Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Es besteht noch keine Internetverbindung Trojaner? (https://www.trojaner-board.de/108436-besteht-noch-keine-internetverbindung-trojaner.html)

Kentamashi 22.01.2012 14:34
Es besteht noch keine Internetverbindung Trojaner?
 
Hallo liebe community!!

Nun hat es auch gestern abend mich erwischt... Bei jedem Rechnerstart kommt die Meldung Es besteht noch keine Internetverbindung bitte warten

Der Hintergrund ist weiss, und ich kann sogut wie garnix machen.

Ich bin total am verzweifeln, da der PC ziemlich teuer war.
Habe mir wie in einem anderem Thread beschrieben Reatogo X pe per ISO dvd rauf gespielt, und habe die OTLPE datei auf dem Desktop gestartet.

In die scans fixes leiste folgendes geschrieben

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe

und dann auf Run Scan.

Der Scan ist fertig, doch ich finde nirgend eine txt datei mit dem scan ergebnis.

In der Scans Fixes leiste steht nun nurnoch

%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll

Habe Windows 7

Ich hoffe ihr könnt mir weiter helfen, und danke schonmal im vorraus

Gruß

Kentamashi 22.01.2012 15:11
Sorry wegen Doppelpost, arbeite vom Reatogo X pe Rechner aus *infizierter Rechner*, und irgendwie klappt das Editieren nicht.

Jedenfalls habe ich jetzt doch eine OTL Textdatei bekommen!

Folgendes steht drin OTL Logfile:
Code:
OTL logfile created on: 1/22/2012 2:03:51 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
Windows 7 Ultimate  (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 95.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 540.89 Gb Total Space | 343.12 Gb Free Space | 63.44% Space Free | Partition Type: NTFS
Drive H: | 390.62 Gb Total Space | 390.51 Gb Free Space | 99.97% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012/01/05 20:35:50 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/12/13 12:21:39 | 003,316,000 | ---- | M] () [Auto] -- C:\program files\common files\akamai/netsession_win_b427739.dll -- (Akamai)
SRV - [2009/08/17 19:36:08 | 000,176,128 | ---- | M] (AMD) [Auto] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009/07/21 07:34:28 | 000,185,089 | ---- | M] (Avira GmbH) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009/07/13 20:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 20:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/13 20:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/05/13 09:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (EagleXNt)
DRV - File not found [Kernel | On_Demand] --  -- (EagleNT)
DRV - [2011/06/13 13:23:01 | 000,443,448 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2011/05/24 18:40:10 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2009/12/21 14:50:16 | 000,005,760 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand] -- C:\Windows\System32\drivers\vHidDev.sys -- (vHidDev)
DRV - [2009/12/08 15:23:09 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009/10/30 03:53:42 | 000,009,216 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Abyssus.sys -- (Abyssus03)
DRV - [2009/08/17 20:48:06 | 004,994,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009/07/13 20:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)
DRV - [2009/07/13 20:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2009/07/13 20:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)
DRV - [2009/07/13 18:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/07/13 18:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)
DRV - [2009/07/13 18:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)
DRV - [2009/05/13 06:11:32 | 000,006,504 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2009/05/11 03:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/04/29 09:37:26 | 000,025,088 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand] -- C:\Windows\System32\drivers\KMWDFILTER.sys -- (KMWDFILTERx86)
DRV - [2009/03/30 03:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2009/03/18 10:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2009/02/13 05:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009/02/03 10:36:58 | 000,059,000 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot] -- C:\Windows\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2008/01/17 23:43:16 | 000,016,128 | ---- | M] (Razer USA Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Lycosa.sys -- (LycoFltr)
DRV - [2007/02/08 12:44:43 | 000,083,320 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot] -- C:\Windows\System32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x)
DRV - [2006/07/10 11:19:58 | 000,027,032 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\Windows\System32\drivers\sfsync02.sys -- (sfsync02) StarForce Protection Synchronization Driver (version 2.x)
DRV - [2006/06/14 09:56:56 | 000,013,680 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot] -- C:\Windows\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=605f893500000000000090e6ba0d1333&tlver=1.4.19.19&affID=17161
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\Schleusener_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.hotspotshield.com/g/?c=h
IE - HKU\Schleusener_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Schleusener_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Schleusener_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1B 24 E4 90 D9 F2 CA 01  [binary data]
IE - HKU\Schleusener_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Schleusener_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;127.0.0.1:9421;
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Hotspot Shield Private Search"
FF - prefs.js..browser.search.defaultthis.engineName: "HotSpot International Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2604146&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Hotspot Shield Private Search"
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.8
FF - prefs.js..keyword.URL: "hxxp://search.hotspotshield.com/g/results.php?c=s&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\System32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: 
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0:  File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame:  File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/01/07 18:00:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/12/12 04:52:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/12/12 04:52:16 | 000,000,000 | ---D | M]
 
[2011/03/13 04:52:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Schleusener\AppData\Roaming\Mozilla\Extensions
[2012/01/21 19:31:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Schleusener\AppData\Roaming\Mozilla\Firefox\Profiles\kmfhm63v.default\extensions
[2012/01/13 09:41:56 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Schleusener\AppData\Roaming\Mozilla\Firefox\Profiles\kmfhm63v.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/05/24 18:40:48 | 000,000,945 | ---- | M] () -- C:\Users\Schleusener\AppData\Roaming\Mozilla\Firefox\Profiles\kmfhm63v.default\searchplugins\conduit.xml
[2011/12/13 16:47:35 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/05/08 08:14:07 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/07/16 10:43:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\afurladvisor@anchorfree.com
[2012/01/07 18:00:51 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 &lt;video&gt;) -- C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2011/05/08 08:13:54 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/11/02 17:31:46 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/11/02 17:31:46 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011/11/02 17:31:46 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/11/02 17:31:46 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/11/02 17:31:46 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 16:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (CescrtHlpr Object) - {2EECD738-5844-4a99-B4B6-146BF802613B} -  File not found
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a}  - No CLSID value found.
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} -  File not found
O4 - HKLM..\Run: [Abyssus] C:\Program Files\Razer\Abyssus\razerhid.exe ()
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKU\Schleusener_ON_C..\Run: [1SjOutZRnOxGgdc] C:\Users\Schleusener\AppData\Roaming\e5su745fss.exe (Pinnacle Systems)
O4 - HKU\Schleusener_ON_C..\Run: [Akamai NetSession Interface] C:\Users\Schleusener\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKU\Schleusener_ON_C..\Run: [bluebirds] C:\Users\Schleusener\Bluebirds\BlueBirds.exe (LG Electronics)
O4 - HKU\Schleusener_ON_C..\Run: [DAEMON Tools Lite]  File not found
O4 - HKU\Schleusener_ON_C..\Run: [DAEMON Tools Pro Agent] C:\Program Files\DAEMON Tools Pro\DTAgent.exe (DT Soft Ltd)
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Schleusener\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\Schleusener_ON_C Winlogon: Shell - (C:\Users\Schleusener\AppData\Roaming\e5su745fss.exe) - C:\Users\Schleusener\AppData\Roaming\e5su745fss.exe (Pinnacle Systems)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 16:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{162bbc87-45a5-11e0-804a-90e6ba0d1333}\Shell - "" = AutoRun
O33 - MountPoints2\{162bbc87-45a5-11e0-804a-90e6ba0d1333}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Autorun.exe
O33 - MountPoints2\{5c427037-bcdf-11de-80fa-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{5c427037-bcdf-11de-80fa-806e6f6e6963}\Shell\AutoRun\command - "" = E:\BlueBirds.exe
O33 - MountPoints2\{74b64d8c-4f6a-11df-954e-90e6ba0d1333}\Shell - "" = AutoRun
O33 - MountPoints2\{74b64d8c-4f6a-11df-954e-90e6ba0d1333}\Shell\AutoRun\command - "" = F:\autorun.exe
O33 - MountPoints2\{e7e83ebe-be39-11de-a8cc-90e6ba0d1333}\Shell - "" = AutoRun
O33 - MountPoints2\{e7e83ebe-be39-11de-a8cc-90e6ba0d1333}\Shell\AutoRun\command - "" = F:\setup\rsrc\Autorun.exe
O33 - MountPoints2\{e7e83ebe-be39-11de-a8cc-90e6ba0d1333}\Shell\dinstall\command - "" = F:\Directx\dxsetup.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpFolder: C:^Users^Schleusener^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^0.2635630021390899.exe.lnk -  - File not found
MsConfig - StartUpFolder: C:^Users^Schleusener^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^wpbt0.dll.lnk -  - File not found
MsConfig - StartUpReg: 1SjOutZRnOxGgdc - hkey= - key= - C:\Users\Schleusener\AppData\Roaming\e5su745fss.exe (Pinnacle Systems)
MsConfig - StartUpReg: BabylonToolbar - hkey= - key= -  File not found
MsConfig - StartUpReg: cyomy.exe - hkey= - key= -  File not found
MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MsConfig - StartUpReg: KPeerNexonEU - hkey= - key= - C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe (NEXON Inc.)
MsConfig - StartUpReg: msnmsgr - hkey= - key= -  File not found
MsConfig - State: "startup" - 2
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/01/22 13:55:29 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012/01/22 05:46:24 | 000,095,744 | ---- | C] (Kassl GmbH) -- C:\Users\Schleusener\AppData\Roaming\dwlGina3.dll
[2012/01/21 20:01:39 | 000,344,064 | ---- | C] (Pinnacle Systems) -- C:\Users\Schleusener\AppData\Roaming\e5su745fss.exe
[2012/01/13 09:42:00 | 000,000,000 | ---D | C] -- C:\Users\Schleusener\AppData\Roaming\DVDVideoSoft
[2012/01/13 09:41:56 | 000,000,000 | ---D | C] -- C:\Users\Schleusener\AppData\Roaming\DVDVideoSoftIEHelpers
[2012/01/13 09:41:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2012/01/13 09:41:49 | 000,000,000 | ---D | C] -- C:\Users\Schleusener\Documents\DVDVideoSoft
[2012/01/13 09:41:49 | 000,000,000 | ---D | C] -- C:\Program Files\DVDVideoSoft
[2012/01/13 09:41:49 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DVDVideoSoft
[2012/01/12 10:14:17 | 000,000,000 | ---D | C] -- C:\Users\Schleusener\Desktop\Hentais
[2012/01/12 08:53:39 | 000,000,000 | ---D | C] -- C:\Users\Schleusener\Desktop\Poster
[2012/01/11 09:27:00 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2012/01/11 09:26:58 | 001,328,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2012/01/11 09:26:58 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll
[2012/01/11 09:26:58 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll
[2012/01/09 17:40:20 | 000,000,000 | ---D | C] -- C:\Users\Schleusener\AppData\Local\DDMSettings
[2012/01/05 20:57:33 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2009/06/16 07:03:56 | 000,126,976 | ---- | C] ( ) -- C:\Windows\System32\Interop.SHDocVw.dll
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/01/22 06:37:36 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/01/22 06:37:32 | 000,017,136 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/22 06:37:32 | 000,017,136 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/22 06:34:48 | 2616,594,432 | -HS- | M] () -- C:\hiberfil.sys
[2012/01/22 06:29:30 | 005,602,894 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/01/22 06:29:30 | 004,872,282 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/01/22 05:46:24 | 000,095,744 | ---- | M] (Kassl GmbH) -- C:\Users\Schleusener\AppData\Roaming\dwlGina3.dll
[2012/01/21 20:01:38 | 000,344,064 | ---- | M] (Pinnacle Systems) -- C:\Users\Schleusener\AppData\Roaming\e5su745fss.exe
[2012/01/15 19:42:12 | 000,218,496 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2012/01/13 09:41:54 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2012/01/12 09:33:36 | 000,257,480 | ---- | M] () -- C:\Users\Schleusener\Desktop\Konachan.com - 94837 censored cum game_cg green_eyes karasuba_yukari kobuichi necklace red_hair sex tenshinranman.jpg
[2012/01/12 09:17:14 | 002,550,670 | ---- | M] () -- C:\Users\Schleusener\Desktop\Ecchi-Autres-660.jpg
[2012/01/11 11:42:29 | 040,782,764 | ---- | M] () -- C:\Users\Schleusener\Desktop\ts3_recording_12_01_11_17_38_53.wav
[2012/01/11 11:31:19 | 002,203,344 | ---- | M] () -- C:\Users\Schleusener\Desktop\muhaha.png
[2012/01/08 14:46:33 | 000,086,964 | ---- | M] () -- C:\Users\Schleusener\Desktop\dps.jpg
[2012/01/08 14:37:55 | 000,418,401 | ---- | M] () -- C:\Users\Schleusener\Desktop\WoWScrnShot_010812_203755.jpg
[2012/01/07 18:00:38 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX Plus
[2012/01/06 15:15:56 | 000,599,115 | ---- | M] () -- C:\Users\Schleusener\Desktop\Screen3e8a0605jpg.jpg
[2012/01/05 22:45:19 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/01/05 20:45:29 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
[2012/01/05 02:05:29 | 002,773,420 | ---- | M] () -- C:\Users\Schleusener\Desktop\2nd Place On AKROSS Con 2010 impr3ssiv - NOIZE.mp3
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/01/12 09:33:36 | 000,257,480 | ---- | C] () -- C:\Users\Schleusener\Desktop\Konachan.com - 94837 censored cum game_cg green_eyes karasuba_yukari kobuichi necklace red_hair sex tenshinranman.jpg
[2012/01/12 09:17:14 | 002,550,670 | ---- | C] () -- C:\Users\Schleusener\Desktop\Ecchi-Autres-660.jpg
[2012/01/11 11:38:56 | 040,782,764 | ---- | C] () -- C:\Users\Schleusener\Desktop\ts3_recording_12_01_11_17_38_53.wav
[2012/01/11 11:31:19 | 002,203,344 | ---- | C] () -- C:\Users\Schleusener\Desktop\muhaha.png
[2012/01/08 14:46:33 | 000,086,964 | ---- | C] () -- C:\Users\Schleusener\Desktop\dps.jpg
[2012/01/08 14:37:55 | 000,418,401 | ---- | C] () -- C:\Users\Schleusener\Desktop\WoWScrnShot_010812_203755.jpg
[2012/01/06 15:14:28 | 000,599,115 | ---- | C] () -- C:\Users\Schleusener\Desktop\Screen3e8a0605jpg.jpg
[2012/01/05 02:05:28 | 002,773,420 | ---- | C] () -- C:\Users\Schleusener\Desktop\2nd Place On AKROSS Con 2010 impr3ssiv - NOIZE.mp3
[2011/08/16 08:16:46 | 000,007,597 | ---- | C] () -- C:\Users\Schleusener\AppData\Local\Resmon.ResmonCfg
[2011/06/26 18:39:07 | 000,000,915 | ---- | C] () -- C:\Users\Schleusener\AppData\Roaming\MPQEditor.ini
[2011/05/31 01:39:50 | 000,058,368 | ---- | C] () -- C:\Windows\System32\bdmpegv.dll
[2011/05/31 01:38:18 | 000,015,360 | ---- | C] () -- C:\Windows\System32\bdmjpeg.dll
[2010/12/12 08:31:13 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/10/06 18:29:32 | 002,601,752 | ---- | C] () -- C:\Windows\System32\pbsvc_moh.exe
[2009/12/02 08:21:13 | 000,000,070 | ---- | C] () -- C:\Windows\MyProg.INI
[2009/12/02 08:20:11 | 000,000,082 | ---- | C] () -- C:\Windows\netdet.ini
[2009/10/24 22:19:44 | 000,003,584 | ---- | C] () -- C:\Users\Schleusener\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/10/21 09:51:06 | 000,140,072 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009/10/21 09:51:06 | 000,138,056 | ---- | C] () -- C:\Users\Schleusener\AppData\Roaming\PnkBstrK.sys
[2009/10/21 09:50:43 | 000,218,496 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2009/10/21 09:50:41 | 002,250,024 | ---- | C] () -- C:\Windows\System32\pbsvc.exe
[2009/10/21 09:50:41 | 000,075,136 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2009/10/19 15:28:44 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2009/10/19 15:28:40 | 000,027,224 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2009/10/19 07:58:25 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009/07/13 23:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 23:33:53 | 000,290,808 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 21:05:48 | 005,602,894 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009/07/13 21:05:48 | 004,872,282 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009/07/13 21:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009/07/13 21:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009/07/13 21:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009/07/13 21:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009/07/13 19:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2009/07/13 19:02:54 | 000,245,248 | ---- | C] () -- C:\Windows\System32\DShowRdpFilter.dll
[2009/07/13 18:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 18:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/06/18 12:29:04 | 000,197,654 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2009/06/16 07:03:58 | 000,053,248 | ---- | C] () -- C:\Windows\System32\dossec.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2009/05/13 06:11:32 | 000,006,504 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys
[2009/04/02 07:30:14 | 000,010,296 | ---- | C] () -- C:\Windows\System32\drivers\ASUSHWIO.SYS
[2009/02/18 10:55:22 | 000,294,912 | ---- | C] () -- C:\Windows\System32\ATIODE.exe
[2009/02/03 13:52:04 | 000,045,056 | ---- | C] () -- C:\Windows\System32\ATIODCLI.exe
 
========== LOP Check ==========
 
[2011/05/08 08:22:43 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\.minecraft
[2011/03/03 10:21:30 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\Azureus
[2010/04/24 01:24:04 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\DAEMON Tools Lite
[2009/10/21 07:13:58 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\DAEMON Tools Pro
[2012/01/13 09:42:01 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\DVDVideoSoft
[2012/01/13 09:41:56 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\DVDVideoSoftIEHelpers
[2010/04/21 10:00:55 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\GrabPro
[2011/12/09 21:37:32 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\gtk-2.0
[2010/06/25 12:47:21 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\gucipdsab
[2010/05/29 08:23:41 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\install
[2010/01/31 12:49:41 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\OpenOffice.org
[2010/04/21 10:05:40 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\Orbit
[2011/07/26 05:58:36 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\Ovik
[2010/05/18 12:56:44 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\Publish Providers
[2010/10/18 10:08:43 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\Raptr
[2011/07/24 19:24:22 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\Raub
[2011/03/14 12:31:30 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\Sony
[2011/03/13 12:07:50 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\Sony Creative Software
[2012/01/05 20:45:29 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\TS3Client
[2010/07/18 20:11:05 | 000,000,000 | ---D | M] -- C:\Users\Schleusener\AppData\Roaming\uTorrent
[2009/07/13 23:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2009/10/20 09:03:24 | 000,000,000 | ---D | M] -- C:\ProgramData\Azureus
[2010/04/23 15:24:51 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Lite
[2009/10/21 07:06:50 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Pro
[2009/07/13 23:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2009/07/13 23:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2010/10/20 05:31:00 | 000,000,000 | -HSD | M] -- C:\ProgramData\DSS
[2010/11/27 07:13:39 | 000,000,000 | ---D | M] -- C:\ProgramData\EA Core
[2011/11/10 14:27:40 | 000,000,000 | ---D | M] -- C:\ProgramData\Electronic Arts
[2010/07/18 20:27:05 | 000,000,000 | ---D | M] -- C:\ProgramData\eMule
[2011/01/02 17:19:18 | 000,000,000 | ---D | M] -- C:\ProgramData\fAnJi07000
[2009/07/13 23:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2010/09/15 10:59:30 | 000,000,000 | ---D | M] -- C:\ProgramData\ICQ
[2011/10/26 17:55:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Nexon
[2011/11/06 23:35:43 | 000,000,000 | ---D | M] -- C:\ProgramData\NexonEU
[2011/11/10 14:27:40 | 000,000,000 | ---D | M] -- C:\ProgramData\Origin
[2010/05/18 12:53:04 | 000,000,000 | ---D | M] -- C:\ProgramData\Sony
[2009/07/13 23:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2009/07/13 23:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2011/07/02 06:01:03 | 000,000,000 | ---D | M] -- C:\ProgramData\Ubisoft
[2011/12/13 18:03:42 | 000,000,000 | ---D | M] -- C:\ProgramData\Windows
[2011/12/31 04:16:47 | 000,032,552 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011/05/13 13:02:48 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2009/10/19 23:43:10 | 000,000,000 | -HSD | M] -- C:\Boot
[2010/08/22 11:34:28 | 000,000,000 | ---D | M] -- C:\divx
[2009/07/13 23:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011/10/26 17:19:16 | 000,000,000 | ---D | M] -- C:\Download
[2010/04/21 10:00:55 | 000,000,000 | ---D | M] -- C:\downloads
[2011/12/25 09:45:31 | 000,000,000 | ---D | M] -- C:\Fraps
[2011/01/02 20:12:45 | 000,000,000 | ---D | M] -- C:\Games
[2011/07/16 12:02:37 | 000,000,000 | ---D | M] -- C:\Hotspot Shield
[2010/12/07 07:03:05 | 000,000,000 | -H-D | M] -- C:\jdsfjsdijf.exe
[2011/10/26 17:17:15 | 000,000,000 | ---D | M] -- C:\Nexon
[2009/07/13 21:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012/01/13 09:41:49 | 000,000,000 | R--D | M] -- C:\Program Files
[2009/10/19 23:42:53 | 000,000,000 | ---D | M] -- C:\Program Files (x86)
[2011/12/10 05:54:17 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2009/10/19 07:53:03 | 000,000,000 | -HSD | M] -- C:\Recovery
[2012/01/22 13:55:29 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2012/01/20 09:30:17 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2009/10/19 07:54:05 | 000,000,000 | R--D | M] -- C:\Users
[2012/01/05 20:57:33 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2009/07/13 20:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009/07/13 20:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009/07/13 20:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009/07/13 20:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/13 20:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009/07/13 20:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009/07/13 20:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009/07/13 20:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/13 20:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009/07/13 20:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011/02/26 00:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009/07/13 20:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011/02/26 00:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009/10/31 00:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011/02/26 00:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\explorer.exe
[2011/02/26 00:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010/11/20 07:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009/08/03 00:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009/08/03 00:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009/10/31 01:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2011/03/11 00:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011/03/11 00:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 00:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0033117673c16921\iaStorV.sys
[2011/03/11 00:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011/03/11 00:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009/07/13 20:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/13 20:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010/11/20 07:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011/03/11 00:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010/11/20 07:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009/07/13 20:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009/07/13 20:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011/03/11 00:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011/03/11 00:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\drivers\nvstor.sys
[2011/03/11 00:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_38e464dbe521cc7f\nvstor.sys
[2011/03/11 00:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011/03/11 00:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011/03/11 00:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010/11/20 07:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009/07/13 20:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/13 20:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009/07/13 20:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009/07/13 20:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010/11/20 07:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009/07/13 20:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll
[2009/07/13 20:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010/11/20 07:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 07:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 20:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009/07/13 20:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009/10/28 01:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe
[2009/10/28 01:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009/10/28 00:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010/11/20 07:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009/07/13 20:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
[2011/12/24 11:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/13 18:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/13 18:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009/07/13 20:15:21 | 000,828,928 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\fontext.dll
[2011/11/11 00:50:43 | 010,990,080 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\ieframe.dll
[2009/07/13 20:16:12 | 000,006,144 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\psapi.dll
[2010/07/27 09:03:24 | 012,867,584 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\shell32.dll
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
< End of report >
--- --- ---

Hatte noch Firefox am laufen, um hier im Forum zu schreiben hoffe das das nichts ausmacht.

markusg 22.01.2012 17:13
hi
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:
Code:
:OTL
O4 - HKU\Schleusener_ON_C..\Run: [1SjOutZRnOxGgdc] C:\Users\Schleusener\AppData\Roaming\e5su745fss.exe (Pinnacle Systems)
O20 - HKU\Schleusener_ON_C Winlogon: Shell - (C:\Users\Schleusener\AppData\Roaming\e5su745fss.exe) - C:\Users\Schleusener\AppData\Roaming\e5su745fss.exe
(Pinnacle Systems)
[2012/01/22 05:46:24 | 000,095,744 | ---- | C] (Kassl GmbH) -- C:\Users\Schleusener\AppData\Roaming\dwlGina3.dll
[2012/01/21 20:01:39 | 000,344,064 | ---- | C] (Pinnacle Systems) -- C:\Users\Schleusener\AppData\Roaming\e5su745fss.exe

:Files
C:\Users\Schleusener\AppData\Roaming\e5su745fss.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.


Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

Kentamashi 22.01.2012 17:16
Hi! Danke der schnellen antwort! Ich kann erst spaeter wieder an einen anderen Rechner, kann ich das ganze auch irgendwie ueber dieses Reatogo X pe machen ?

Und was genau meinst du mit Hake alles an wie es im OTLPENet.exe beschrieben ist
Meinst du beim start wo ich den Haken raus machen muss, oder im Programm selbst irgendwas veraendern ?

Besten gruß!

markusg 22.01.2012 17:23
hi, du sollst den fix ja über die erstellte otl cd machen.
wenn du dort internet hast, ist das ok, falls nicht, wie gesagt auf nen stick kopieren.
genau, einfach die otl cd starten wie du es zum erstellen des logs gemacht hast.

Kentamashi 22.01.2012 17:32
Super ! Habe nun die Fix.txt erstellt und werde sie gleich laufen lassen vorher noch ein Screenshot von den Haken in OTLPE, um alles richtig zu machen!

Ist das so richtig?

hxxp://www.imgimg.de/bild_Hakena9a05b1fjpg.jpg.html

markusg 22.01.2012 17:35
ja, halt wie beim ersten mal :-)

Kentamashi 22.01.2012 17:47
Gut! Musste nun den fix manuell in die Scans Fixes leiste eintragen dann auf Run Fix gedrueckt! Hat auch soweit geklappt nur der PC ist nicht neu gestartet aber Processing Complete! Es hat sich auch keine Text datei mit dem Log geoeffnet. Soll ich den Rechner versuchen ohne CD neu zu starten?

Gruß

Kentamashi 22.01.2012 18:30
Kleines Update
Habe versucht den Rechner neu zu starten, ging aber nicht. Das Laufwerk wo die DVD drin liegt fing an lauter zu brummen und wurde dann wieder leiser, Rechner lief einwandfrei weiter *Immernoch Reatogo X pe*
Dann habe ich auf den einschalt button einmal gedrueckt und er ging immernoch nicht aus. Soll ich ihn abstuerzen lassen und beim hochfahren cd fix raus nehmen?

markusg 22.01.2012 18:32
ja, wenn er sich nicht runter fahren lässt muss das wohl sein :-)

Kentamashi 22.01.2012 18:47
Ok - getan!
Ein Lichtblick !! Windows hat sich wieder normal gestartet CD habe ich beim Hochfahren schnell raus genommen, allerdings sind anscheind meine kompletten einstellungen weg meine Maus ist sehr langsam ich habe garkeine Desktopverknüpfungen mehr und alles ist sehr klein (schrift etc), aber das kann warten!

Es hat sich leider keine Text Datei geöffnet, lade aber mal den MovedFiles Ordner hoch!

Danke nochmal !

markusg 22.01.2012 18:48
danke.
danach führe mal folgendes aus:
rechtsklick desktop, ansicht, symbole einblenden.
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
  • Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
    Tool

    Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Hinweis:
    Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  • Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Kentamashi 22.01.2012 19:01
Hab es mir gedownloadet - Hat sich Automatisch in den download ordner getan, hab es aber auf den Desktop gezogen. Programm gestartet dann lädt es kurz und dann kommt
Warning!!
Do not use in Compatibility Mode
Does much Damage on Mashine

irgend sowas und dann beendet es sich :(

Gruß!

markusg 22.01.2012 19:44
ok, dann folgendes:

malwarebytes:
Downloade Dir bitte Malwarebytes
  • Installiere
    das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche
    nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet
    ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste
    das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:00 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131