitelisted) ===================

2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService [291840 2012-02-14] (Advanced Micro Devices, Inc.)
2 BstHdAndroidSvc; "C:\Program Files\BlueStacks\HD-Service.exe" BstHdAndroidSvc Android [393080 2012-09-14] (BlueStack Systems, Inc.)
2 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [384888 2012-09-14] (BlueStack Systems, Inc.)
2 Guard.Mail.ru; "C:\Program Files\Guard-ICQ\GuardICQ.exe" [1564368 2012-06-28] ()
2 IB Updater; C:\Program Files\IB Updater\ExtensionUpdaterService.exe [188760 2013-01-29] ()
2 IBUpdaterService; C:\Windows\System32\dmwu.exe [1008496 2012-10-02] ()
2 JMB36X; C:\Windows\System32\XSrvSetup.exe [65536 2009-08-06] ()
2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75136 2012-12-10] ()
2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
4 KMService; C:\Windows\system32\srvany.exe [x]
2 MsMpSvc; "c:\Program Files\Microsoft Security Client\MsMpEng.exe" [x]
3 NisSrv; "c:\Program Files\Microsoft Security Client\NisSrv.exe" [x]

==================== Drivers (Whitelisted) ====================

2 AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [46720 2012-02-01] (Advanced Micro Devices)
3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-01-26] (AVM Berlin)
2 BstHdDrv; \??\C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [63864 2012-09-14] (BlueStack Systems)
1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2012-11-27] (DT Soft Ltd)
3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-01-26] (AVM GmbH)
0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [99440 2009-10-29] (JMicron Technology Corp.)
0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [193552 2012-08-30] (Microsoft Corporation)
1 MpKsl07894b93; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl07894b93.sys [29904 2013-03-30] ()
1 MpKsl3d312dd0; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl3d312dd0.sys [29904 2013-03-30] ()
1 MpKsl9a732883; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl9a732883.sys [29904 2013-03-30] ()
1 MpKsld861874d; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsld861874d.sys [29904 2013-03-30] ()
1 MpKsle2a982e2; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsle2a982e2.sys [29904 2013-03-30] ()
3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [168480 2009-12-02] (Realtek Semiconductor Corp.)
0 speedfan; C:\Windows\System32\speedfan.sys [25240 2011-03-18] (Almico Software)
3 gdrv; \??\C:\Windows\gdrv.sys [x]
3 VGPU; C:\Windows\System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-03-31 02:47 - 2013-03-31 02:47 - 00000000 ____D C:\_OTL
2013-03-31 00:50 - 2013-03-31 02:34 - 00100434 ____A C:\OTL.Txt
2013-03-30 22:08 - 2013-03-30 22:08 - 00000000 ____D C:\FRST
2013-03-30 03:40 - 2013-03-30 03:48 - 00000004 ____A C:\Users\Administrator\AppData\Roaming\skype.ini
2013-03-27 03:49 - 2013-03-27 03:49 - 00000076 ____A C:\Users\Administrator\Desktop\1.txt
2013-03-25 23:33 - 2013-03-25 23:33 - 00400662 ____A C:\Users\Administrator\Downloads\RBGInterface.zip
2013-03-25 18:05 - 2013-03-25 18:16 - 00000000 ____D C:\Users\Administrator\Desktop\World of Warcraft
2013-03-20 15:35 - 2013-03-23 03:40 - 00009728 ____H C:\Users\Administrator\AppData\Roaming\desktop.ini
2013-03-18 21:05 - 2013-03-18 21:05 - 00003306 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.20.zip
2013-03-17 23:49 - 2013-03-30 02:00 - 00000080 ____A C:\Users\Administrator\Desktop\realms.txt
2013-03-17 16:54 - 2013-03-17 16:55 - 00003343 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.3.zip
2013-03-15 18:20 - 2013-03-23 09:00 - 00000000 __SHD C:\Users\Administrator\AppData\Local\ST6UNST #2
2013-03-15 18:20 - 2013-03-17 16:34 - 00000000 __SHD C:\Users\Administrator\Documents\DAEMON Tools Lite
2013-03-11 00:34 - 2013-03-11 00:34 - 00000000 ____D C:\ProgramData\szcvlmmrfopiwja
2013-03-11 00:34 - 2013-03-11 00:33 - 00121856 ____A C:\ProgramData\pkgndjoz.exe
2013-03-11 00:33 - 2013-03-11 00:34 - 00076318 ____A C:\ProgramData\ttiqexkmjhsphik
2013-03-09 11:17 - 2013-03-09 11:17 - 00920120 ____A C:\Windows\Minidump\030913-21450-01.dmp
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl.zip
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl (1).zip

==================== One Month Modified Files and Folders ========

2013-03-31 02:47 - 2013-03-31 02:47 - 00000000 ____D C:\_OTL
2013-03-31 02:34 - 2013-03-31 00:50 - 00100434 ____A C:\OTL.Txt
2013-03-31 00:45 - 2013-01-14 17:26 - 00000000 ____D C:\users\Administrator
2013-03-31 00:45 - 2012-03-13 17:32 - 00000000 ____D C:\users\Robert
2013-03-30 22:08 - 2013-03-30 22:08 - 00000000 ____D C:\FRST
2013-03-30 18:12 - 2013-01-04 08:49 - 00043704 ____A C:\Windows\setupact.log
2013-03-30 18:10 - 2009-07-14 05:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-03-30 15:40 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-03-30 15:40 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-03-30 03:48 - 2013-03-30 03:40 - 00000004 ____A C:\Users\Administrator\AppData\Roaming\skype.ini
2013-03-30 03:35 - 2013-01-14 17:28 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Skype
2013-03-30 02:00 - 2013-03-17 23:49 - 00000080 ____A C:\Users\Administrator\Desktop\realms.txt
2013-03-30 01:54 - 2013-02-06 15:37 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\TS3Client
2013-03-30 00:00 - 2012-03-13 21:11 - 00000000 ____D C:\Program Files\SpeedFan
2013-03-29 16:50 - 2013-01-14 22:47 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\vlc
2013-03-29 14:58 - 2012-03-13 17:32 - 01513695 ____A C:\Windows\WindowsUpdate.log
2013-03-27 03:49 - 2013-03-27 03:49 - 00000076 ____A C:\Users\Administrator\Desktop\1.txt
2013-03-26 18:23 - 2012-06-12 14:57 - 00000000 ____D C:\Users\Administrator\Desktop\Bewerbungen Robert
2013-03-25 23:33 - 2013-03-25 23:33 - 00400662 ____A C:\Users\Administrator\Downloads\RBGInterface.zip
2013-03-25 18:16 - 2013-03-25 18:05 - 00000000 ____D C:\Users\Administrator\Desktop\World of Warcraft
2013-03-23 14:10 - 2010-11-20 22:01 - 01621244 ____A C:\Windows\System32\PerfStringBackup.INI
2013-03-23 09:00 - 2013-03-15 18:20 - 00000000 __SHD C:\Users\Administrator\AppData\Local\ST6UNST #2
2013-03-23 03:40 - 2013-03-20 15:35 - 00009728 ____H C:\Users\Administrator\AppData\Roaming\desktop.ini
2013-03-18 23:00 - 2012-03-13 23:04 - 00000000 ____D C:\Users\Administrator\Desktop\Eigene Filme
2013-03-18 21:05 - 2013-03-18 21:05 - 00003306 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.20.zip
2013-03-17 16:55 - 2013-03-17 16:54 - 00003343 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.3.zip
2013-03-17 16:34 - 2013-03-15 18:20 - 00000000 __SHD C:\Users\Administrator\Documents\DAEMON Tools Lite
2013-03-11 00:34 - 2013-03-11 00:34 - 00000000 ____D C:\ProgramData\szcvlmmrfopiwja
2013-03-11 00:34 - 2013-03-11 00:33 - 00076318 ____A C:\ProgramData\ttiqexkmjhsphik
2013-03-11 00:33 - 2013-03-11 00:34 - 00121856 ____A C:\ProgramData\pkgndjoz.exe
2013-03-10 20:55 - 2012-03-14 23:43 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-03-09 11:17 - 2013-03-09 11:17 - 00920120 ____A C:\Windows\Minidump\030913-21450-01.dmp
2013-03-09 11:17 - 2012-04-08 23:42 - 302044857 ____A C:\Windows\MEMORY.DMP
2013-03-09 11:17 - 2012-04-08 23:42 - 00000000 ____D C:\Windows\Minidump
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl.zip
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl (1).zip
2013-03-01 09:21 - 2012-12-03 01:55 - 00000000 ____D C:\Program Files\IB Updater

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1811024326-1583312281-2864969909-1000\$303fa670b122c7f9747c5881443d375b

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$303fa670b122c7f9747c5881443d375b

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1811024326-1583312281-2864969909-500\$303fa670b122c7f9747c5881443d375b

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$303fa670b122c7f9747c5881443d375b

==================== Known DLLs (Whitelisted) =================


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2011-07-15 16:02] - [2011-02-25 06:30] - 2616320 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\explorer.exe IS INFECTED. <===== ATTENTION!

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2012-12-29 11:52:54
Restore point made on: 2013-01-06 04:20:55
Restore point made on: 2013-01-15 17:51:08
Restore point made on: 2013-01-22 19:08:56
Restore point made on: 2013-02-03 18:23:50
Restore point made on: 2013-02-15 02:20:50
Restore point made on: 2013-02-22 15:35:13
Restore point made on: 2013-03-02 17:55:05
Restore point made on: 2013-03-10 10:28:41
Restore point made on: 2013-03-23 09:05:11

==================== Memory info ===========================

Percentage of memory in use: 12%
Total physical RAM: 4094.49 MB
Available physical RAM: 3566.2 MB
Total Pagefile: 4092.78 MB
Available Pagefile: 3566.35 MB
Total Virtual: 2047.88 MB
Available Virtual: 1960.68 MB

==================== Partitions =============================

1 Drive c: () (Fixed) (Total:465.66 GB) (Free:62.34 GB) NTFS
3 Drive f: () (Removable) (Total:14.44 GB) (Free:14.44 GB) FAT32
4 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
5 Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Datentr„ger ### Status Gr”áe Frei Dyn GPT
--------------- ------------- ------- ------- --- ---
Datentr„ger 0 Online 465 GB 0 B
Datentr„ger 1 Online 14 GB 0 B

Partitions of Disk 0:
===============

Datentr„ger-ID: 290F0B0B

Partition ### Typ GrӇe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 100 MB 1024 KB
Partition 2 Prim„r 465 GB 101 MB

=========================================================

Disk: 0
Partition 1
Typ : 07
Versteckt: Nein
Aktiv : Ja

Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y System-rese NTFS Partition 100 MB Fehlerfre

=========================================================

Disk: 0
Partition 2
Typ : 07
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 465 GB Fehlerfre

=========================================================

Partitions of Disk 1:
===============

Datentr„ger-ID: 2D653D85

Partition ### Typ GrӇe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 14 GB 1704 KB

=========================================================

Disk: 1
Partition 1
Typ : 0B
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F FAT32 Wechselmed 14 GB Fehlerfre

=========================================================
============================== MBR Partition Table ==================

==============================
Partitions of Disk 0:
===============
Disk ID: 290F0B0B

Partition 1:
=========
Hex: 8020210007DF130C0008000000200300
Active: YES
Type: 07 (NTFS)
Size: 100 MB

Partition 2:
=========
Hex: 00DF140C07FEFFFF002803000030353A
Active: NO
Type: 07 (NTFS)
Size: 466 GB

==============================
Partitions of Disk 1:
===============
Disk ID: 2D653D85

Partition 1:
=========
Hex: 003607000BBBDD5E500D0000B072CE01
Active: NO
Type: 0B
Size: 14 GB


Last Boot: 2013-03-23 08:57

==================== End Of Log ============================

Du hast wieder das OTLPe-Log gepostet, ich würde aber gerne ein FRST-Log sehen ;)

Hi

du hast dir da was nettes eingefangen - aber das kriegen wir hin:

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Über den Boot Manager

• Starte den Rechner neu auf.
• Während dem Hochfahren drücke mehrmals die F8 Taste
• Wähle nun Computer reparieren.
• Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD

• Lege die Windows CD in dein Laufwerk.
• Starte den Rechner neu auf und starte von der CD
• Wähle die Spracheinstellungen und klicke "Weiter".
• Klicke auf Computerreparaturoptionen !!
• Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen Eingabeaufforderung

• Gib nun bitte notepad ein und drücke Enter.
• Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer
  Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt.
• Schließe Notepad wieder
• Gib nun bitte folgenden Befehl ein.
  e:\frst.exe bzw. e:\frst64.exe
  Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Gegebenfalls anpassen.
• Akzeptiere den Disclaimer mit Yes.
  
  Jetzt gib in das Suchfeld Folgendes ein:
  
  Code:

  ---

  explorer.exe

  ---

  und klicke Search File(s)

Das Tool erstellt eine Search.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Mist- schon gedacht das es was schlimmeres ist.
Farbar Recovery Scan Tool (x86) Version: 13-03-2013
Ran by SYSTEM at 2013-03-30 23:53:42
Running from F:\

================== Search: "explorer.exe" ===================

C:\Windows\explorer.exe
[2011-07-15 16:02] - [2011-02-25 06:30] - 2616320 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2011-07-15 16:02] - [2011-02-26 06:19] - 2616320 ____A (Microsoft Corporation) 0FB9C74046656D1579A64660AD67B746

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2011-07-15 16:02] - [2011-02-25 06:30] - 2616320 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2010-11-20 22:29] - [2010-11-20 22:29] - 2616320 ____A (Microsoft Corporation) 40D777B7A95E00593EB1568C68514493

C:\Program Files\Spybot - Search & Destroy 2\explorer.exe
[2013-01-04 04:30] - [2012-11-13 14:07] - 3906584 ____A (Safer-Networking Ltd.) E4A0900CF535888DDD85B10040CA3E34

=== End Of Search ===

mfg devil94

So, das sollte ihm schwer zu schaffen machen: ;)

Schritt 1

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

• Starte deinen Rechner erneut in die Reparaturoptionen
• Starte nun die FRST.exe erneut und klicke den Fix Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Schritt 2

Erstelle nun bitte ein neues FRST-Scan-Log.

Bitte poste in deiner nächsten Antwort

• Fixlog.txt
• FRST.txt

Sooo:

Fixlog

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 13-03-2013
Ran by SYSTEM at 2013-03-31 01:31:26 Run:1
Running from F:\

==============================================

HKEY_USERS\Administrator\Software\Microsoft\Windows\CurrentVersion\Run\\pkgndjozfpgpfzz Value deleted successfully.
HKEY_USERS\Administrator\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell Value deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default value was restored successfully .
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}] should be deleted in normal mode (if present).
C:\Users\Administrator\AppData\Roaming\skype.ini moved successfully.
C:\Users\Administrator\AppData\Roaming\desktop.ini moved successfully.
C:\ProgramData\szcvlmmrfopiwja moved successfully.
C:\ProgramData\pkgndjoz.exe moved successfully.
C:\ProgramData\ttiqexkmjhsphik moved successfully.
C:\$Recycle.Bin\S-1-5-21-1811024326-1583312281-2864969909-1000\$303fa670b122c7f9747c5881443d375b moved successfully.
C:\$Recycle.Bin\S-1-5-18\$303fa670b122c7f9747c5881443d375b moved successfully.
C:\$Recycle.Bin\S-1-5-21-1811024326-1583312281-2864969909-500\$303fa670b122c7f9747c5881443d375b deleted successfully.
C:\$Recycle.Bin\S-1-5-18\$303fa670b122c7f9747c5881443d375b not found.
C:\Windows\explorer.exe moved successfully.
C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe copied successfully to C:\Windows\explorer.exe

==== End of Fixlog ====

can result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2013 (ATTENTION: FRST version is 17 days old)
Ran by SYSTEM at 30-03-2013 22:09:07
Running from F:\
Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\FRITZWLANMini.exe [283136 2007-02-02] (AVM Berlin)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [8120864 2009-12-08] (Realtek Semiconductor)
HKLM\...\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM\...\Run: [NUSB3MON] "C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [106496 2009-11-20] (NEC Electronics Corporation)
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [636032 2012-02-14] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [37296 2012-03-27] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-03] (Adobe Systems Incorporated)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\mssecex.exe" -hide -runkey [x]
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM\...\Run: [BlueStacks Agent] C:\Program Files\BlueStacks\HD-Agent.exe [577400 2012-09-14] (BlueStack Systems, Inc.)
HKLM\...\Run: [SDTray] "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" [3825176 2012-11-13] (Safer-Networking Ltd.)
HKU\Administrator\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18705664 2013-01-08] (Skype Technologies S.A.)
HKU\Administrator\...\Run: [pkgndjozfpgpfzz] C:\Windows\pkgndjoz.exe [x]
HKU\Administrator\...\Winlogon: [Shell] explorer.exe,C:\Users\Administrator\AppData\Roaming\skype.dat [84480 2011-11-17] ()
HKU\Robert\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18705664 2013-01-08] (Skype Technologies S.A.)
HKU\Robert\...\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun [3673728 2012-11-06] (DT Soft Ltd)
HKU\Robert\...\Winlogon: [Shell] explorer.exe [x]
HKLM\...\Winlogon: [Shell] explorer.exe [2616320 2011-02-25] ()
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
Startup: C:\ProgramData\Start Menu\Programs\Startup\AML Device Install.lnk
ShortcutTarget: AML Device Install.lnk -> C:\Program Files\AMD AVT\bin\kdbsync.exe ()
Startup: C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Tom Clancy's Rainbow Six ()

==================== Services (Whitelisted) ===================

2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService [291840 2012-02-14] (Advanced Micro Devices, Inc.)
2 BstHdAndroidSvc; "C:\Program Files\BlueStacks\HD-Service.exe" BstHdAndroidSvc Android [393080 2012-09-14] (BlueStack Systems, Inc.)
2 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [384888 2012-09-14] (BlueStack Systems, Inc.)
2 Guard.Mail.ru; "C:\Program Files\Guard-ICQ\GuardICQ.exe" [1564368 2012-06-28] ()
2 IB Updater; C:\Program Files\IB Updater\ExtensionUpdaterService.exe [188760 2013-01-29] ()
2 IBUpdaterService; C:\Windows\System32\dmwu.exe [1008496 2012-10-02] ()
2 JMB36X; C:\Windows\System32\XSrvSetup.exe [65536 2009-08-06] ()
2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75136 2012-12-10] ()
2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
4 KMService; C:\Windows\system32\srvany.exe [x]
2 MsMpSvc; "c:\Program Files\Microsoft Security Client\MsMpEng.exe" [x]
3 NisSrv; "c:\Program Files\Microsoft Security Client\NisSrv.exe" [x]

==================== Drivers (Whitelisted) ====================

2 AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [46720 2012-02-01] (Advanced Micro Devices)
3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-01-26] (AVM Berlin)
2 BstHdDrv; \??\C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [63864 2012-09-14] (BlueStack Systems)
1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2012-11-27] (DT Soft Ltd)
3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-01-26] (AVM GmbH)
0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [99440 2009-10-29] (JMicron Technology Corp.)
0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [193552 2012-08-30] (Microsoft Corporation)
1 MpKsl07894b93; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl07894b93.sys [29904 2013-03-30] ()
1 MpKsl3d312dd0; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl3d312dd0.sys [29904 2013-03-30] ()
1 MpKsl9a732883; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl9a732883.sys [29904 2013-03-30] ()
1 MpKsld861874d; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsld861874d.sys [29904 2013-03-30] ()
1 MpKsle2a982e2; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsle2a982e2.sys [29904 2013-03-30] ()
3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [168480 2009-12-02] (Realtek Semiconductor Corp.)
0 speedfan; C:\Windows\System32\speedfan.sys [25240 2011-03-18] (Almico Software)
3 gdrv; \??\C:\Windows\gdrv.sys [x]
3 VGPU; C:\Windows\System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-03-31 02:47 - 2013-03-31 02:47 - 00000000 ____D C:\_OTL
2013-03-31 00:50 - 2013-03-31 02:34 - 00100434 ____A C:\OTL.Txt
2013-03-30 22:08 - 2013-03-30 22:08 - 00000000 ____D C:\FRST
2013-03-30 03:40 - 2013-03-30 03:48 - 00000004 ____A C:\Users\Administrator\AppData\Roaming\skype.ini
2013-03-27 03:49 - 2013-03-27 03:49 - 00000076 ____A C:\Users\Administrator\Desktop\1.txt
2013-03-25 23:33 - 2013-03-25 23:33 - 00400662 ____A C:\Users\Administrator\Downloads\RBGInterface.zip
2013-03-25 18:05 - 2013-03-25 18:16 - 00000000 ____D C:\Users\Administrator\Desktop\World of Warcraft
2013-03-20 15:35 - 2013-03-23 03:40 - 00009728 ____H C:\Users\Administrator\AppData\Roaming\desktop.ini
2013-03-18 21:05 - 2013-03-18 21:05 - 00003306 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.20.zip
2013-03-17 23:49 - 2013-03-30 02:00 - 00000080 ____A C:\Users\Administrator\Desktop\realms.txt
2013-03-17 16:54 - 2013-03-17 16:55 - 00003343 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.3.zip
2013-03-15 18:20 - 2013-03-23 09:00 - 00000000 __SHD C:\Users\Administrator\AppData\Local\ST6UNST #2
2013-03-15 18:20 - 2013-03-17 16:34 - 00000000 __SHD C:\Users\Administrator\Documents\DAEMON Tools Lite
2013-03-11 00:34 - 2013-03-11 00:34 - 00000000 ____D C:\ProgramData\szcvlmmrfopiwja
2013-03-11 00:34 - 2013-03-11 00:33 - 00121856 ____A C:\ProgramData\pkgndjoz.exe
2013-03-11 00:33 - 2013-03-11 00:34 - 00076318 ____A C:\ProgramData\ttiqexkmjhsphik
2013-03-09 11:17 - 2013-03-09 11:17 - 00920120 ____A C:\Windows\Minidump\030913-21450-01.dmp
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl.zip
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl (1).zip

==================== One Month Modified Files and Folders ========

2013-03-31 02:47 - 2013-03-31 02:47 - 00000000 ____D C:\_OTL
2013-03-31 02:34 - 2013-03-31 00:50 - 00100434 ____A C:\OTL.Txt
2013-03-31 00:45 - 2013-01-14 17:26 - 00000000 ____D C:\users\Administrator
2013-03-31 00:45 - 2012-03-13 17:32 - 00000000 ____D C:\users\Robert
2013-03-30 22:08 - 2013-03-30 22:08 - 00000000 ____D C:\FRST
2013-03-30 18:12 - 2013-01-04 08:49 - 00043704 ____A C:\Windows\setupact.log
2013-03-30 18:10 - 2009-07-14 05:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-03-30 15:40 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-03-30 15:40 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-03-30 03:48 - 2013-03-30 03:40 - 00000004 ____A C:\Users\Administrator\AppData\Roaming\skype.ini
2013-03-30 03:35 - 2013-01-14 17:28 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Skype
2013-03-30 02:00 - 2013-03-17 23:49 - 00000080 ____A C:\Users\Administrator\Desktop\realms.txt
2013-03-30 01:54 - 2013-02-06 15:37 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\TS3Client
2013-03-30 00:00 - 2012-03-13 21:11 - 00000000 ____D C:\Program Files\SpeedFan
2013-03-29 16:50 - 2013-01-14 22:47 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\vlc
2013-03-29 14:58 - 2012-03-13 17:32 - 01513695 ____A C:\Windows\WindowsUpdate.log
2013-03-27 03:49 - 2013-03-27 03:49 - 00000076 ____A C:\Users\Administrator\Desktop\1.txt
2013-03-26 18:23 - 2012-06-12 14:57 - 00000000 ____D C:\Users\Administrator\Desktop\Bewerbungen Robert
2013-03-25 23:33 - 2013-03-25 23:33 - 00400662 ____A C:\Users\Administrator\Downloads\RBGInterface.zip
2013-03-25 18:16 - 2013-03-25 18:05 - 00000000 ____D C:\Users\Administrator\Desktop\World of Warcraft
2013-03-23 14:10 - 2010-11-20 22:01 - 01621244 ____A C:\Windows\System32\PerfStringBackup.INI
2013-03-23 09:00 - 2013-03-15 18:20 - 00000000 __SHD C:\Users\Administrator\AppData\Local\ST6UNST #2
2013-03-23 03:40 - 2013-03-20 15:35 - 00009728 ____H C:\Users\Administrator\AppData\Roaming\desktop.ini
2013-03-18 23:00 - 2012-03-13 23:04 - 00000000 ____D C:\Users\Administrator\Desktop\Eigene Filme
2013-03-18 21:05 - 2013-03-18 21:05 - 00003306 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.20.zip
2013-03-17 16:55 - 2013-03-17 16:54 - 00003343 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.3.zip
2013-03-17 16:34 - 2013-03-15 18:20 - 00000000 __SHD C:\Users\Administrator\Documents\DAEMON Tools Lite
2013-03-11 00:34 - 2013-03-11 00:34 - 00000000 ____D C:\ProgramData\szcvlmmrfopiwja
2013-03-11 00:34 - 2013-03-11 00:33 - 00076318 ____A C:\ProgramData\ttiqexkmjhsphik
2013-03-11 00:33 - 2013-03-11 00:34 - 00121856 ____A C:\ProgramData\pkgndjoz.exe
2013-03-10 20:55 - 2012-03-14 23:43 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-03-09 11:17 - 2013-03-09 11:17 - 00920120 ____A C:\Windows\Minidump\030913-21450-01.dmp
2013-03-09 11:17 - 2012-04-08 23:42 - 302044857 ____A C:\Windows\MEMORY.DMP
2013-03-09 11:17 - 2012-04-08 23:42 - 00000000 ____D C:\Windows\Minidump
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl.zip
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl (1).zip
2013-03-01 09:21 - 2012-12-03 01:55 - 00000000 ____D C:\Program Files\IB Updater

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1811024326-1583312281-2864969909-1000\$303fa670b122c7f9747c5881443d375b

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$303fa670b122c7f9747c5881443d375b

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1811024326-1583312281-2864969909-500\$303fa670b122c7f9747c5881443d375b

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$303fa670b122c7f9747c5881443d375b

==================== Known DLLs (Whitelisted) =================


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2011-07-15 16:02] - [2011-02-25 06:30] - 2616320 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\explorer.exe IS INFECTED. <===== ATTENTION!

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2012-12-29 11:52:54
Restore point made on: 2013-01-06 04:20:55
Restore point made on: 2013-01-15 17:51:08
Restore point made on: 2013-01-22 19:08:56
Restore point made on: 2013-02-03 18:23:50
Restore point made on: 2013-02-15 02:20:50
Restore point made on: 2013-02-22 15:35:13
Restore point made on: 2013-03-02 17:55:05
Restore point made on: 2013-03-10 10:28:41
Restore point made on: 2013-03-23 09:05:11

==================== Memory info ===========================

Percentage of memory in use: 12%
Total physical RAM: 4094.49 MB
Available physical RAM: 3566.2 MB
Total Pagefile: 4092.78 MB
Available Pagefile: 3566.35 MB
Total Virtual: 2047.88 MB
Available Virtual: 1960.68 MB

==================== Partitions =============================

1 Drive c: () (Fixed) (Total:465.66 GB) (Free:62.34 GB) NTFS
3 Drive f: () (Removable) (Total:14.44 GB) (Free:14.44 GB) FAT32
4 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
5 Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Datentr„ger ### Status Gr”áe Frei Dyn GPT
--------------- ------------- ------- ------- --- ---
Datentr„ger 0 Online 465 GB 0 B
Datentr„ger 1 Online 14 GB 0 B

Partitions of Disk 0:
===============

Datentr„ger-ID: 290F0B0B

Partition ### Typ GrӇe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 100 MB 1024 KB
Partition 2 Prim„r 465 GB 101 MB

=========================================================

Disk: 0
Partition 1
Typ : 07
Versteckt: Nein
Aktiv : Ja

Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y System-rese NTFS Partition 100 MB Fehlerfre

=========================================================

Disk: 0
Partition 2
Typ : 07
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 465 GB Fehlerfre

=========================================================

Partitions of Disk 1:
===============

Datentr„ger-ID: 2D653D85

Partition ### Typ GrӇe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 14 GB 1704 KB

=========================================================

Disk: 1
Partition 1
Typ : 0B
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F FAT32 Wechselmed 14 GB Fehlerfre

=========================================================
============================== MBR Partition Table ==================

==============================
Partitions of Disk 0:
===============
Disk ID: 290F0B0B

Partition 1:
=========
Hex: 8020210007DF130C0008000000200300
Active: YES
Type: 07 (NTFS)
Size: 100 MB

Partition 2:
=========
Hex: 00DF140C07FEFFFF002803000030353A
Active: NO
Type: 07 (NTFS)
Size: 466 GB

==============================
Partitions of Disk 1:
===============
Disk ID: 2D653D85

Partition 1:
=========
Hex: 003607000BBBDD5E500D0000B072CE01
Active: NO
Type: 0B
Size: 14 GB


Last Boot: 2013-03-23 08:57

==================== End Of Log ============================

Hoffentlich wird mein rechner bis Dienstag wieder laufen.

mfg devil94

Du hast mir wieder die alte FRST.txt gepostet. Lösche die alte FRST.txt vom Stick und lasse bitte einen neuen Scan laufen. Poste mir danach die -neue- FRST.txt.

Es wurde keine frst.txt erstellt - habs eben nochmal gescannt
nur ne fixlog.txt wurde nochmal erstellt aufm USB stick

Bist du sicher, dass du auf Scan gedrückt hast?

Lösche mal alles vom USB-Stick, lade dir eine neue FRST.exe herunter und kopiere sie auf den Stick. Führe dann einen Scan aus und poste das Logfile (wie hier beschrieben).

Fehler war auf meiner Seite, habe auf Fix anstatt Scan gedrückt.
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2013 (ATTENTION: FRST version is 18 days old)
Ran by SYSTEM at 31-03-2013 01:59:31
Running from F:\
Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\FRITZWLANMini.exe [283136 2007-02-02] (AVM Berlin)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [8120864 2009-12-08] (Realtek Semiconductor)
HKLM\...\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM\...\Run: [NUSB3MON] "C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [106496 2009-11-20] (NEC Electronics Corporation)
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [636032 2012-02-14] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [37296 2012-03-27] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-03] (Adobe Systems Incorporated)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\mssecex.exe" -hide -runkey [x]
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM\...\Run: [BlueStacks Agent] C:\Program Files\BlueStacks\HD-Agent.exe [577400 2012-09-14] (BlueStack Systems, Inc.)
HKLM\...\Run: [SDTray] "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" [3825176 2012-11-13] (Safer-Networking Ltd.)
HKU\Administrator\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18705664 2013-01-08] (Skype Technologies S.A.)
HKU\Robert\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18705664 2013-01-08] (Skype Technologies S.A.)
HKU\Robert\...\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun [3673728 2012-11-06] (DT Soft Ltd)
HKU\Robert\...\Winlogon: [Shell] explorer.exe [x]
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
Startup: C:\ProgramData\Start Menu\Programs\Startup\AML Device Install.lnk
ShortcutTarget: AML Device Install.lnk -> C:\Program Files\AMD AVT\bin\kdbsync.exe ()
Startup: C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Tom Clancy's Rainbow Six ()

==================== Services (Whitelisted) ===================

2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService [291840 2012-02-14] (Advanced Micro Devices, Inc.)
2 BstHdAndroidSvc; "C:\Program Files\BlueStacks\HD-Service.exe" BstHdAndroidSvc Android [393080 2012-09-14] (BlueStack Systems, Inc.)
2 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [384888 2012-09-14] (BlueStack Systems, Inc.)
2 Guard.Mail.ru; "C:\Program Files\Guard-ICQ\GuardICQ.exe" [1564368 2012-06-28] ()
2 IB Updater; C:\Program Files\IB Updater\ExtensionUpdaterService.exe [188760 2013-01-29] ()
2 IBUpdaterService; C:\Windows\System32\dmwu.exe [1008496 2012-10-02] ()
2 JMB36X; C:\Windows\System32\XSrvSetup.exe [65536 2009-08-06] ()
2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75136 2012-12-10] ()
2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
4 KMService; C:\Windows\system32\srvany.exe [x]
2 MsMpSvc; "c:\Program Files\Microsoft Security Client\MsMpEng.exe" [x]
3 NisSrv; "c:\Program Files\Microsoft Security Client\NisSrv.exe" [x]

==================== Drivers (Whitelisted) ====================

2 AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [46720 2012-02-01] (Advanced Micro Devices)
3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-01-26] (AVM Berlin)
2 BstHdDrv; \??\C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [63864 2012-09-14] (BlueStack Systems)
1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2012-11-27] (DT Soft Ltd)
3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-01-26] (AVM GmbH)
0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [99440 2009-10-29] (JMicron Technology Corp.)
0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [193552 2012-08-30] (Microsoft Corporation)
1 MpKsl07894b93; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl07894b93.sys [29904 2013-03-30] ()
1 MpKsl3d312dd0; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl3d312dd0.sys [29904 2013-03-30] ()
1 MpKsl9a732883; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl9a732883.sys [29904 2013-03-30] ()
1 MpKsld861874d; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsld861874d.sys [29904 2013-03-30] ()
1 MpKsle2a982e2; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsle2a982e2.sys [29904 2013-03-30] ()
3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [168480 2009-12-02] (Realtek Semiconductor Corp.)
0 speedfan; C:\Windows\System32\speedfan.sys [25240 2011-03-18] (Almico Software)
3 gdrv; \??\C:\Windows\gdrv.sys [x]
3 VGPU; C:\Windows\System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-03-31 02:47 - 2013-03-31 02:47 - 00000000 ____D C:\_OTL
2013-03-31 00:50 - 2013-03-31 02:34 - 00100434 ____A C:\OTL.Txt
2013-03-30 22:08 - 2013-03-31 01:31 - 00000000 ____D C:\FRST
2013-03-27 03:49 - 2013-03-27 03:49 - 00000076 ____A C:\Users\Administrator\Desktop\1.txt
2013-03-25 23:33 - 2013-03-25 23:33 - 00400662 ____A C:\Users\Administrator\Downloads\RBGInterface.zip
2013-03-25 18:05 - 2013-03-25 18:16 - 00000000 ____D C:\Users\Administrator\Desktop\World of Warcraft
2013-03-18 21:05 - 2013-03-18 21:05 - 00003306 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.20.zip
2013-03-17 23:49 - 2013-03-30 02:00 - 00000080 ____A C:\Users\Administrator\Desktop\realms.txt
2013-03-17 16:54 - 2013-03-17 16:55 - 00003343 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.3.zip
2013-03-15 18:20 - 2013-03-23 09:00 - 00000000 __SHD C:\Users\Administrator\AppData\Local\ST6UNST #2
2013-03-15 18:20 - 2013-03-17 16:34 - 00000000 __SHD C:\Users\Administrator\Documents\DAEMON Tools Lite
2013-03-09 11:17 - 2013-03-09 11:17 - 00920120 ____A C:\Windows\Minidump\030913-21450-01.dmp
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl.zip
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl (1).zip

==================== One Month Modified Files and Folders ========

2013-03-31 02:47 - 2013-03-31 02:47 - 00000000 ____D C:\_OTL
2013-03-31 02:34 - 2013-03-31 00:50 - 00100434 ____A C:\OTL.Txt
2013-03-31 01:31 - 2013-03-30 22:08 - 00000000 ____D C:\FRST
2013-03-31 01:29 - 2013-01-04 08:49 - 00044762 ____A C:\Windows\setupact.log
2013-03-31 01:29 - 2009-07-14 05:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-03-31 00:45 - 2013-01-14 17:26 - 00000000 ____D C:\users\Administrator
2013-03-31 00:45 - 2012-03-13 17:32 - 00000000 ____D C:\users\Robert
2013-03-30 15:40 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-03-30 15:40 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-03-30 03:35 - 2013-01-14 17:28 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Skype
2013-03-30 02:00 - 2013-03-17 23:49 - 00000080 ____A C:\Users\Administrator\Desktop\realms.txt
2013-03-30 01:54 - 2013-02-06 15:37 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\TS3Client
2013-03-30 00:00 - 2012-03-13 21:11 - 00000000 ____D C:\Program Files\SpeedFan
2013-03-29 16:50 - 2013-01-14 22:47 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\vlc
2013-03-29 14:58 - 2012-03-13 17:32 - 01513695 ____A C:\Windows\WindowsUpdate.log
2013-03-27 03:49 - 2013-03-27 03:49 - 00000076 ____A C:\Users\Administrator\Desktop\1.txt
2013-03-26 18:23 - 2012-06-12 14:57 - 00000000 ____D C:\Users\Administrator\Desktop\Bewerbungen Robert
2013-03-25 23:33 - 2013-03-25 23:33 - 00400662 ____A C:\Users\Administrator\Downloads\RBGInterface.zip
2013-03-25 18:16 - 2013-03-25 18:05 - 00000000 ____D C:\Users\Administrator\Desktop\World of Warcraft
2013-03-23 14:10 - 2010-11-20 22:01 - 01621244 ____A C:\Windows\System32\PerfStringBackup.INI
2013-03-23 09:00 - 2013-03-15 18:20 - 00000000 __SHD C:\Users\Administrator\AppData\Local\ST6UNST #2
2013-03-18 23:00 - 2012-03-13 23:04 - 00000000 ____D C:\Users\Administrator\Desktop\Eigene Filme
2013-03-18 21:05 - 2013-03-18 21:05 - 00003306 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.20.zip
2013-03-17 16:55 - 2013-03-17 16:54 - 00003343 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.3.zip
2013-03-17 16:34 - 2013-03-15 18:20 - 00000000 __SHD C:\Users\Administrator\Documents\DAEMON Tools Lite
2013-03-10 20:55 - 2012-03-14 23:43 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-03-09 11:17 - 2013-03-09 11:17 - 00920120 ____A C:\Windows\Minidump\030913-21450-01.dmp
2013-03-09 11:17 - 2012-04-08 23:42 - 302044857 ____A C:\Windows\MEMORY.DMP
2013-03-09 11:17 - 2012-04-08 23:42 - 00000000 ____D C:\Windows\Minidump
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl.zip
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl (1).zip
2013-03-01 09:21 - 2012-12-03 01:55 - 00000000 ____D C:\Program Files\IB Updater

==================== Known DLLs (Whitelisted) =================


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2011-07-15 16:02] - [2011-02-26 06:19] - 2616320 ____A (Microsoft Corporation) 0FB9C74046656D1579A64660AD67B746

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2012-12-29 11:52:54
Restore point made on: 2013-01-06 04:20:55
Restore point made on: 2013-01-15 17:51:08
Restore point made on: 2013-01-22 19:08:56
Restore point made on: 2013-02-03 18:23:50
Restore point made on: 2013-02-15 02:20:50
Restore point made on: 2013-02-22 15:35:13
Restore point made on: 2013-03-02 17:55:05
Restore point made on: 2013-03-10 10:28:41
Restore point made on: 2013-03-23 09:05:11

==================== Memory info ===========================

Percentage of memory in use: 12%
Total physical RAM: 4094.49 MB
Available physical RAM: 3575.69 MB
Total Pagefile: 4092.78 MB
Available Pagefile: 3575.18 MB
Total Virtual: 2047.88 MB
Available Virtual: 1961.6 MB

==================== Partitions =============================

1 Drive c: () (Fixed) (Total:465.66 GB) (Free:62.34 GB) NTFS
3 Drive f: () (Removable) (Total:14.44 GB) (Free:14.44 GB) FAT32
4 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
5 Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Datentr„ger ### Status Gr”áe Frei Dyn GPT
--------------- ------------- ------- ------- --- ---
Datentr„ger 0 Online 465 GB 0 B
Datentr„ger 1 Online 14 GB 0 B

Partitions of Disk 0:
===============

Datentr„ger-ID: 290F0B0B

Partition ### Typ GrӇe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 100 MB 1024 KB
Partition 2 Prim„r 465 GB 101 MB

=========================================================

Disk: 0
Partition 1
Typ : 07
Versteckt: Nein
Aktiv : Ja

Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y System-rese NTFS Partition 100 MB Fehlerfre

=========================================================

Disk: 0
Partition 2
Typ : 07
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 465 GB Fehlerfre

=========================================================

Partitions of Disk 1:
===============

Datentr„ger-ID: 2D653D85

Partition ### Typ GrӇe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 14 GB 1704 KB

=========================================================

Disk: 1
Partition 1
Typ : 0B
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F FAT32 Wechselmed 14 GB Fehlerfre

=========================================================
============================== MBR Partition Table ==================

==============================
Partitions of Disk 0:
===============
Disk ID: 290F0B0B

Partition 1:
=========
Hex: 8020210007DF130C0008000000200300
Active: YES
Type: 07 (NTFS)
Size: 100 MB

Partition 2:
=========
Hex: 00DF140C07FEFFFF002803000030353A
Active: NO
Type: 07 (NTFS)
Size: 466 GB

==============================
Partitions of Disk 1:
===============
Disk ID: 2D653D85

Partition 1:
=========
Hex: 003607000BBBDD5E500D0000B072CE01
Active: NO
Type: 0B
Size: 14 GB


Last Boot: 2013-03-23 08:57

==================== End Of Log ============================

Tut mir leid
mfg devil

Kein Ding ;)

Du solltest jetzt wieder in den normalen Modus booten können.

Mache dort bitte Folgendes:

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)

• Doppelklick auf die OTL.exe
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
• Unter Extra Registry, wähle bitte Use SafeList
• Klicke nun auf Run Scan links oben
• Wenn der Scan beendet wurde werden 2 Logfiles erstellt
• Poste die Logfiles hier in den Thread.

Die eine .txt-dateiOTL EXTRAS Logfile:
--- --- ---

die andere habe ich nicht gefunden wie sollte die den heißen oder abgespeichert werden?
mfg devil

Sie sollte OTL.txt heißen...

TL logfile created on: 3/30/2013 9:32:25 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Windows 7 Ultimate Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): c:\pagefile.sys 4096 4096 [binary data]

%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files
Drive C: | 100.00 Mb Total Space | 75.52 Mb Free Space | 75.53% Space Free | Partition Type: NTFS
Drive D: | 14.44 Gb Total Space | 14.44 Gb Free Space | 100.00% Space Free | Partition Type: FAT32
Drive E: | 465.66 Gb Total Space | 62.41 Gb Free Space | 13.40% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled] -- -- (KMService)
SRV - [2013/01/29 09:29:00 | 000,188,760 | ---- | M] () [Auto] -- E:\Program Files\IB Updater\ExtensionUpdaterService.exe -- (IB Updater)
SRV - [2013/01/08 07:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto] -- E:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/11/13 09:07:24 | 000,168,384 | ---- | M] (Safer-Networking Ltd.) [Auto] -- E:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe -- (SDWSCService)
SRV - [2012/11/13 09:07:20 | 001,369,624 | ---- | M] (Safer-Networking Ltd.) [Auto] -- E:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe -- (SDUpdateService)
SRV - [2012/11/13 09:07:16 | 001,103,392 | ---- | M] (Safer-Networking Ltd.) [Auto] -- E:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe -- (SDScannerService)
SRV - [2012/10/02 11:20:26 | 001,008,496 | ---- | M] () [Auto] -- E:\Windows\System32\dmwu.exe -- (IBUpdaterService)
SRV - [2012/09/20 08:28:48 | 030,785,672 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2012/09/14 10:24:40 | 000,384,888 | ---- | M] (BlueStack Systems, Inc.) [Auto] -- E:\Program Files\BlueStacks\HD-LogRotatorService.exe -- (BstHdLogRotatorSvc)
SRV - [2012/09/14 10:24:16 | 000,393,080 | ---- | M] (BlueStack Systems, Inc.) [Auto] -- E:\Program Files\BlueStacks\HD-Service.exe -- (BstHdAndroidSvc)
SRV - [2012/09/12 11:25:24 | 000,287,824 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012/09/12 11:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/08/29 17:57:12 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand] -- E:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/06/28 18:33:50 | 001,564,368 | ---- | M] () [Auto] -- E:\Program Files\Guard-ICQ\GuardICQ.exe -- (Guard.Mail.ru)
SRV - [2012/02/14 23:12:48 | 000,163,328 | ---- | M] (AMD) [Auto] -- E:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012/02/14 17:15:30 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) [Auto] -- E:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV - [2009/08/06 01:51:20 | 000,065,536 | R--- | M] () [Auto] -- E:\Windows\System32\XSrvSetup.exe -- (JMB36X)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (VGPU)
DRV - File not found [Kernel | On_Demand] -- -- (gdrv)
DRV - [2013/03/30 13:04:25 | 000,029,904 | ---- | M] () [Kernel | System] -- E:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl9a732883.sys -- (MpKsl9a732883)
DRV - [2013/03/30 11:10:08 | 000,029,904 | ---- | M] () [Kernel | System] -- E:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl07894b93.sys -- (MpKsl07894b93)
DRV - [2013/03/30 00:05:01 | 000,029,904 | ---- | M] () [Kernel | System] -- E:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl3d312dd0.sys -- (MpKsl3d312dd0)
DRV - [2013/03/29 23:53:14 | 000,029,904 | ---- | M] () [Kernel | System] -- E:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsle2a982e2.sys -- (MpKsle2a982e2)
DRV - [2013/03/29 23:38:06 | 000,029,904 | ---- | M] () [Kernel | System] -- E:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsld861874d.sys -- (MpKsld861874d)
DRV - [2012/11/27 16:25:33 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System] -- E:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2012/09/14 10:24:24 | 000,063,864 | ---- | M] (BlueStack Systems) [Kernel | Auto] -- E:\Program Files\BlueStacks\HD-Hypervisor-x86.sys -- (BstHdDrv)
DRV - [2012/08/30 16:03:50 | 000,099,272 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- E:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2012/02/14 23:47:12 | 009,182,208 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2012/02/14 23:47:12 | 009,182,208 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2012/02/14 22:12:48 | 000,264,704 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2012/02/01 09:18:10 | 000,046,720 | ---- | M] (Advanced Micro Devices) [Kernel | Auto] -- E:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\aoddriver2.sys -- (AODDriver4.1)
DRV - [2011/03/18 12:08:54 | 000,025,240 | ---- | M] (Almico Software) [Kernel | Boot] -- E:\Windows\System32\speedfan.sys -- (speedfan)
DRV - [2011/02/08 06:03:54 | 001,882,624 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2010/11/20 17:29:34 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010/11/20 17:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 17:29:03 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 17:29:03 | 000,112,640 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\tsusbhub.sys -- (tsusbhub)
DRV - [2010/11/20 17:29:03 | 000,077,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\Synth3dVsc.sys -- (Synth3dVsc)
DRV - [2010/11/20 17:29:03 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\dmvsc.sys -- (dmvsc)
DRV - [2010/11/20 17:29:03 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- E:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 17:29:03 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 17:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV - [2010/11/20 17:29:03 | 000,025,600 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\terminpt.sys -- (terminpt)
DRV - [2010/11/20 17:29:03 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 17:29:03 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/02/18 04:18:22 | 000,037,944 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand] -- E:\Windows\System32\drivers\amdiox86.sys -- (amdiox86)
DRV - [2009/12/02 03:01:06 | 000,168,480 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\RtHDMIV.sys -- (RTHDMIAzAudService)
DRV - [2009/11/20 07:15:18 | 000,137,728 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV - [2009/11/20 07:15:16 | 000,058,880 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\nusb3hub.sys -- (nusb3hub)
DRV - [2009/10/29 04:14:32 | 000,099,440 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot] -- E:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2007/01/25 20:00:00 | 000,265,088 | ---- | M] (AVM GmbH) [Kernel | On_Demand] -- E:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV - [2007/01/25 20:00:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand] -- E:\Windows\System32\drivers\avmeject.sys -- (avmeject)
DRV - [1996/04/03 15:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot] -- E:\Windows\System32\giveio.sys -- (giveio)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {78e516ef-11de-47a1-8364-a99b917ec5ee} - E:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.)


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Administrator_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\Administrator_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Administrator_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\Administrator_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C9 5E 1C 2C 75 F2 CD 01 [binary data]
IE - HKU\Administrator_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\Robert_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\Robert_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Robert_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\Robert_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 4C AF 4B 45 37 01 CD 01 [binary data]
IE - HKU\Robert_ON_E\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\Robert_ON_E\..\URLSearchHook: {78e516ef-11de-47a1-8364-a99b917ec5ee} - E:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.)
IE - HKU\Robert_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://mystart.incredibar.com/mb128?a=6PQRxFiXXD&i=26"
FF - prefs.js..keyword.URL: "hxxp://mystart.incredibar.com/mb128/?loc=IB_DS&a=6PQRxFiXXD&&i=26&search="


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: E:\Windows\System32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: E:\Windows\System32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: E:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: E:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: E:\Program Files\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: E:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: E:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\IB Updater\Firefox [2013/02/28 10:57:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}: C:\Program Files\IB Updater\Firefox [2013/02/28 10:57:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/08/29 22:20:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2012/03/13 13:00:09 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Robert\AppData\Roaming\Mozilla\Extensions
[2012/12/02 20:55:46 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\extensions
[2012/07/25 09:56:32 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012/12/02 20:55:46 | 000,000,000 | ---D | M] (incredibar.com) -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\extensions\ffxtlbr@incredibar.com
[2012/12/02 20:51:04 | 000,000,000 | ---D | M] (Yontoo) -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\extensions\plugin@yontoo.com
[2012/08/23 09:27:37 | 000,000,950 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\icqplugin-1.xml
[2012/07/25 14:20:43 | 000,000,950 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\icqplugin-2.xml
[2012/07/24 08:48:30 | 000,000,168 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\icqplugin.gif
[2012/07/24 08:48:30 | 000,000,618 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\icqplugin.src
[2012/07/13 05:03:49 | 000,001,056 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\icqplugin.xml
[2012/12/02 20:53:12 | 000,002,203 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\MyStart Search.xml
[2012/08/29 22:20:54 | 000,000,000 | ---D | M] (No name found) -- E:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
[2012/08/24 22:00:05 | 000,266,720 | ---- | M] (Mozilla Foundation) -- E:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/08/24 22:49:52 | 000,001,392 | ---- | M] () -- E:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/08/24 22:49:52 | 000,001,153 | ---- | M] () -- E:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012/08/24 22:49:52 | 000,006,805 | ---- | M] () -- E:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/08/24 22:49:52 | 000,001,178 | ---- | M] () -- E:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/08/24 22:49:52 | 000,001,105 | ---- | M] () -- E:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | ---- | M]) - E:\Windows\System32\drivers\etc\hosts
O2 - BHO: (ICQ Sparberater) - {0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD} - E:\Program Files\icq\Internet Explorer\icq.dll (solute gmbh)
O2 - BHO: (IB Updater) - {336D0C35-8A85-403a-B9D2-65C292C39087} - E:\Program Files\IB Updater\Extension32.dll ()
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - E:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - File not found
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (FileConverter 1.3 Toolbar) - {78e516ef-11de-47a1-8364-a99b917ec5ee} - E:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - E:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - File not found
O3 - HKLM\..\Toolbar: (FileConverter 1.3 Toolbar) - {78e516ef-11de-47a1-8364-a99b917ec5ee} - E:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - File not found
O3 - HKU\Robert_ON_E\..\Toolbar\WebBrowser: (FileConverter 1.3 Toolbar) - {78E516EF-11DE-47A1-8364-A99B917EC5EE} - E:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.)
O4 - HKLM..\Run: [AVMWlanClient] E:\Program Files\avmwlanstick\FRITZWLANMini.exe (AVM Berlin)
O4 - HKLM..\Run: [BCSSync] E:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [BlueStacks Agent] E:\Program Files\BlueStacks\HD-Agent.exe (BlueStack Systems, Inc.)
O4 - HKLM..\Run: [JMB36X IDE Setup] E:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [MSC] File not found
O4 - HKLM..\Run: [NUSB3MON] E:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation)
O4 - HKLM..\Run: [SDTray] E:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [StartCCC] E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\Administrator_ON_E..\Run: [pkgndjozfpgpfzz] File not found
O4 - HKU\Robert_ON_E..\Run: [DAEMON Tools Lite] E:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\LocalService_ON_E..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_E..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: E:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Tom Clancy's Rainbow Six ()
F3 - HKU\Administrator_ON_E WinNT: Run - (C:\Users\ADMINI~1\DOCUME~1\DAEMON~1\DAEMON~1.EXE) - File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\Administrator_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Robert_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Robert_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O8 - Extra context menu item: An OneNote s&enden - E:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - E:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - E:\Program Files\ICQ7M\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - E:\Program Files\ICQ7M\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - E:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - E:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.6.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - E:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - E:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O20 - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe ()
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKU\Administrator_ON_E Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe ()
O20 - HKU\Administrator_ON_E Winlogon: Shell - (C:\Users\Administrator\AppData\Roaming\skype.dat) - E:\Users\Administrator\AppData\Roaming\skype.dat ()
O20 - HKU\Robert_ON_E Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe ()
O20 - Winlogon\Notify\SDWinLogon: DllName - SDWinLogon.dll - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - E:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - E:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{72ccbb9c-6d29-11e1-9e53-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{72ccbb9c-6d29-11e1-9e53-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup.exe
O33 - MountPoints2\{85b57e7c-38cc-11e2-9911-bc05430293a4}\Shell - "" = AutoRun
O33 - MountPoints2\{85b57e7c-38cc-11e2-9911-bc05430293a4}\Shell\AutoRun\command - "" = F:\launcher.exe
O33 - MountPoints2\{ed260521-6d29-11e1-af58-6cf049b829f3}\Shell - "" = AutoRun
O33 - MountPoints2\{ed260521-6d29-11e1-af58-6cf049b829f3}\Shell\AutoRun\command - "" = E:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2013/03/30 21:30:43 | 000,000,000 | -HSD | C] -- E:\RECYCLER
[2013/03/25 13:05:39 | 000,000,000 | ---D | C] -- E:\Users\Administrator\Desktop\World of Warcraft
[2013/03/15 13:20:34 | 000,000,000 | -HSD | C] -- E:\Users\Administrator\AppData\Local\ST6UNST #2
[2013/03/15 13:20:27 | 000,000,000 | -HSD | C] -- E:\Users\Administrator\Documents\DAEMON Tools Lite
[2013/03/10 19:34:14 | 000,000,000 | ---D | C] -- E:\ProgramData\szcvlmmrfopiwja
[2012/11/18 06:17:28 | 000,929,844 | ---- | C] (Microsoft Corporation) -- E:\Program Files\MFC42D.DLL
[2012/11/18 06:17:28 | 000,798,773 | ---- | C] (Microsoft Corporation) -- E:\Program Files\MFCO42D.DLL
[2012/11/18 06:17:28 | 000,434,252 | ---- | C] (Microsoft Corporation) -- E:\Program Files\MSVCRTD.DLL
[2012/11/18 06:17:28 | 000,421,888 | ---- | C] (Microsoft Corporation) -- E:\Program Files\MSVCRT.DLL
[2012/11/18 06:17:27 | 000,069,632 | ---- | C] (MAX - DESIGN) -- E:\Program Files\Max_Sound.dll
[2012/11/18 06:16:58 | 000,430,080 | ---- | C] (MAX - DESIGN) -- E:\Program Files\CompLogic.dll
[2012/11/18 06:16:55 | 000,593,920 | ---- | C] (MAX DESIGN) -- E:\Program Files\AnnoFrame.dll
[2012/11/18 06:16:12 | 000,933,331 | ---- | C] (MAX DESIGN) -- E:\Program Files\1503Startup.exe
[2011/05/12 07:53:30 | 000,147,456 | ---- | C] ( ) -- E:\Windows\System32\lagarith.dll
[2010/10/16 13:00:54 | 007,970,816 | ---- | C] (home) -- E:\Program Files\Hero Editor.exe
[2010/02/03 19:00:00 | 000,139,264 | ---- | C] ( ) -- E:\Windows\sipr3260.dll

========== Files - Modified Within 30 Days ==========

[2013/03/30 13:12:53 | 000,067,584 | --S- | M] () -- E:\Windows\bootstat.dat
[2013/03/30 13:10:35 | 2616,057,856 | -HS- | M] () -- E:\hiberfil.sys
[2013/03/30 10:40:57 | 000,026,544 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/03/30 10:40:57 | 000,026,544 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/03/29 22:48:27 | 000,000,004 | ---- | M] () -- E:\Users\Administrator\AppData\Roaming\skype.ini
[2013/03/23 16:51:03 | 000,195,718 | ---- | M] () -- E:\Users\Administrator\Documents\614860_274164932689356_1623987283_o.jpg
[2013/03/23 09:10:41 | 000,700,168 | ---- | M] () -- E:\Windows\System32\perfh007.dat
[2013/03/23 09:10:41 | 000,654,880 | ---- | M] () -- E:\Windows\System32\perfh009.dat
[2013/03/23 09:10:41 | 000,148,964 | ---- | M] () -- E:\Windows\System32\perfc007.dat
[2013/03/23 09:10:41 | 000,121,752 | ---- | M] () -- E:\Windows\System32\perfc009.dat
[2013/03/17 11:47:18 | 000,540,468 | ---- | M] () -- E:\Users\Administrator\Documents\WoWScrnShot_031713_164614.jpg
[2013/03/10 19:34:14 | 000,076,318 | ---- | M] () -- E:\ProgramData\ttiqexkmjhsphik
[2013/03/10 19:33:53 | 000,121,856 | ---- | M] () -- E:\ProgramData\pkgndjoz.exe
[2013/03/09 06:17:13 | 302,044,857 | ---- | M] () -- E:\Windows\MEMORY.DMP

========== Files Created - No Company Name ==========

[2013/03/29 22:40:03 | 000,000,004 | ---- | C] () -- E:\Users\Administrator\AppData\Roaming\skype.ini
[2013/03/23 16:49:00 | 000,195,718 | ---- | C] () -- E:\Users\Administrator\Documents\614860_274164932689356_1623987283_o.jpg
[2013/03/17 11:46:59 | 000,540,468 | ---- | C] () -- E:\Users\Administrator\Documents\WoWScrnShot_031713_164614.jpg
[2013/03/10 19:34:11 | 000,121,856 | ---- | C] () -- E:\ProgramData\pkgndjoz.exe
[2013/03/10 19:33:53 | 000,076,318 | ---- | C] () -- E:\ProgramData\ttiqexkmjhsphik
[2013/01/16 01:10:53 | 000,007,168 | ---- | C] () -- E:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/12/20 12:40:13 | 000,021,840 | ---- | C] () -- E:\Windows\System32\SIntfNT.dll
[2012/12/20 12:40:13 | 000,017,212 | ---- | C] () -- E:\Windows\System32\SIntf32.dll
[2012/12/20 12:40:13 | 000,012,067 | ---- | C] () -- E:\Windows\System32\SIntf16.dll
[2012/12/13 17:57:45 | 000,000,004 | ---- | C] () -- E:\Users\Robert\AppData\Roaming\skype.ini
[2012/12/02 20:55:06 | 001,008,496 | ---- | C] () -- E:\Windows\System32\dmwu.exe
[2012/12/02 20:55:06 | 000,028,160 | ---- | C] () -- E:\Windows\System32\ImHttpComm.dll
[2012/11/18 06:17:28 | 000,708,608 | ---- | C] () -- E:\Program Files\View.dll
[2012/11/18 06:17:28 | 000,233,472 | ---- | C] () -- E:\Program Files\SAVRepair.exe
[2012/11/18 06:17:28 | 000,043,279 | ---- | C] () -- E:\Program Files\Texte.dat
[2012/11/18 06:17:27 | 002,519,642 | ---- | C] () -- E:\Program Files\Handbuch.pdf
[2012/11/18 06:17:26 | 025,305,841 | ---- | C] () -- E:\Program Files\FigurenHeader.dat
[2012/11/18 06:17:25 | 014,289,592 | ---- | C] () -- E:\Program Files\Figuren200.dat
[2012/11/18 06:17:23 | 016,039,347 | ---- | C] () -- E:\Program Files\Figuren102.dat
[2012/11/18 06:17:21 | 016,777,177 | ---- | C] () -- E:\Program Files\Figuren101.dat
[2012/11/18 06:17:19 | 016,777,198 | ---- | C] () -- E:\Program Files\Figuren100.dat
[2012/11/18 06:17:18 | 011,190,229 | ---- | C] () -- E:\Program Files\Figuren009.dat
[2012/11/18 06:17:16 | 016,785,902 | ---- | C] () -- E:\Program Files\Figuren008.dat
[2012/11/18 06:17:14 | 016,769,888 | ---- | C] () -- E:\Program Files\Figuren007.dat
[2012/11/18 06:17:11 | 016,776,353 | ---- | C] () -- E:\Program Files\Figuren006.dat
[2012/11/18 06:17:09 | 016,776,964 | ---- | C] () -- E:\Program Files\Figuren005.dat
[2012/11/18 06:17:06 | 016,777,905 | ---- | C] () -- E:\Program Files\Figuren004.dat
[2012/11/18 06:17:04 | 016,776,259 | ---- | C] () -- E:\Program Files\Figuren003.dat
[2012/11/18 06:17:02 | 016,777,308 | ---- | C] () -- E:\Program Files\Figuren002.dat
[2012/11/18 06:17:00 | 016,778,359 | ---- | C] () -- E:\Program Files\Figuren001.dat
[2012/11/18 06:16:58 | 016,775,920 | ---- | C] () -- E:\Program Files\Figuren000.dat
[2012/11/18 06:16:58 | 000,358,963 | ---- | C] () -- E:\Program Files\binkw32.dll
[2012/11/18 06:16:57 | 002,187,264 | ---- | C] () -- E:\Program Files\AnnoSplash.exe
[2012/11/18 06:16:57 | 000,909,312 | ---- | C] () -- E:\Program Files\AnnoWelt.dll
[2012/11/18 06:16:57 | 000,221,184 | ---- | C] () -- E:\Program Files\AnnoScene.dll
[2012/11/18 06:16:57 | 000,184,320 | ---- | C] () -- E:\Program Files\AnnoGame.dll
[2012/11/18 06:16:55 | 000,385,024 | ---- | C] () -- E:\Program Files\AnnoDisplay.dll
[2012/11/18 06:16:13 | 192,149,051 | ---- | C] () -- E:\Program Files\Anlagen.dat
[2012/08/30 10:39:18 | 000,139,228 | -H-- | C] () -- E:\Windows\System32\mlfcache.dat
[2012/04/13 07:59:57 | 000,139,128 | ---- | C] () -- E:\Windows\System32\drivers\PnkBstrK.sys
[2012/04/13 07:59:48 | 000,189,248 | ---- | C] () -- E:\Windows\System32\PnkBstrB.exe
[2012/04/13 07:59:28 | 000,075,136 | ---- | C] () -- E:\Windows\System32\PnkBstrA.exe
[2012/03/13 15:41:58 | 000,010,240 | ---- | C] () -- E:\Users\Robert\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/03/13 14:11:34 | 000,084,480 | ---- | C] () -- E:\Users\Administrator\AppData\Roaming\skype.dat
[2012/03/13 12:43:51 | 000,065,536 | R--- | C] () -- E:\Windows\System32\XSrvSetup.exe
[2012/03/13 12:43:03 | 000,073,728 | ---- | C] () -- E:\Windows\System32\RtNicProp32.dll
[2012/03/13 12:39:10 | 000,000,010 | ---- | C] () -- E:\Windows\GSetup.ini
[2012/03/13 12:33:54 | 000,097,360 | ---- | C] () -- E:\Windows\System32\drivers\Fwusb1b.bin
[2012/03/13 12:29:22 | 000,000,000 | ---- | C] () -- E:\Windows\ativpsrm.bin
[2012/02/14 22:28:34 | 000,157,144 | ---- | C] () -- E:\Windows\System32\ativvsva.dat
[2012/02/14 22:28:32 | 000,204,952 | ---- | C] () -- E:\Windows\System32\ativvsvl.dat
[2012/02/14 17:05:16 | 000,054,784 | ---- | C] () -- E:\Windows\System32\OVDecode.dll
[2012/01/31 01:00:24 | 000,016,896 | ---- | C] () -- E:\Windows\System32\kdbsdk32.dll
[2012/01/10 17:10:08 | 000,601,728 | ---- | C] () -- E:\Windows\System32\atiicdxx.dat
[2011/09/12 18:06:16 | 000,003,917 | ---- | C] () -- E:\Windows\System32\atipblag.dat
[2011/07/15 11:02:32 | 002,616,320 | ---- | C] () -- E:\Windows\explorer.exe
[2011/05/13 04:58:12 | 002,785,280 | ---- | C] () -- E:\Windows\System32\x264vfw.dll
[2011/04/11 21:30:05 | 000,700,168 | ---- | C] () -- E:\Windows\System32\perfh007.dat
[2011/04/11 21:30:05 | 000,295,922 | ---- | C] () -- E:\Windows\System32\perfi007.dat
[2011/04/11 21:30:05 | 000,148,964 | ---- | C] () -- E:\Windows\System32\perfc007.dat
[2011/04/11 21:30:05 | 000,038,104 | ---- | C] () -- E:\Windows\System32\perfd007.dat
[2011/04/11 14:09:18 | 000,073,216 | ---- | C] () -- E:\Windows\System32\ff_vfw.dll
[2011/03/19 06:06:02 | 000,240,640 | ---- | C] () -- E:\Windows\System32\xvidvfw.dll
[2011/03/19 06:04:28 | 000,650,752 | ---- | C] () -- E:\Windows\System32\xvidcore.dll
[2010/11/20 17:29:34 | 000,080,896 | ---- | C] () -- E:\Windows\System32\RDVGHelper.exe
[2010/11/20 17:29:26 | 000,066,048 | ---- | C] () -- E:\Windows\System32\PrintBrmUi.exe
[2010/11/20 17:29:24 | 000,252,928 | ---- | C] () -- E:\Windows\System32\DShowRdpFilter.dll
[2010/03/15 00:31:48 | 000,165,376 | ---- | C] () -- E:\Windows\System32\unrar.dll
[2009/08/27 03:04:12 | 000,207,400 | R--- | C] () -- E:\Windows\GSetup.exe
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- E:\Windows\bootstat.dat
[2009/07/14 00:33:53 | 000,408,696 | ---- | C] () -- E:\Windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,654,880 | ---- | C] () -- E:\Windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- E:\Windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,121,752 | ---- | C] () -- E:\Windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- E:\Windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- E:\Windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- E:\Windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- E:\Windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- E:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- E:\Windows\System32\BWContextHandler.dll
[2009/07/13 18:09:19 | 000,982,196 | ---- | C] () -- E:\Windows\System32\igkrng500.bin
[2009/07/13 18:09:19 | 000,417,344 | ---- | C] () -- E:\Windows\System32\igcompkrng500.bin
[2009/07/13 18:09:19 | 000,139,824 | ---- | C] () -- E:\Windows\System32\igfcg500.bin
[2009/07/13 18:09:19 | 000,097,448 | ---- | C] () -- E:\Windows\System32\igfcg500m.bin
[2009/06/19 15:06:22 | 000,197,912 | ---- | C] () -- E:\Windows\System32\physxcudart_20.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelTraditionalChinese.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelSwedish.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelSpanish.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelPortugese.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelKorean.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelJapanese.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelGerman.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelFrench.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- E:\Windows\System32\mlang.dat
[2007/10/12 18:20:06 | 000,151,417 | ---- | C] () -- E:\Windows\System32\xlive.dll.cat
[2007/02/05 15:05:26 | 000,000,038 | ---- | C] () -- E:\Windows\AviSplitter.INI
[1996/04/03 15:33:26 | 000,005,248 | ---- | C] () -- E:\Windows\System32\giveio.sys

========== LOP Check ==========

[2012/03/13 12:48:36 | 000,000,000 | ---D | M] -- E:\ProgramData\AMD
[2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\ProgramData\Anwendungsdaten
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Application Data
[2012/03/13 13:07:06 | 000,000,000 | ---D | M] -- E:\ProgramData\ashampoo
[2012/09/23 18:04:43 | 000,000,000 | ---D | M] -- E:\ProgramData\BlueStacks
[2012/09/23 18:04:14 | 000,000,000 | ---D | M] -- E:\ProgramData\BlueStacksSetup
[2012/11/27 16:26:37 | 000,000,000 | ---D | M] -- E:\ProgramData\DAEMON Tools Lite
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Desktop
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Documents
[2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\ProgramData\Dokumente
[2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favoriten
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favorites
[2012/06/28 18:33:50 | 000,000,000 | ---D | M] -- E:\ProgramData\ICQ
[2012/12/10 08:41:51 | 000,000,000 | ---D | M] -- E:\ProgramData\Solidshield
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Start Menu
[2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\ProgramData\Startmenü
[2013/03/10 19:34:51 | 000,000,000 | ---D | M] -- E:\ProgramData\szcvlmmrfopiwja
[2012/12/02 20:51:03 | 000,000,000 | ---D | M] -- E:\ProgramData\Tarma Installer
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Templates
[2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\ProgramData\Vorlagen
[2012/03/13 13:14:28 | 000,000,000 | ---D | M] -- E:\ProgramData\Win7codecs
[2013/01/30 15:19:19 | 000,032,632 | ---- | M] () -- E:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*. >
[2013/01/14 12:26:37 | 000,000,000 | -HSD | M] -- E:\$Recycle.Bin
[2012/03/13 12:46:28 | 000,000,000 | ---D | M] -- E:\AMD
[2013/01/24 05:49:03 | 000,000,000 | -HSD | M] -- E:\Config.Msi
[2012/10/07 08:35:12 | 000,000,000 | ---D | M] -- E:\DeusEx
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\Documents and Settings
[2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\Dokumente und Einstellungen
[2012/03/13 13:17:23 | 000,000,000 | RH-D | M] -- E:\MSOCache
[2009/07/13 22:37:05 | 000,000,000 | ---D | M] -- E:\PerfLogs
[2013/02/21 00:46:14 | 000,000,000 | ---D | M] -- E:\Program Files
[2013/03/10 19:34:14 | 000,000,000 | -H-D | M] -- E:\ProgramData
[2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\Programme
[2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\Recovery
[2013/03/30 21:30:43 | 000,000,000 | -HSD | M] -- E:\RECYCLER
[2013/03/23 04:05:15 | 000,000,000 | -HSD | M] -- E:\System Volume Information
[2012/03/13 14:28:46 | 000,000,000 | ---D | M] -- E:\Temp
[2013/01/14 12:26:30 | 000,000,000 | R--D | M] -- E:\Users
[2013/03/29 22:51:57 | 000,000,000 | ---D | M] -- E:\Windows

< %PROGRAMFILES%\*.exe >
[2004/01/06 21:04:00 | 000,933,331 | ---- | M] (MAX DESIGN) -- E:\Program Files\1503Startup.exe
[2005/10/05 07:00:16 | 002,187,264 | ---- | M] () -- E:\Program Files\AnnoSplash.exe
[2010/10/16 13:00:54 | 007,970,816 | ---- | M] (home) -- E:\Program Files\Hero Editor.exe
[2004/01/06 21:04:00 | 000,233,472 | ---- | M] () -- E:\Program Files\SAVRepair.exe

Invalid Environment Variable: %LOCALAPPDATA%\*.exe

< %systemroot%\*. /mp /s >

< C:\Windows\system32\*.tsp >


< MD5 for: AGP440.SYS >
[2009/07/13 21:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- E:\Windows\System32\drivers\AGP440.sys
[2009/07/13 21:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- E:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009/07/13 21:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- E:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/07/13 21:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- E:\Windows\System32\drivers\atapi.sys
[2009/07/13 21:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- E:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009/07/13 21:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- E:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- E:\Windows\System32\cngaudit.dll
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- E:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

< MD5 for: EXPLORER.EXE >
[2011/02/26 01:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- E:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2010/11/20 17:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- E:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2012/11/13 09:07:52 | 003,906,584 | ---- | M] (Safer-Networking Ltd.) MD5=E4A0900CF535888DDD85B10040CA3E34 -- E:\Program Files\Spybot - Search & Destroy 2\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | ---- | M] () Unable to obtain MD5 -- E:\Windows\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | ---- | M] () Unable to obtain MD5 -- E:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe

< MD5 for: IASTORV.SYS >
[2011/03/11 01:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- E:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 01:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- E:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 01:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- E:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011/03/11 01:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- E:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2010/11/20 17:29:03 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- E:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010/11/20 17:29:03 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- E:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2010/11/20 17:29:12 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- E:\Windows\System32\netlogon.dll
[2010/11/20 17:29:12 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- E:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2011/03/11 01:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- E:\Windows\System32\drivers\nvstor.sys
[2011/03/11 01:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- E:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/03/11 01:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- E:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011/03/11 01:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- E:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2010/11/20 17:29:03 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- E:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/20 17:29:03 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- E:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys

< MD5 for: SCECLI.DLL >
[2010/11/20 17:29:07 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- E:\Windows\System32\scecli.dll
[2010/11/20 17:29:07 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- E:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll

< MD5 for: USER32.DLL >
[2010/11/20 17:29:20 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- E:\Windows\System32\user32.dll
[2010/11/20 17:29:20 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- E:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll

< MD5 for: USERINIT.EXE >
[2010/11/20 17:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- E:\Windows\System32\userinit.exe
[2010/11/20 17:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- E:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/20 17:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- E:\Windows\System32\winlogon.exe
[2010/11/20 17:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- E:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe

< MD5 for: WS2IFSL.SYS >
[2009/07/13 19:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- E:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/13 19:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- E:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >

< %systemroot%\system32\*.dll /lockedfiles >
[2010/11/20 17:29:08 | 000,828,928 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- E:\Windows\system32\fontext.dll
[2012/06/09 00:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- E:\Windows\system32\shell32.dll

Invalid Environment Variable: %USERPROFILE%\*.*

Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe

Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll

Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe

< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

< CREATERESTOREPOINT >

========== Alternate Data Streams ==========

@Alternate Data Stream - 763 bytes -> E:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Tom Clancy's Rainbow Six: Vegas.LNK
< End of report >
die müssts sein

Du hast mir ein OTLPe-Logfile gepostet. Ich würd aber gern ein OTL-Log sehen.
Lösche mal alle vorhandenen OTL.txt(s) und starte OTL (nicht OTLPE!) im normalen MOdus von Windows:

Starte bitte die OTL.exe.
Wähle unter
Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.
Poste die OTL.txt und die Extras.txt hier in deinen Thread.

Habs (hoffentlich).OTL Logfile:
--- --- ---
OTL Logfile:
--- --- ---

mfg devil94

Mann, warum nur? Und dann auch noch während einer Bereinigung?

Beim ersten Anzeichen der Nutzung von illegalen Programmen wie Cracks & Keygens müssen wir den Support einstellen und verweisen auf eine Anleitung zum Neuaufsetzen.

Halte dich in Zukunft von sowas fern, solche Dateien sind zu 99% mit Schadprogrammen infiziert, die auf deinem PC als Backdoor fungieren und andere Malware nachladen. Auch von Warez-Seiten und Streaming-Portalen solltest du aus demselben Grund in Zukunft die Finger lassen.

Sei mir nicht böse, aber so sind die Regeln.

Gruß

Okay, sorry und danke für den Support bis jetzt.
Habe das spiel auf meinem laptop gefunden mit dem ich das geschrieben hab während mein pc infiziert war und wollts dann doch nochmal testen.
war aber im endeffekt zu blöd ihn dann richtig zu benutzen. :crazy:
hab die datei gelöscht.

mfg devil94