Hallo M-K-D-B,
Zuerst schonmal ein Danke für die ausführliche Unterstützung.
1. OTL Fix:
All processes killed
========== OTL ==========
C:\ProgramData\~45866760 moved successfully.
C:\ProgramData\~45866760r moved successfully.
C:\ProgramData\45866760 moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Daniel
->Temp folder emptied: 48601837 bytes
->Temporary Internet Files folder emptied: 11182527 bytes
->FireFox cache emptied: 225165321 bytes
->Flash cache emptied: 4331 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16443363 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50233 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 288,00 mb
OTL by OldTimer - Version 3.2.22.3 log created on 04272011_202428
Files\Folders moved on Reboot...
C:\Users\Daniel\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
Registry entries deleted on Reboot...
2. Combofix - Hier musste ich mein Virenprogramm (Microsoft Security Essentials) komplett deinstallieren da es sich, selbst mit dem Task Manager, nicht schließen ließe:
Combofix Logfile: Code:
ComboFix 11-04-27.01 - Daniel 27.04.2011 21:14:28.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3959.2873 [GMT 2:00]
ausgeführt von:: c:\users\Daniel\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-03-27 bis 2011-04-27 ))))))))))))))))))))))))))))))
.
.
2011-04-27 19:18 . 2011-04-27 19:18 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-04-27 18:24 . 2011-04-27 18:24 -------- d-----w- C:\_OTL
2011-04-26 18:08 . 2011-04-26 18:08 -------- d-----w- c:\windows\system32\SPReview
2011-04-26 18:08 . 2011-04-26 18:08 -------- d-----w- c:\windows\system32\EventProviders
2011-04-26 18:04 . 2010-11-05 01:57 48976 ----a-w- c:\windows\system32\netfxperf.dll
2011-04-26 18:04 . 2010-11-05 01:57 1942856 ----a-w- c:\windows\system32\dfshim.dll
2011-04-26 18:04 . 2010-11-05 01:58 1130824 ----a-w- c:\windows\SysWow64\dfshim.dll
2011-04-26 18:04 . 2010-11-20 13:33 5563776 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-04-26 18:04 . 2010-11-20 13:27 12288 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2011-04-26 18:04 . 2010-11-20 11:07 59392 ----a-w- c:\windows\system32\drivers\TsUsbFlt.sys
2011-04-26 18:04 . 2010-11-20 13:27 14967808 ----a-w- c:\program files\DVD Maker\OmdBase.dll
2011-04-26 18:04 . 2010-11-20 13:27 3715584 ----a-w- c:\windows\system32\mstscax.dll
2011-04-26 18:04 . 2010-11-20 13:26 1838080 ----a-w- c:\windows\system32\d3d10warp.dll
2011-04-26 18:04 . 2010-11-20 12:19 3215872 ----a-w- c:\windows\SysWow64\mstscax.dll
2011-04-26 18:02 . 2010-11-20 13:27 1441280 ----a-w- c:\windows\system32\wlanpref.dll
2011-04-26 18:01 . 2010-11-20 13:27 243712 ----a-w- c:\windows\system32\taskbarcpl.dll
2011-04-26 18:00 . 2010-11-20 12:21 189952 ----a-w- c:\windows\SysWow64\wdscore.dll
2011-04-26 18:00 . 2010-11-20 12:17 209920 ----a-w- c:\windows\SysWow64\PkgMgr.exe
2011-04-26 18:00 . 2010-11-20 12:18 323072 ----a-w- c:\windows\SysWow64\drvstore.dll
2011-04-26 18:00 . 2010-11-20 12:18 257024 ----a-w- c:\windows\SysWow64\dpx.dll
2011-04-26 18:00 . 2010-11-20 12:21 363008 ----a-w- c:\windows\SysWow64\wbemcomn.dll
2011-04-26 18:00 . 2010-11-20 12:19 606208 ----a-w- c:\windows\SysWow64\wbem\fastprox.dll
2011-04-26 17:58 . 2010-11-20 13:27 524288 ----a-w- c:\windows\system32\wmicmiplugin.dll
2011-04-26 17:58 . 2010-11-20 13:27 529408 ----a-w- c:\windows\system32\wbemcomn.dll
2011-04-26 17:58 . 2010-11-20 13:27 1225216 ----a-w- c:\windows\system32\wbem\wbemcore.dll
2011-04-26 17:58 . 2010-11-20 13:27 933376 ----a-w- c:\windows\system32\SmiEngine.dll
2011-04-26 17:58 . 2010-11-20 13:25 199168 ----a-w- c:\windows\system32\PkgMgr.exe
2011-04-26 17:58 . 2010-11-20 13:26 422912 ----a-w- c:\windows\system32\drvstore.dll
2011-04-26 17:58 . 2010-11-20 13:26 399872 ----a-w- c:\windows\system32\dpx.dll
2011-04-25 12:36 . 2010-12-20 16:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-04-25 12:36 . 2011-04-25 12:36 -------- d-----w- c:\programdata\Malwarebytes
2011-04-25 12:36 . 2011-04-27 00:00 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-04-25 12:36 . 2010-12-20 16:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-04-22 23:05 . 2011-04-22 23:06 -------- d-----w- C:\Visual C# Aufgaben
2011-04-22 21:58 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe
2011-04-22 20:16 . 2010-12-17 11:40 715776 ----a-w- c:\windows\system32\kerberos.dll
2011-04-22 20:16 . 2010-12-17 07:07 542208 ----a-w- c:\windows\SysWow64\kerberos.dll
2011-04-22 20:13 . 2011-03-08 06:29 976896 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-22 17:09 . 2011-04-22 17:09 -------- d-----w- c:\program files (x86)\Microsoft SQL Server
2011-04-22 17:09 . 2011-04-22 17:09 -------- d-----w- c:\program files\Microsoft Synchronization Services
2011-04-22 17:09 . 2011-04-22 17:09 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2011-04-22 17:09 . 2011-04-22 17:09 -------- d-----w- c:\program files (x86)\Microsoft Synchronization Services
2011-04-22 17:09 . 2011-04-22 17:11 188896 ----a-w- c:\programdata\Microsoft\VCSExpress\10.0\1031\ResourceCache.dll
2011-04-22 17:07 . 2011-04-22 17:10 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 10.0
2011-04-22 17:06 . 2011-04-22 17:06 -------- d-----w- c:\windows\symbols
2011-04-22 17:06 . 2011-04-22 17:06 -------- d-----w- c:\program files\Microsoft Visual Studio 10.0
2011-04-22 17:06 . 2011-04-22 17:06 -------- d-----w- c:\program files\Microsoft Help Viewer
2011-04-22 17:06 . 2011-04-22 17:06 -------- d-----w- c:\program files (x86)\Microsoft SDKs
2011-04-22 15:58 . 2011-04-22 17:07 -------- d-----w- c:\program files (x86)\Microsoft.NET
2011-04-22 05:57 . 2011-04-22 06:22 -------- d-----w- c:\windows\SMINST
2011-04-22 01:19 . 2011-04-22 01:19 159080 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10138.bin
2011-04-22 00:11 . 2011-04-27 17:08 -------- d-----w- c:\program files (x86)\World of Warcraft
2011-04-22 00:11 . 2011-04-22 00:12 -------- d-----w- c:\program files (x86)\Common Files\Blizzard Entertainment
2011-04-22 00:11 . 2011-04-22 00:39 -------- d-----w- c:\programdata\Blizzard Entertainment
2011-04-21 23:56 . 2010-10-19 20:51 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-04-21 22:51 . 2011-04-21 22:51 -------- d-----w- c:\users\Default\AppData\Local\SoftThinks
2011-04-21 22:48 . 2011-04-22 21:37 -------- d-----w- c:\users\Daniel
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-26 18:16 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-04-26 18:16 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-04-21 23:51 . 2010-06-24 17:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-06-02 98304]
.
c:\users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2010-5-28 1324384]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2010-5-28 1324384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]
R3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 BcmVWL;Broadcom Virtual Wireless;c:\windows\system32\DRIVERS\bcmvwl64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - NisDrv
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-06-18 487424]
"Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2010-02-03 5712896]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
FF - ProfilePath - c:\users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\uxwf3yqi.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-RunOnce-c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe - c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-04-27 21:19:26
ComboFix-quarantined-files.txt 2011-04-27 19:19
.
Vor Suchlauf: 14 Verzeichnis(se), 440.370.655.232 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 440.018.239.488 Bytes frei
.
- - End Of File - - B681D9289FCB6598AFD53CFB4CD24BA1
--- --- ---
3. aswMBR:
aswMBR version 0.9.4 Copyright(c) 2011 AVAST Software
Run date: 2011-04-27 21:24:17
-----------------------------
21:24:17.601 OS Version: Windows x64 6.1.7601 Service Pack 1
21:24:17.601 Number of processors: 4 586 0x2505
21:24:17.601 ComputerName: DANIEL-PC UserName: Daniel
21:24:19.489 Initialize success
21:24:36.446 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
21:24:36.446 Disk 0 Vendor: WDC_WD5000BEVT-75A0RT0 01.01A01 Size: 476940MB BusType: 11
21:24:38.474 Disk 0 MBR read successfully
21:24:38.474 Disk 0 MBR scan
21:24:38.474 Service scanning
21:24:39.519 Disk 0 trace - called modules:
21:24:39.535 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
21:24:39.535 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004c1b060]
21:24:39.550 3 CLASSPNP.SYS[fffff88001bc943f] -> nt!IofCallDriver -> [0xfffffa8004962520]
21:24:39.550 5 ACPI.sys[fffff88000f927a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80049501f0]
21:24:39.550 Scan finished successfully
4. OTL Quick - Scan:OTL Logfile: Code:
OTL logfile created on: 27.04.2011 21:27:40 - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Daniel\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 72,00% Memory free
8,00 Gb Paging File | 6,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 451,01 Gb Total Space | 409,84 Gb Free Space | 90,87% Space Free | Partition Type: NTFS
Computer Name: DANIEL-PC | User Name: Daniel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011.04.25 15:32:03 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Daniel\Desktop\OTL.exe
PRC - [2009.06.09 16:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) -- C:\Programme\Dell\DellDock\DockLogin.exe
========== Modules (SafeList) ==========
MOD - [2011.04.25 15:32:03 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Daniel\Desktop\OTL.exe
MOD - [2010.11.20 13:55:09 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
========== Win32 Services (SafeList) ==========
SRV:64bit: - [2010.09.23 02:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010.06.02 08:30:28 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\WINDOWS\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010.02.03 06:13:10 | 000,048,128 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE -- (wltrysvc)
SRV - [2010.08.26 04:28:54 | 002,823,000 | ---- | M] (Dell, Inc.) [Auto | Running] -- C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe -- (NOBU)
SRV - [2010.06.18 07:10:14 | 000,258,048 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Programme\IDT\WDM\stacsv64.exe -- (STacSV)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.06.09 16:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Programme\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV - [2009.03.03 12:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Programme\IDT\WDM\AESTSr64.exe -- (AESTFilters)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 15:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.06.18 07:10:14 | 000,515,584 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2010.06.08 18:33:14 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.06.02 08:50:28 | 006,857,728 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2010.06.02 07:42:48 | 000,264,192 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010.05.06 15:21:46 | 000,125,456 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2010.03.30 21:58:06 | 000,053,800 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\btusbflt.sys -- (btusbflt)
DRV:64bit: - [2010.03.19 11:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.03.17 23:41:48 | 000,325,152 | ---- | M] (Realtek ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010.03.17 23:29:52 | 000,232,480 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010.02.03 06:13:08 | 000,022,520 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\bcm42rly.sys -- (BCM42RLY)
DRV:64bit: - [2010.02.03 06:13:08 | 000,020,984 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\bcmvwl64.sys -- (BcmVWL)
DRV:64bit: - [2010.02.03 06:13:06 | 003,058,168 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2009.09.17 20:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\WINDOWS\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.06.10 22:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2006.11.01 20:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\WimFltr.sys -- (WimFltr)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USCON/8
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.04.22 01:40:52 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
[2011.04.22 01:41:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniel\AppData\Roaming\mozilla\Extensions
[2011.04.22 01:40:52 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
File not found (No name found) --
[2011.03.18 19:56:37 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\WINDOWS\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O4:64bit: - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Programme\Dell\DW WLAN Card\WLTRAY.EXE (Dell Inc.)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] File not found
O4 - Startup: C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O28:64bit: - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
MsConfig:64bit - StartUpReg: Dell DataSafe Online - hkey= - key= - C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe (Dell, Inc.)
MsConfig:64bit - State: "startup" - Reg Error: Key error.
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2011.04.27 21:23:51 | 000,566,272 | ---- | C] (AVAST Software) -- C:\Users\Daniel\Desktop\aswMBR.exe
[2011.04.27 21:19:27 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011.04.27 21:13:55 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011.04.27 21:13:55 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011.04.27 21:13:55 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011.04.27 21:13:52 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011.04.27 21:13:01 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2011.04.27 20:38:49 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011.04.27 20:38:33 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2011.04.27 20:24:28 | 000,000,000 | ---D | C] -- C:\_OTL
[2011.04.26 20:08:45 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview
[2011.04.26 20:08:14 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders
[2011.04.26 20:02:17 | 000,116,224 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\SysNative\fms.dll
[2011.04.26 20:01:46 | 000,093,696 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\SysWow64\fms.dll
[2011.04.25 16:39:01 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\WinRAR
[2011.04.25 16:39:01 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011.04.25 16:39:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011.04.25 16:38:53 | 000,000,000 | ---D | C] -- C:\Programme\WinRAR
[2011.04.25 15:31:56 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Daniel\Desktop\OTL.exe
[2011.04.25 15:26:29 | 001,377,112 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Daniel\Desktop\tdsskiller.exe
[2011.04.25 15:02:42 | 000,258,560 | ---- | C] (OldTimer Tools) -- C:\Users\Daniel\Desktop\OTH.scr
[2011.04.25 14:36:27 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Malwarebytes
[2011.04.25 14:36:21 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011.04.25 14:36:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.04.25 14:36:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.04.25 14:36:17 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.04.25 14:36:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.04.25 14:35:20 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Daniel\Desktop\horst.exe.exe
[2011.04.23 01:05:35 | 000,000,000 | ---D | C] -- C:\Visual C# Aufgaben
[2011.04.22 23:30:26 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\Diagnostics
[2011.04.22 23:16:41 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2011.04.22 19:09:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server
[2011.04.22 19:09:46 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Synchronization Services
[2011.04.22 19:09:46 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft SQL Server Compact Edition
[2011.04.22 19:09:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Synchronization Services
[2011.04.22 19:09:08 | 000,000,000 | ---D | C] -- C:\Users\Daniel\Documents\Visual Studio 2010
[2011.04.22 19:09:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Visual Studio 2010 Express
[2011.04.22 19:07:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 10.0
[2011.04.22 19:06:41 | 000,000,000 | ---D | C] -- C:\Windows\symbols
[2011.04.22 19:06:41 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Visual Studio 10.0
[2011.04.22 19:06:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SDKs
[2011.04.22 19:06:40 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Help Viewer
[2011.04.22 17:58:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2011.04.22 07:57:39 | 000,000,000 | ---D | C] -- C:\Windows\SMINST
[2011.04.22 02:48:40 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\Adobe
[2011.04.22 02:11:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
[2011.04.22 02:11:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\World of Warcraft
[2011.04.22 02:11:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Blizzard Entertainment
[2011.04.22 02:11:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment
[2011.04.22 01:41:00 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Mozilla
[2011.04.22 01:41:00 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\Mozilla
[2011.04.22 01:40:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2011.04.22 01:39:42 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Macromedia
[2011.04.22 01:39:39 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Adobe
[2011.04.22 01:08:16 | 000,000,000 | ---D | C] -- C:\Users\Daniel\Mein Backup Datei
[2011.04.22 00:54:12 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Roxio Log Files
[2011.04.22 00:52:40 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Dell
[2011.04.22 00:52:25 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Intel Corporation
[2011.04.22 00:52:24 | 000,000,000 | ---D | C] -- C:\Users\Daniel\Documents\Bluetooth-Exchange-Ordner
[2011.04.22 00:52:18 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Roxio
[2011.04.22 00:52:16 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\ATI
[2011.04.22 00:52:16 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\ATI
[2011.04.22 00:51:57 | 000,000,000 | R--D | C] -- C:\Users\Daniel\Searches
[2011.04.22 00:51:57 | 000,000,000 | R--D | C] -- C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011.04.22 00:51:48 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Identities
[2011.04.22 00:51:44 | 000,000,000 | R--D | C] -- C:\Users\Daniel\Contacts
[2011.04.22 00:51:41 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\VirtualStore
[2011.04.22 00:51:31 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\Stardock_Corporation
[2011.04.22 00:51:31 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\SoftThinks
[2011.04.22 00:48:13 | 000,000,000 | --SD | C] -- C:\Users\Daniel\AppData\Roaming\Microsoft
[2011.04.22 00:48:13 | 000,000,000 | R--D | C] -- C:\Users\Daniel\Videos
[2011.04.22 00:48:13 | 000,000,000 | R--D | C] -- C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011.04.22 00:48:13 | 000,000,000 | R--D | C] -- C:\Users\Daniel\Saved Games
[2011.04.22 00:48:13 | 000,000,000 | R--D | C] -- C:\Users\Daniel\Pictures
[2011.04.22 00:48:13 | 000,000,000 | R--D | C] -- C:\Users\Daniel\Music
[2011.04.22 00:48:13 | 000,000,000 | R--D | C] -- C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011.04.22 00:48:13 | 000,000,000 | R--D | C] -- C:\Users\Daniel\Links
[2011.04.22 00:48:13 | 000,000,000 | R--D | C] -- C:\Users\Daniel\Desktop\Games
[2011.04.22 00:48:13 | 000,000,000 | R--D | C] -- C:\Users\Daniel\Favorites
[2011.04.22 00:48:13 | 000,000,000 | R--D | C] -- C:\Users\Daniel\Downloads
[2011.04.22 00:48:13 | 000,000,000 | R--D | C] -- C:\Users\Daniel\Documents
[2011.04.22 00:48:13 | 000,000,000 | R--D | C] -- C:\Users\Daniel\Desktop
[2011.04.22 00:48:13 | 000,000,000 | R--D | C] -- C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011.04.22 00:48:13 | 000,000,000 | -HSD | C] -- C:\Users\Daniel\Vorlagen
[2011.04.22 00:48:13 | 000,000,000 | -HSD | C] -- C:\Users\Daniel\AppData\Local\Verlauf
[2011.04.22 00:48:13 | 000,000,000 | -HSD | C] -- C:\Users\Daniel\AppData\Local\Temporary Internet Files
[2011.04.22 00:48:13 | 000,000,000 | -HSD | C] -- C:\Users\Daniel\Startmenü
[2011.04.22 00:48:13 | 000,000,000 | -HSD | C] -- C:\Users\Daniel\SendTo
[2011.04.22 00:48:13 | 000,000,000 | -HSD | C] -- C:\Users\Daniel\Recent
[2011.04.22 00:48:13 | 000,000,000 | -HSD | C] -- C:\Users\Daniel\Netzwerkumgebung
[2011.04.22 00:48:13 | 000,000,000 | -HSD | C] -- C:\Users\Daniel\Lokale Einstellungen
[2011.04.22 00:48:13 | 000,000,000 | -HSD | C] -- C:\Users\Daniel\Documents\Eigene Videos
[2011.04.22 00:48:13 | 000,000,000 | -HSD | C] -- C:\Users\Daniel\Documents\Eigene Musik
[2011.04.22 00:48:13 | 000,000,000 | -HSD | C] -- C:\Users\Daniel\Eigene Dateien
[2011.04.22 00:48:13 | 000,000,000 | -HSD | C] -- C:\Users\Daniel\Documents\Eigene Bilder
[2011.04.22 00:48:13 | 000,000,000 | -HSD | C] -- C:\Users\Daniel\Druckumgebung
[2011.04.22 00:48:13 | 000,000,000 | -HSD | C] -- C:\Users\Daniel\Cookies
[2011.04.22 00:48:13 | 000,000,000 | -HSD | C] -- C:\Users\Daniel\AppData\Local\Anwendungsdaten
[2011.04.22 00:48:13 | 000,000,000 | -HSD | C] -- C:\Users\Daniel\Anwendungsdaten
[2011.04.22 00:48:13 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\Temp
[2011.04.22 00:48:13 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\Microsoft
[2011.04.22 00:48:13 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Media Center Programs
[2011.04.22 00:48:13 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData
[2011.04.22 00:47:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2011.04.22 00:47:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2011.04.22 00:47:45 | 000,000,000 | -HSD | C] -- C:\Programme\Gemeinsame Dateien
[2011.04.22 00:47:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2011.04.22 00:47:45 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2011.04.22 00:47:45 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2011.04.22 00:47:45 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2011.04.22 00:47:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2011.04.22 00:47:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
========== Files - Modified Within 30 Days ==========
[2011.04.27 21:24:50 | 000,000,512 | ---- | M] () -- C:\Users\Daniel\Desktop\MBR.dat
[2011.04.27 21:23:52 | 000,566,272 | ---- | M] (AVAST Software) -- C:\Users\Daniel\Desktop\aswMBR.exe
[2011.04.27 21:13:27 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[2011.04.27 21:13:14 | 000,691,814 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.04.27 21:13:14 | 000,647,788 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.04.27 21:13:14 | 000,145,380 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.04.27 21:13:14 | 000,118,918 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.04.27 20:34:28 | 004,331,679 | R--- | M] () -- C:\Users\Daniel\Desktop\ComboFix.exe
[2011.04.27 20:33:32 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.04.27 20:33:32 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.04.27 20:26:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.04.27 20:25:59 | 3113,234,432 | -HS- | M] () -- C:\hiberfil.sys
[2011.04.27 16:15:59 | 001,604,022 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.04.27 02:00:21 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.27 01:53:06 | 000,000,144 | ---- | M] () -- C:\ProgramData\~40230664r
[2011.04.27 01:53:06 | 000,000,128 | ---- | M] () -- C:\ProgramData\~40230664
[2011.04.27 01:53:01 | 000,000,336 | ---- | M] () -- C:\ProgramData\40230664
[2011.04.26 20:48:05 | 000,274,464 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.04.25 15:32:03 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Daniel\Desktop\OTL.exe
[2011.04.25 15:26:36 | 001,377,112 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Daniel\Desktop\tdsskiller.exe
[2011.04.25 15:23:43 | 000,504,657 | ---- | M] () -- C:\Users\Daniel\Desktop\unhide.exe
[2011.04.25 15:02:45 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Users\Daniel\Desktop\OTH.scr
[2011.04.25 14:35:25 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Daniel\Desktop\horst.exe.exe
[2011.04.22 23:52:11 | 001,581,628 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.04.22 23:06:42 | 000,000,017 | ---- | M] () -- C:\Users\Daniel\AppData\Local\resmon.resmoncfg
[2011.04.22 09:46:57 | 000,052,870 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2011.04.22 09:46:57 | 000,052,870 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2011.04.22 00:52:16 | 000,001,980 | ---- | M] () -- C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
========== Files Created - No Company Name ==========
[2011.04.27 21:24:50 | 000,000,512 | ---- | C] () -- C:\Users\Daniel\Desktop\MBR.dat
[2011.04.27 21:13:55 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011.04.27 21:13:55 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011.04.27 21:13:55 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2011.04.27 21:13:55 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011.04.27 21:13:55 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011.04.27 20:34:22 | 004,331,679 | R--- | C] () -- C:\Users\Daniel\Desktop\ComboFix.exe
[2011.04.27 02:00:21 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.27 01:53:06 | 000,000,144 | ---- | C] () -- C:\ProgramData\~40230664r
[2011.04.27 01:53:06 | 000,000,128 | ---- | C] () -- C:\ProgramData\~40230664
[2011.04.27 01:53:01 | 000,000,336 | ---- | C] () -- C:\ProgramData\40230664
[2011.04.26 20:03:37 | 000,347,904 | ---- | C] () -- C:\Windows\SysNative\systemsf.ebd
[2011.04.26 20:01:25 | 000,010,429 | ---- | C] () -- C:\Windows\SysNative\ScavengeSpace.xml
[2011.04.26 20:01:12 | 000,105,559 | ---- | C] () -- C:\Windows\SysWow64\RacRules.xml
[2011.04.26 20:01:12 | 000,105,559 | ---- | C] () -- C:\Windows\SysNative\RacRules.xml
[2011.04.26 20:00:54 | 000,001,041 | ---- | C] () -- C:\Windows\SysWow64\tcpbidi.xml
[2011.04.25 15:23:42 | 000,504,657 | ---- | C] () -- C:\Users\Daniel\Desktop\unhide.exe
[2011.04.22 23:41:56 | 000,001,980 | ---- | C] () -- C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
[2011.04.22 23:06:42 | 000,000,017 | ---- | C] () -- C:\Users\Daniel\AppData\Local\resmon.resmoncfg
[2011.04.22 09:26:13 | 3113,234,432 | -HS- | C] () -- C:\hiberfil.sys
[2011.04.22 01:48:50 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif
[2011.04.22 01:48:12 | 001,581,628 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.04.22 00:52:03 | 000,001,407 | ---- | C] () -- C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2011.04.22 00:51:59 | 000,001,441 | ---- | C] () -- C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011.01.06 22:29:57 | 000,002,137 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.01.06 22:23:12 | 000,000,324 | ---- | C] () -- C:\Windows\Prelaunch.ini
[2011.01.06 22:23:12 | 000,000,271 | ---- | C] () -- C:\Windows\WisPriority.ini
[2011.01.06 22:23:12 | 000,000,035 | ---- | C] () -- C:\Windows\DELL_LANGCODE.ini
[2011.01.06 22:23:12 | 000,000,033 | ---- | C] () -- C:\Windows\DELL_OSTYPE.ini
[2011.01.06 22:23:12 | 000,000,032 | ---- | C] () -- C:\Windows\WisHWDest.ini
[2011.01.06 22:23:12 | 000,000,028 | ---- | C] () -- C:\Windows\WisLangCode.ini
[2011.01.06 22:23:12 | 000,000,023 | ---- | C] () -- C:\Windows\WisSysInfo.ini
[2011.01.06 21:44:38 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009.07.14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 23:59:36 | 000,982,196 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin
[2009.07.13 23:59:36 | 000,139,824 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin
[2009.07.13 23:59:36 | 000,097,448 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin
[2009.07.13 23:59:35 | 000,417,344 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin
[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
========== LOP Check ==========
[2009.07.14 07:08:49 | 000,015,236 | ---- | M] () -- C:\WINDOWS\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*. >
[2009.04.28 18:27:08 | 000,000,000 | ---D | M] -- C:\Boot
[2011.04.27 21:13:23 | 000,000,000 | ---D | M] -- C:\Config.Msi
[2011.04.22 09:27:35 | 000,000,000 | ---D | M] -- C:\Dell
[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.03.17 21:48:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2011.01.06 21:37:04 | 000,000,000 | ---D | M] -- C:\Intel
[2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.04.27 21:13:23 | 000,000,000 | R--D | M] -- C:\Programme
[2011.04.27 21:13:23 | 000,000,000 | ---D | M] -- C:\Program Files (x86)
[2011.04.27 20:24:28 | 000,000,000 | ---D | M] -- C:\ProgramData
[2011.03.17 21:48:24 | 000,000,000 | ---D | M] -- C:\Programme
[2011.04.27 21:19:28 | 000,000,000 | ---D | M] -- C:\Qoobox
[2011.04.27 21:28:10 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.04.22 00:48:12 | 000,000,000 | R--D | M] -- C:\Users
[2011.04.23 01:06:22 | 000,000,000 | ---D | M] -- C:\Visual C# Aufgaben
[2011.04.27 21:19:27 | 000,000,000 | ---D | M] -- C:\WINDOWS
[2011.04.27 20:24:28 | 000,000,000 | ---D | M] -- C:\_OTL
< %PROGRAMFILES%\*.exe >
< %PROGRAMFILES%\*. >
[2011.01.06 21:51:26 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Adobe
[2011.01.06 21:43:47 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\ATI Technologies
[2011.04.27 21:16:26 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files
[2011.01.06 22:03:03 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Creative Live! Cam
[2011.04.22 23:36:05 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Dell
[2011.04.22 01:11:40 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\InstallShield Installation Information
[2011.04.22 01:34:19 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Intel
[2011.04.26 20:44:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Internet Explorer
[2011.01.06 22:18:12 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Jagex
[2011.04.27 02:00:21 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.04.22 19:06:40 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Microsoft SDKs
[2011.04.24 18:22:02 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Microsoft Silverlight
[2011.04.22 19:09:59 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Microsoft SQL Server
[2011.04.22 19:09:36 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2011.04.22 19:09:36 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Microsoft Synchronization Services
[2011.04.22 19:10:53 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Microsoft Visual Studio 10.0
[2011.04.22 19:07:43 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Microsoft.NET
[2011.04.22 01:40:52 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox
[2009.07.14 07:32:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\MSBuild
[2011.01.06 21:48:58 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Realtek
[2009.07.14 07:32:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Reference Assemblies
[2011.04.22 00:54:06 | 000,000,000 | R--D | M] -- C:\Program Files (x86)\Skype
[2011.01.06 21:52:10 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\WildTangent
[2011.01.06 22:42:13 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Defender
[2011.04.22 23:54:43 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Live
[2011.04.26 20:44:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Mail
[2011.04.26 20:44:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Media Player
[2009.07.14 07:32:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows NT
[2011.04.26 20:44:37 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Photo Viewer
[2011.04.26 20:44:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Portable Devices
[2011.04.26 20:44:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Sidebar
[2011.04.27 19:08:05 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\World of Warcraft
< %LOCALAPPDATA%\*.exe >
< %systemroot%\*. /mp /s >
< MD5 for: EXPLORER.EXE >
[2011.01.06 20:57:18 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=00B0358734CAA32C39D181FE6916B178 -- C:\WINDOWS\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_b8b0208ee0ce1889\explorer.exe
[2011.02.26 08:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\WINDOWS\SoftwareDistribution\Download\71d84967e1e9a8a414d570c6caa8bb08\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\WINDOWS\SoftwareDistribution\Download\71d84967e1e9a8a414d570c6caa8bb08\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\WINDOWS\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\WINDOWS\SoftwareDistribution\Download\71d84967e1e9a8a414d570c6caa8bb08\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2011.01.06 21:05:15 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\WINDOWS\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\WINDOWS\SoftwareDistribution\Download\71d84967e1e9a8a414d570c6caa8bb08\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\WINDOWS\SoftwareDistribution\Download\71d84967e1e9a8a414d570c6caa8bb08\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 08:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\WINDOWS\SoftwareDistribution\Download\71d84967e1e9a8a414d570c6caa8bb08\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\WINDOWS\SysWOW64\explorer.exe
[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\WINDOWS\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011.01.06 20:57:18 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=6D4F9E4B640B413C6F73414327484C80 -- C:\WINDOWS\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_addea9f19345cd81\explorer.exe
[2011.01.06 20:54:13 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\WINDOWS\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\WINDOWS\SoftwareDistribution\Download\71d84967e1e9a8a414d570c6caa8bb08\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2011.01.06 21:05:15 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\WINDOWS\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2011.01.06 20:54:13 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\WINDOWS\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010.11.20 15:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\WINDOWS\ERDNT\cache86\explorer.exe
[2010.11.20 15:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\WINDOWS\explorer.exe
[2010.11.20 15:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\WINDOWS\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2011.01.06 21:05:15 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\WINDOWS\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2011.01.06 20:54:13 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\WINDOWS\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 03:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\WINDOWS\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2011.01.06 21:05:15 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\WINDOWS\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011.01.06 20:57:18 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=CA17F8620815267DC838E30B68CB5052 -- C:\WINDOWS\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_ae5b763cac6d568e\explorer.exe
[2011.02.26 08:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\WINDOWS\SoftwareDistribution\Download\71d84967e1e9a8a414d570c6caa8bb08\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2011.01.06 20:54:13 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\WINDOWS\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[2011.01.06 20:57:18 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=FC89FACA0473641CB625EDA9277D0885 -- C:\WINDOWS\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_b8335443c7a68f7c\explorer.exe
< MD5 for: USERINIT.EXE >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\WINDOWS\ERDNT\cache86\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\WINDOWS\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\WINDOWS\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\WINDOWS\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\WINDOWS\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\WINDOWS\ERDNT\cache64\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\WINDOWS\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\WINDOWS\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
< MD5 for: WININIT.EXE >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\WINDOWS\ERDNT\cache64\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\WINDOWS\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\WINDOWS\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\WINDOWS\ERDNT\cache86\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\WINDOWS\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\WINDOWS\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
< MD5 for: WINLOGON.EXE >
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\WINDOWS\ERDNT\cache64\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\WINDOWS\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\WINDOWS\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\WINDOWS\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2011.01.06 21:05:15 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\WINDOWS\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2011.01.06 21:05:15 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\WINDOWS\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >
--- --- ---
Nun zu den Fragen:
-Ja, ich habe TDSSKiller bereits benutzt
-Mein Rechner läuft momentan nicht gut. Es fand in der Zwischenzeit ein weiterer Befall statt. Daraufhin habe ich Windows - Recovery wieder entfernt. Ich hoffe die Ausführung der Schritte werden keine Probleme durch diesen Vorfall bereiten.
Ausserdem ist die CPU Auslastung in kurzen regelmäßigen Zeit - Abschnitten zu hoch (30% auf dem Windows - Desktop ohne laufende Programme)
Die Logs von mbam nach dem Befall sind hier:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 6451
Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514
27.04.2011 02:33:42
mbam-log-2011-04-27 (02-33-42).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|G:\|)
Durchsuchte Objekte: 272440
Laufzeit: 32 Minute(n), 18 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 9
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qSsBwhAkulOsDNp (Trojan.FakeAlert) -> Value: qSsBwhAkulOsDNp -> Quarantined and deleted successfully.
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
c:\Users\Daniel\AppData\Roaming\microsoft\Windows\start menu\Programs\windows recovery (Trojan.FakeAV) -> Quarantined and deleted successfully.
Infizierte Dateien:
c:\programdata\qssbwhakulosdnp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\programdata\40230664.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Daniel\AppData\Local\Temp\1363E8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Daniel\AppData\Local\Temp\adobe_flash_player.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Daniel\AppData\Local\Temp\ldr90c9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Daniel\AppData\Local\Temp\tmp8C85.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Daniel\Desktop\windows recovery.lnk (Trojan.FakeAV) -> Quarantined and deleted successfully.
c:\Users\Daniel\AppData\Roaming\microsoft\Windows\start menu\Programs\windows recovery\uninstall windows recovery.lnk (Trojan.FakeAV) -> Quarantined and deleted successfully.
c:\Users\Daniel\AppData\Roaming\microsoft\Windows\start menu\Programs\windows recovery\windows recovery.lnk (Trojan.FakeAV) -> Quarantined and deleted successfully.
Die Logfiles von TDSSKiller finden Sie im beiliegenden Anhang, da diese zu lang sind.
So das wars dann, hoffe es hilft.
Mfg Malf |
