Trojaner-Board - Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht (https://www.trojaner-board.de/111698-weisser-bildschirm-abgesicherter-modus-funktioniert.html)

Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht

Hallo.

Ich habe wohl einen Virus/ Trojaner auf meinem Windows Laptop.
Es erscheint direkt nach dem starten ein weißer Bildschirm.
Zu sehen ist: Bitte warten sie während die Verbindung hergestellt wird.
(da der Laptop aber nicht (mehr) mit dem Internet verbunden ist, kommt da auch nichts weiter)
Dieser weiße Bildschirm erscheint auch, wenn ich im abgesicherten Modus starte oder auch im abgesicherten Modus mit Netzwerktreibern.

Ich kann also gar nichts machen.

Ich wäre über eure Hilfe sehr dankbar.

Vielen Dank schon an dieser Stelle!

hi
Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.

Lade

OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.

Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
Lege eine leere CD in Deinen Brenner.
ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
Du kannst nun die Fenster des Brennprogramms schließen.

Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD

Bebilderte Anleitung: OTLpe-Scan

Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
Mache einen Doppelklick auf das OTLPE Icon.
Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
OTLpe sollte nun starten.
Drücke Run Scan, um den Scan zu starten.
Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
Bitte poste den Inhalt von C:\OTL.txt und Extras.txt.

also die OTPLEnet.exe hab ich runtergeladen und iso burner auch.
wenn ich aber die .exe doppel anklicke, dan kommt die frage, ob ich das wauf cd brennen möchte, ich klicke auf ja und dann kommt extracting. wenn das voll gelade ist, erscheint automatisch img burn.
damit kenn ich ich aber null aus. auch die anleitung hilft mir nicht. oder soll ich einfach manuell iso burner öffnen, und die OTPLENet. exe damit dann brennen?

ich versteh den schritt dazwischen noch nich ganz O.ô

danke aber auf alle fälle schon mal für dene hilfe!

dann deinstaliere img burn dann müsste er es mit isoburner öffnen.

okay. das werde ih dann als nächstes tun, gerade passiert hier aber folgendes und ich weiß nicht, obs richtig ist:

ich hab einen rohling eingelegt, auf die .exe geklickt und dann ja geantwortet, als gefragt wurde, ob ich ees auf cd brennen möchte. daraufhin kam extracting und jetzt brennt img burn etwas auf die cd.
ist das nun richtig oder falsch?

das ist in ordnung, lasse img burn arbeiten und mach dann mit dem rest der anleitung weiter

okay. bin nun mit der reatogo-x-pe-CD drin. wenn ich jetzt allerdings auf das OTLPE icon klicke, kommt:

browse for folder
choose windows directory

my computer
>RAMdisk (b)
>System Reseerved (C)
>X (D)
>loal Disk (e)
>reatogoPE(X)
>shared documents

was tun?

alle nacheinander aufklappen, den windows ordner suchen, anklicken, und los gehts :-)

welchen windows ordner?
also system32 finde ich nicht.

mein betriebssystem ist aber auf C

der ordner heißt windows den anklicken.

habe den/einen windows ordner unter E: local disk gefunden, wenn ich den dann öffne, kommt die frage:

Do you wish to load remote user profile(s) for scanning.

Die steht ja auch in deiner anleitung, aber die frage nach der remote registry kam nicht. wie problematisch ist das? hab ich vllt. doch den falschen ordner?

oder einfach auf yes klicken?

bitte antworte(n) :)

hi,
so was wie bitte antworten kannst du dir schenken.
bist hier nicht der einzige.
und, steht doch eig auch in der anleitung was anzuklicken ist.

ja. das steht in deiner anleitung und dafür danke ich dir auch sehr, allerdngs steht da:

• Wenn du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
• Wenn du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes

bei mir kam die erste frage nicht, sondern direkt die zweite. ist das jetzt problematisch?

nein, wird auch so gehen denke ich.

okay. nun steht hier folgendes:

select user profile:

LocalService
NetworkService
X
systemprofile

Und dadrunter: Automaically Local All Remaining User?
Den haken habe ich weggemacht.

aber welches user profile soll ich auswählen?

müsste system profile sein

okay. bin in otl drin. aber wie krieg ich die diese textbox da eingefügt?
internetverbindung krieg ich nicht hin und einen usb-stick erkennt er nicht..

das wurde mir jetyt angezeigt.
ich hoffe, dass sit alles richtig so und hilft dir weiter.

ich danke dir fuer deine hilfe!

Code:

OTL logfile created on: 3/18/2012 10:43:40 PM - Run 

OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE

64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 88.00% Memory free

3.00 Gb Paging File | 3.00 Gb Available in Paging File | 95.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files (x86)

Drive C: | 100.00 Mb Total Space | 74.34 Mb Free Space | 74.35% Space Free | Partition Type: NTFS

Drive D: | 195.31 Gb Total Space | 66.96 Gb Free Space | 34.28% Space Free | Partition Type: NTFS

Drive E: | 260.80 Gb Total Space | 91.42 Gb Free Space | 35.05% Space Free | Partition Type: NTFS

Drive F: | 3.72 Gb Total Space | 1.71 Gb Free Space | 45.87% Space Free | Partition Type: FAT32

Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

 

Computer Name: REATOGO | User Name: SYSTEM

Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

Using ControlSet: ControlSet001

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2010/09/22 13:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)

SRV:64bit: - [2009/08/12 17:11:54 | 000,522,240 | ---- | M] (Sony Corporation) [Auto] -- E:\Program Files\Sony\VAIO Smart Network\VSNService.exe -- (VSNService)

SRV:64bit: - [2009/07/27 16:27:07 | 000,203,264 | ---- | M] (AMD) [Auto] -- E:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2009/07/24 00:34:31 | 000,189,984 | ---- | M] (Realtek Semiconductor) [Auto] -- E:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe -- (RtkAudioService)

SRV:64bit: - [2009/07/16 03:36:56 | 000,411,496 | ---- | M] (Sony Corporation) [Auto] -- E:\Program Files\Sony\VAIO Power Management\SPMService.exe -- (VAIO Power Management)

SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV:64bit: - [2009/07/01 12:54:02 | 000,864,032 | ---- | M] (Broadcom Corporation.) [Auto] -- E:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)

SRV:64bit: - [2009/06/26 08:56:10 | 000,357,672 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe -- (VcmINSMgr)

SRV:64bit: - [2009/06/26 08:35:04 | 000,468,264 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe -- (VcmIAlzMgr)

SRV:64bit: - [2009/06/17 12:50:30 | 000,110,888 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe -- (VcmXmlIfHelper)

SRV - [2012/02/28 12:38:54 | 002,343,816 | ---- | M] (LogMeIn Inc.) [Auto] -- E:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)

SRV - [2011/11/30 18:23:10 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand] -- E:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2011/07/21 06:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- E:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011/06/06 07:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto] -- E:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011/04/21 01:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- E:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011/04/01 06:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand] -- E:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)

SRV - [2011/03/28 06:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)

SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010/03/18 05:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [On_Demand] -- E:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)

SRV - [2009/07/27 10:58:40 | 000,091,432 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe -- (SOHPlMgr)

SRV - [2009/07/27 10:58:38 | 000,427,304 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe -- (SOHDms)

SRV - [2009/07/27 10:58:38 | 000,075,048 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe -- (SOHDs)

SRV - [2009/07/27 10:58:38 | 000,070,952 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe -- (SOHDBSvr)

SRV - [2009/07/27 10:58:36 | 000,120,104 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe -- (SOHCImp)

SRV - [2009/07/23 04:39:38 | 000,313,264 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe -- (Vcsw)

SRV - [2009/07/23 04:39:38 | 000,069,632 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe -- (VAIO Entertainment TV Device Arbitration Service)

SRV - [2009/07/23 04:39:36 | 000,206,336 | ---- | M] (Sony Corporation) [Auto] -- E:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe -- (VzCdbSvc)

SRV - [2009/07/22 09:03:04 | 000,642,920 | ---- | M] (Sony Corporation) [Auto] -- E:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe -- (VCFw)

SRV - [2009/07/01 05:49:34 | 000,204,648 | ---- | M] (Sony Corporation) [Auto] -- E:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service)

SRV - [2009/06/26 05:25:36 | 000,362,992 | ---- | M] (Sonic Solutions) [Auto] -- E:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe -- (Roxio Upnp Server 10)

SRV - [2009/06/26 05:25:24 | 000,313,840 | ---- | M] (Sonic Solutions) [On_Demand] -- E:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe -- (Roxio UPnP Renderer 10)

SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009/06/04 13:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto] -- E:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)

SRV - [2008/09/18 04:59:10 | 000,104,960 | ---- | M] (ArcSoft, Inc.) [Auto] -- E:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe -- (uCamMonitor)

SRV - [2008/08/07 06:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand] -- E:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)

SRV - [2007/01/10 23:02:00 | 000,126,464 | ---- | M] (SEIKO EPSON CORPORATION) [Auto] -- E:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE -- (EPSON_PM_RPCV4_01) EPSON V3 Service4(01)

SRV - [2007/01/04 13:48:50 | 000,112,152 | ---- | M] (InterVideo) [Auto] -- E:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2011/08/02 12:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64)

DRV:64bit: - [2011/07/21 06:11:10 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System] -- E:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2011/07/21 06:11:09 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto] -- E:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2011/05/13 10:37:54 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\fssfltr.sys -- (fssfltr)

DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010/11/20 05:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\sdbus.sys -- (sdbus)

DRV:64bit: - [2010/09/14 08:03:11 | 000,314,016 | ---- | M] () [Kernel | Auto] -- E:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV:64bit: - [2010/09/14 08:03:11 | 000,043,680 | ---- | M] () [Kernel | Auto] -- E:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV:64bit: - [2010/09/14 07:43:22 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- E:\Windows\System32\drivers\sptd.sys -- (sptd)

DRV:64bit: - [2010/04/19 14:29:18 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\netaapl64.sys -- (Netaapl)

DRV:64bit: - [2010/02/03 09:56:56 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\hamachi.sys -- (hamachi)

DRV:64bit: - [2009/10/20 14:19:54 | 000,047,632 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto] -- E:\Windows\System32\drivers\npf.sys -- (NPF)

DRV:64bit: - [2009/08/04 21:22:40 | 000,139,264 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)

DRV:64bit: - [2009/08/04 21:20:51 | 007,345,632 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2009/08/03 16:06:34 | 000,250,928 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\Apfiltr.sys -- (ApfiltrService)

DRV:64bit: - [2009/07/31 16:29:11 | 001,484,800 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\athrx.sys -- (athr)

DRV:64bit: - [2009/07/31 16:14:14 | 000,076,288 | ---- | M] (REDC) [Kernel | Auto] -- E:\Windows\system32\DRIVERS\risdsn64.sys -- (risdptsk)

DRV:64bit: - [2009/07/31 16:13:51 | 000,086,528 | ---- | M] (REDC) [Kernel | Auto] -- E:\Windows\system32\DRIVERS\rimssn64.sys -- (rimsptsk)

DRV:64bit: - [2009/07/31 16:02:03 | 000,393,216 | ---- | M] (Marvell) [Kernel | On_Demand] -- E:\Windows\System32\drivers\yk62x64.sys -- (yukonw7)

DRV:64bit: - [2009/07/27 16:27:10 | 006,037,504 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)

DRV:64bit: - [2009/07/24 01:24:03 | 000,201,472 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\RtHDMIVX.sys -- (RTHDMIAzAudService)

DRV:64bit: - [2009/06/11 16:19:09 | 000,011,392 | ---- | M] (Sony Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\SFEP.sys -- (SFEP)

DRV:64bit: - [2009/06/10 17:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\VSTDPV6.SYS -- (SrvHsfV92)

DRV:64bit: - [2009/06/10 17:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)

DRV:64bit: - [2009/06/10 17:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\VSTAZL6.SYS -- (SrvHsfHDA)

DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- E:\Windows\System32\wbem\ntfs.mof -- (Ntfs)

DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)

DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009/06/05 16:04:10 | 005,435,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\NETw5v64.sys -- (netw5v64) Intel(R)

DRV:64bit: - [2009/05/26 08:32:04 | 000,019,968 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ArcSoftKsUFilter.sys -- (ArcSoftKsUFilter)

DRV:64bit: - [2009/05/20 06:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot] -- E:\Windows\System32\drivers\PxHlpa64.sys -- (PxHlpa64)

DRV:64bit: - [2007/04/16 14:51:50 | 000,014,112 | R--- | M] (InterVideo) [Kernel | Auto] -- E:\Windows\System32\drivers\regi.sys -- (regi)

DRV:64bit: - [2007/04/11 10:35:30 | 000,056,080 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)

DRV:64bit: - [2007/04/11 10:35:22 | 000,053,520 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)

DRV - [2009/07/28 20:55:42 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto] -- E:\Windows\SysWOW64\drivers\SSPORT.SYS -- (SSPORT)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

 

 

IE - HKU\Sebastian_Rosner_ON_E\Software\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKU\Sebastian_Rosner_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\Sebastian_Rosner_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\Sebastian_Rosner_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E7 80 DE E2 36 FC CB 01  [binary data]

IE - HKU\Sebastian_Rosner_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1

IE - HKU\Sebastian_Rosner_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local

 

 

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=:  

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0:  File not found

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: E:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: E:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@gamersfirst.com/LiveLauncher:  File not found

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@google.com/npPicasa3,version=3.0.0:  File not found

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: E:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: E:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 3.5.10\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/03/11 14:37:59 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 3.5.10\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/12/14 07:05:02 | 000,000,000 | ---D | M]

 

[2010/05/31 12:17:25 | 000,000,000 | ---D | M] (No name found) -- E:\Program Files (x86)\Mozilla Firefox\extensions

[2009/12/02 04:31:53 | 000,001,392 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2009/12/02 04:31:53 | 000,002,344 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2009/12/02 04:31:53 | 000,006,805 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2009/12/02 04:31:53 | 000,001,178 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2009/12/02 04:31:53 | 000,000,801 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - E:\Windows\System32\drivers\etc\hosts

O2 - BHO: (no name) - {09628AAA-66AD-4FA2-82E2-698185B66463} - No CLSID value found.

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - E:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - E:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O4:64bit: - HKLM..\Run: [Apoint] E:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)

O4:64bit: - HKLM..\Run: [IAAnotif] E:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [RtHDVCpl] E:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [Skytel] E:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [APSDaemon] E:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [avgnt] E:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [ISBMgr.exe] E:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)

O4 - HKLM..\Run: [iTunesHelper]  File not found

O4 - HKLM..\Run: [LogMeIn Hamachi Ui] E:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)

O4 - HKLM..\Run: [MarketingTools] E:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe (Sony Corporation)

O4 - HKLM..\Run: [PC Auto Shutdown]  File not found

O4 - HKLM..\Run: [Samsung PanelMgr] E:\Windows\Samsung\PanelMgr\ssmmgr.exe ()

O4 - HKLM..\Run: [StartCCC] E:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [TrayServer]  File not found

O4 - HKU\LocalService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\NetworkService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\Sebastian_Rosner_ON_E..\Run: [DAEMON Tools Lite] E:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O4 - HKU\Sebastian_Rosner_ON_E..\Run: [EPSON Stylus DX4400 Series]  File not found

O4 - HKU\Sebastian_Rosner_ON_E..\Run: [ICQ]  File not found

O4 - HKU\Sebastian_Rosner_ON_E..\Run: [K3aRyluP6SiCkoR] E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe (All Alex,Inc)

O4 - HKU\LocalService_ON_E..\RunOnce: [mctadmin]  File not found

O4 - HKU\NetworkService_ON_E..\RunOnce: [mctadmin]  File not found

O4 - Startup: Error locating startup folders.

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKU\Sebastian_Rosner_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\Sebastian_Rosner_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0

O7 - HKU\Sebastian_Rosner_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1

O7 - HKU\Sebastian_Rosner_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKU\Sebastian_Rosner_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - E:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - E:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - E:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - E:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O13:64bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)

O16:64bit: - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)

O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)

O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)

O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKU\Sebastian_Rosner_ON_E Winlogon: Shell - (C:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe) - E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe (All Alex,Inc)

O20 - HKU\Sebastian_Rosner_ON_E Winlogon: UserInit - (C:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe) - E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe (All Alex,Inc)

O20 - Winlogon\Notify\VESWinlogon: DllName - VESWinlogon.dll - E:\Windows\SysWow64\VESWinlogon.dll (Sony Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
 64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
 64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - 

ActiveX:64bit: >{E180241B-EB76-4C34-83A1-489F6DEE2BB7} - RunDLL32 IEDKCS32.DLL,BrandIE4 CUSTOM

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - 

ActiveX: >{E180241B-EB76-4C34-83A1-489F6DEE2BB7} - RunDLL32 IEDKCS32.DLL,BrandIE4 CUSTOM

 

 

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012/03/13 19:15:27 | 000,308,224 | ---- | C] (All Alex,Inc) -- E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe

[2012/03/13 13:57:10 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{D93FF6C6-6F29-4831-BD9A-F17A0FBF1675}

[2012/03/13 13:56:37 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{F28A3E22-78BC-409D-9CFC-335A3B438473}

[2012/03/12 13:22:44 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{55A03D60-06C4-44A5-8367-0083CD5EA881}

[2012/03/12 13:22:11 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{F191252B-6C7F-43EC-A97E-E2AC176BE4EA}

[2012/03/08 13:43:55 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{E7DEF6AF-882F-4AC4-AD03-AD44DB8A479E}

[2012/03/08 13:43:22 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{DA94EA3F-AED4-44AA-83F0-3CC53BCE4DDA}

[2012/03/07 17:52:15 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{B67D7E93-20BB-4243-83F6-F36D65068203}

[2012/03/07 17:51:42 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{9B979ED0-E1EF-45AE-BAA5-319F7329E720}

[2012/03/07 05:51:28 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{C6639BAC-5CCE-451F-B9D0-B8B5A0C8E1A1}

[2012/03/07 05:50:54 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{4C034C90-A2B2-40E3-9743-EF83195CA2A6}

[2012/03/06 07:51:52 | 000,584,704 | ---- | C] (OldTimer Tools) -- E:\Users\Sebastian Rosner\Desktop\OTL.exe

[2012/03/06 07:19:39 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{9DB697E4-666C-4A6E-AB16-AF0F03BD38FB}

[2012/03/06 07:19:26 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{0B6C1ADD-2AE7-4299-A6C8-87FB689860A0}

[2012/03/06 05:40:45 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Roaming\Malwarebytes

[2012/03/06 05:40:35 | 000,000,000 | ---D | C] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012/03/06 05:40:34 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- E:\Windows\System32\drivers\mbam.sys

[2012/03/06 05:40:34 | 000,000,000 | ---D | C] -- E:\ProgramData\Malwarebytes

[2012/03/06 05:39:54 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\Desktop\Viren

[2012/03/05 10:02:52 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{C87D57AD-62C3-4F4D-99D9-9B38AEA61C3D}

[2012/03/05 10:02:20 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{FD492D71-14E2-4AC4-A165-CBAF84233B87}

[2012/03/04 06:28:32 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{29E72FC0-57B2-4AC7-845A-9B5C3AEAF8E2}

[2012/03/04 06:28:02 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{C0034C6B-713A-4039-B313-CADEDFBA083B}

[2012/03/03 09:06:04 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{71DE17F7-BEDD-4F00-8039-7BB039CCE67F}

[2012/03/03 09:05:35 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{5E748FBA-7EB2-4B60-B7BC-EF8FDE7B5F86}

[2012/03/02 10:31:50 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Roaming\EPSON

[2012/03/02 06:14:38 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{9072EE92-AB14-4941-9390-521C2A7E93BD}

[2012/03/02 06:14:08 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{3C1E01C8-2AA5-466E-9DF1-A5DF5F2A94E2}

[2012/03/01 15:36:04 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\Risen

[2012/03/01 15:14:11 | 000,000,000 | ---D | C] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

[2012/03/01 15:14:08 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\AGEIA Technologies

[2012/03/01 15:14:08 | 000,000,000 | ---D | C] -- E:\Windows\SysWow64\AGEIA

[2012/03/01 15:13:43 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Common Files\Wise Installation Wizard

[2012/03/01 15:13:23 | 000,518,480 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\XAudio2_3.dll

[2012/03/01 15:13:23 | 000,514,384 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\XAudio2_3.dll

[2012/03/01 15:13:23 | 000,074,576 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\XAPOFX1_2.dll

[2012/03/01 15:13:23 | 000,070,992 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\XAPOFX1_2.dll

[2012/03/01 15:13:22 | 000,235,856 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine3_3.dll

[2012/03/01 15:13:22 | 000,175,440 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine3_3.dll

[2012/03/01 15:13:22 | 000,025,936 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\X3DAudio1_5.dll

[2012/03/01 15:13:22 | 000,023,376 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\X3DAudio1_5.dll

[2012/03/01 15:13:20 | 001,942,552 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DCompiler_39.dll

[2012/03/01 15:13:20 | 000,540,688 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx10_39.dll

[2012/03/01 15:13:19 | 004,992,520 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DX9_39.dll

[2012/03/01 15:13:18 | 000,511,496 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\XAudio2_1.dll

[2012/03/01 15:13:18 | 000,507,400 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\XAudio2_1.dll

[2012/03/01 15:13:18 | 000,238,088 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine3_1.dll

[2012/03/01 15:13:18 | 000,177,672 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine3_1.dll

[2012/03/01 15:13:18 | 000,068,104 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\XAPOFX1_0.dll

[2012/03/01 15:13:18 | 000,065,032 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\XAPOFX1_0.dll

[2012/03/01 15:13:18 | 000,028,168 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\X3DAudio1_4.dll

[2012/03/01 15:13:18 | 000,025,608 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\X3DAudio1_4.dll

[2012/03/01 15:13:17 | 001,941,528 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DCompiler_38.dll

[2012/03/01 15:13:17 | 001,491,992 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\D3DCompiler_38.dll

[2012/03/01 15:13:17 | 000,540,688 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx10_38.dll

[2012/03/01 15:13:17 | 000,467,984 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx10_38.dll

[2012/03/01 15:13:15 | 004,991,496 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DX9_38.dll

[2012/03/01 15:13:15 | 003,850,760 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\D3DX9_38.dll

[2012/03/01 15:13:15 | 000,489,480 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\XAudio2_0.dll

[2012/03/01 15:13:15 | 000,479,752 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\XAudio2_0.dll

[2012/03/01 15:13:15 | 000,238,088 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine3_0.dll

[2012/03/01 15:13:15 | 000,177,672 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine3_0.dll

[2012/03/01 15:13:14 | 000,028,168 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\X3DAudio1_3.dll

[2012/03/01 15:13:14 | 000,025,608 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\X3DAudio1_3.dll

[2012/03/01 15:13:13 | 001,860,120 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DCompiler_37.dll

[2012/03/01 15:13:13 | 001,420,824 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\D3DCompiler_37.dll

[2012/03/01 15:13:13 | 000,529,424 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx10_37.dll

[2012/03/01 15:13:13 | 000,462,864 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx10_37.dll

[2012/03/01 15:13:12 | 004,910,088 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DX9_37.dll

[2012/03/01 15:13:12 | 003,786,760 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\D3DX9_37.dll

[2012/03/01 15:13:12 | 000,411,656 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_10.dll

[2012/03/01 15:13:12 | 000,267,272 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_10.dll

[2012/03/01 15:13:10 | 002,006,552 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DCompiler_36.dll

[2012/03/01 15:13:10 | 001,374,232 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\D3DCompiler_36.dll

[2012/03/01 15:13:10 | 000,508,264 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx10_36.dll

[2012/03/01 15:13:10 | 000,444,776 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx10_36.dll

[2012/03/01 15:13:09 | 005,081,608 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_36.dll

[2012/03/01 15:13:09 | 003,734,536 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_36.dll

[2012/03/01 15:13:08 | 000,411,496 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_9.dll

[2012/03/01 15:13:08 | 000,267,112 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_9.dll

[2012/03/01 15:13:07 | 001,985,904 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DCompiler_35.dll

[2012/03/01 15:13:07 | 001,358,192 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\D3DCompiler_35.dll

[2012/03/01 15:13:07 | 000,508,264 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx10_35.dll

[2012/03/01 15:13:07 | 000,444,776 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx10_35.dll

[2012/03/01 15:13:05 | 005,073,256 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_35.dll

[2012/03/01 15:13:05 | 003,727,720 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_35.dll

[2012/03/01 15:13:05 | 000,409,960 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_8.dll

[2012/03/01 15:13:05 | 000,266,088 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_8.dll

[2012/03/01 15:13:05 | 000,021,000 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\X3DAudio1_2.dll

[2012/03/01 15:13:05 | 000,017,928 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\X3DAudio1_2.dll

[2012/03/01 15:13:04 | 001,401,200 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DCompiler_34.dll

[2012/03/01 15:13:04 | 001,124,720 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\D3DCompiler_34.dll

[2012/03/01 15:13:04 | 000,506,728 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx10_34.dll

[2012/03/01 15:13:04 | 000,443,752 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx10_34.dll

[2012/03/01 15:13:03 | 004,496,232 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_34.dll

[2012/03/01 15:13:03 | 003,497,832 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_34.dll

[2012/03/01 15:13:02 | 000,403,304 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_7.dll

[2012/03/01 15:13:02 | 000,261,480 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_7.dll

[2012/03/01 15:13:02 | 000,107,368 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xinput1_3.dll

[2012/03/01 15:13:02 | 000,081,768 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xinput1_3.dll

[2012/03/01 15:13:01 | 001,400,176 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DCompiler_33.dll

[2012/03/01 15:13:01 | 001,123,696 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\D3DCompiler_33.dll

[2012/03/01 15:13:01 | 000,506,728 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx10_33.dll

[2012/03/01 15:13:01 | 000,443,752 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx10_33.dll

[2012/03/01 15:13:00 | 004,494,184 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_33.dll

[2012/03/01 15:13:00 | 003,495,784 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_33.dll

[2012/03/01 15:12:59 | 000,393,576 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_6.dll

[2012/03/01 15:12:59 | 000,255,848 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_6.dll

[2012/03/01 15:12:58 | 000,469,264 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx10.dll

[2012/03/01 15:12:58 | 000,440,080 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx10.dll

[2012/03/01 15:12:58 | 000,390,424 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_5.dll

[2012/03/01 15:12:58 | 000,251,672 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_5.dll

[2012/03/01 15:12:56 | 000,364,824 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_4.dll

[2012/03/01 15:12:56 | 000,237,848 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_4.dll

[2012/03/01 15:12:56 | 000,017,688 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\x3daudio1_1.dll

[2012/03/01 15:12:56 | 000,015,128 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\x3daudio1_1.dll

[2012/03/01 15:12:55 | 003,977,496 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_31.dll

[2012/03/01 15:12:55 | 002,414,360 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_31.dll

[2012/03/01 15:12:54 | 000,363,288 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_3.dll

[2012/03/01 15:12:54 | 000,236,824 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_3.dll

[2012/03/01 15:12:54 | 000,083,736 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xinput1_2.dll

[2012/03/01 15:12:54 | 000,062,744 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xinput1_2.dll

[2012/03/01 15:12:53 | 000,354,072 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_2.dll

[2012/03/01 15:12:53 | 000,230,168 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_2.dll

[2012/03/01 15:12:53 | 000,083,664 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xinput1_1.dll

[2012/03/01 15:12:53 | 000,062,672 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xinput1_1.dll

[2012/03/01 15:12:52 | 000,352,464 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_1.dll

[2012/03/01 15:12:52 | 000,229,584 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_1.dll

[2012/03/01 15:12:47 | 003,927,248 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_30.dll

[2012/03/01 15:12:47 | 002,388,176 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_30.dll

[2012/03/01 15:12:46 | 000,355,536 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_0.dll

[2012/03/01 15:12:46 | 000,230,096 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_0.dll

[2012/03/01 15:12:46 | 000,016,592 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\x3daudio1_0.dll

[2012/03/01 15:12:46 | 000,014,032 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\x3daudio1_0.dll

[2012/03/01 15:12:44 | 003,830,992 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_29.dll

[2012/03/01 15:12:44 | 002,332,368 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_29.dll

[2012/03/01 15:12:43 | 003,815,120 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_28.dll

[2012/03/01 15:12:43 | 002,323,664 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_28.dll

[2012/03/01 15:12:42 | 003,807,440 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_27.dll

[2012/03/01 15:12:42 | 002,319,568 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_27.dll

[2012/03/01 15:12:40 | 003,767,504 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_26.dll

[2012/03/01 15:12:40 | 002,297,552 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_26.dll

[2012/03/01 15:12:39 | 003,823,312 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_25.dll

[2012/03/01 15:12:39 | 002,337,488 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_25.dll

[2012/03/01 15:12:37 | 003,544,272 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_24.dll

[2012/03/01 15:12:37 | 002,222,800 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_24.dll

[2012/03/01 14:55:15 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{501BDB27-3108-44F5-A018-0F7EB9D07AFA}

[2012/03/01 14:54:45 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{4112FD1D-DD25-4F6C-B872-E9F804C290D7}

[2012/03/01 03:20:21 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\Desktop\Fotos Mama

[2012/03/01 03:15:08 | 000,000,000 | ---D | C] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi

[2012/03/01 03:15:03 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\LogMeIn Hamachi

[2012/02/29 19:44:01 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\Desktop\StonerockAlbumFotos

[2012/02/29 07:36:10 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{EF930F8C-8841-45FA-9BC7-B7C53A06B54A}

[2012/02/29 07:35:39 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{94006AB0-8C7E-487E-96EA-FE9FB471B2E7}

[2012/02/28 19:35:18 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{7814422E-90E3-4628-8C0A-D4CD50789E61}

[2012/02/28 19:34:49 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{52DDC274-298A-4351-B08E-8CA55F3644A2}

[2012/02/28 07:34:26 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{20EE24DA-8E03-4431-936D-5524FBA3F2A6}

[2012/02/28 07:33:56 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{16D07746-A325-4C5E-B73E-DA22B08D3AFD}

[2012/02/27 18:48:38 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{68F031A6-BBDC-4E74-B9A8-0029A2479D04}

[2012/02/27 18:48:08 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{137E188E-2B09-489F-998F-874AF7D7D596}

[2012/02/27 06:47:45 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{37FAD16E-1BE4-4BFD-BD99-1C3AC351005A}

[2012/02/27 06:47:15 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{A35111E5-D02A-46BD-A68B-1D9F829F1FFD}

[2012/02/26 16:35:34 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{15FBAA72-264E-453D-9E28-19AAB587795B}

[2012/02/26 16:35:05 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{1E3C63CE-49A1-4DF8-AFD1-F3E7E3229EAA}

[2012/02/26 15:59:41 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{F8C6E89C-4CAA-45AE-91F6-0410F4C6825A}

[2012/02/25 08:21:06 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{9DF0A60C-5C3F-43A6-8BD0-393B9CA8A5E8}

[2012/02/25 08:20:35 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{F5208DFE-9CCB-4B2D-99A6-CC4CA687831A}

[2012/02/24 07:25:47 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{76952553-17AC-4C55-BD93-E4BED1CD79C9}

[2012/02/24 07:25:17 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{9C990647-40B6-4138-9DB2-46DF625E6F0E}

[2012/02/23 08:51:09 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{21EAA541-6AAD-406D-A731-9BD94E910EC2}

[2012/02/23 08:50:51 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{83573AFC-90C7-463D-96BC-EE3584EAF2BB}

[2012/02/22 08:02:57 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{43C93030-F838-48B8-96E5-251BACA11A63}

[2012/02/22 08:02:27 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{7A759E95-74F1-47B2-9EBA-8974F0168EA1}

[2012/02/21 09:30:41 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{50584D68-E714-49E5-BF54-D9C5A02863D1}

[2012/02/21 09:30:23 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{02F2F4D5-81AA-47B6-8D5D-8E6331F43870}

[2012/02/20 06:41:56 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{22950753-6FB9-42C3-8438-F68C39D54E2C}

[2012/02/20 06:41:26 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{0957B350-4EA7-42E6-B655-89F1ED3B1714}

[2012/02/19 18:41:04 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{526A1907-2808-4B81-992F-2ECB30888DBC}

[2012/02/19 18:40:35 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{5631D1CD-C674-4FE1-8543-64A81BAC727E}

[1 E:\Windows\*.tmp files -> E:\Windows\*.tmp -> ]

[1 E:\Users\Sebastian Rosner\AppData\Roaming\*.tmp files -> E:\Users\Sebastian Rosner\AppData\Roaming\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012/03/18 14:36:50 | 000,067,584 | --S- | M] () -- E:\Windows\bootstat.dat

[2012/03/18 14:35:48 | 3195,293,696 | -HS- | M] () -- E:\hiberfil.sys

[2012/03/13 19:15:25 | 000,308,224 | ---- | M] (All Alex,Inc) -- E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe

[2012/03/13 13:50:17 | 000,038,910 | ---- | M] () -- E:\Users\Sebastian Rosner\Desktop\MM2.pdf

[2012/03/13 12:53:53 | 000,009,696 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012/03/13 12:53:53 | 000,009,696 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012/03/06 07:51:54 | 000,584,704 | ---- | M] (OldTimer Tools) -- E:\Users\Sebastian Rosner\Desktop\OTL.exe

[2012/03/06 05:40:35 | 000,001,005 | ---- | M] () -- E:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012/03/06 05:40:35 | 000,000,000 | ---D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012/03/04 14:15:17 | 000,654,400 | ---- | M] () -- E:\Windows\System32\perfh007.dat

[2012/03/04 14:15:17 | 000,616,242 | ---- | M] () -- E:\Windows\System32\perfh009.dat

[2012/03/04 14:15:17 | 000,130,240 | ---- | M] () -- E:\Windows\System32\perfc007.dat

[2012/03/04 14:15:17 | 000,106,622 | ---- | M] () -- E:\Windows\System32\perfc009.dat

[2012/03/01 15:14:11 | 000,000,000 | ---D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

[2012/03/01 15:11:38 | 000,000,000 | R--D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

[2012/03/01 11:15:34 | 000,387,586 | ---- | M] () -- E:\Users\Sebastian Rosner\Desktop\IMG_0953.JPG

[2012/03/01 03:15:13 | 000,000,886 | ---- | M] () -- E:\Users\Public\Desktop\LogMeIn Hamachi.lnk

[2012/03/01 03:15:12 | 000,000,000 | ---D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi

[2012/02/28 08:40:02 | 000,009,346 | ---- | M] () -- E:\Users\Sebastian Rosner\Desktop\Plakat_StoneRock_quer.png

[2012/02/24 07:25:30 | 000,347,846 | ---- | M] () -- E:\Users\Sebastian Rosner\Desktop\Bandcontest2.jpg

[1 E:\Windows\*.tmp files -> E:\Windows\*.tmp -> ]

[1 E:\Users\Sebastian Rosner\AppData\Roaming\*.tmp files -> E:\Users\Sebastian Rosner\AppData\Roaming\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012/03/13 13:50:16 | 000,038,910 | ---- | C] () -- E:\Users\Sebastian Rosner\Desktop\MM2.pdf

[2012/03/06 05:40:35 | 000,001,005 | ---- | C] () -- E:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012/03/02 08:49:37 | 000,387,586 | ---- | C] () -- E:\Users\Sebastian Rosner\Desktop\IMG_0953.JPG

[2012/02/28 08:40:01 | 000,009,346 | ---- | C] () -- E:\Users\Sebastian Rosner\Desktop\Plakat_StoneRock_quer.png

[2012/02/24 07:25:30 | 000,347,846 | ---- | C] () -- E:\Users\Sebastian Rosner\Desktop\Bandcontest2.jpg

[2011/12/21 10:57:55 | 000,004,608 | ---- | C] () -- E:\Users\Sebastian Rosner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011/11/23 08:13:28 | 000,000,034 | ---- | C] () -- E:\Users\Sebastian Rosner\AppData\Roaming\blckdom.res

[2011/11/07 18:48:57 | 000,004,096 | ---- | C] () -- E:\Windows\d3dx.dat

[2011/09/13 09:04:44 | 000,482,408 | ---- | C] () -- E:\Windows\ssndii.exe

[2011/06/01 19:11:11 | 000,252,928 | ---- | C] () -- E:\Windows\SysWow64\DShowRdpFilter.dll

[2011/03/12 17:07:03 | 000,019,414 | ---- | C] () -- E:\Users\Sebastian Rosner\AppData\Roaming\UserTile.png

[2011/03/11 04:35:39 | 000,000,047 | ---- | C] () -- E:\Windows\NeroDigital.ini

[2011/03/05 10:45:12 | 000,000,760 | ---- | C] () -- E:\Users\Sebastian Rosner\AppData\Roaming\setup_ldm.iss

[2011/02/26 09:50:45 | 000,004,824 | ---- | C] () -- E:\Users\Sebastian Rosner\AppData\Roaming\DF20.D6A

[2011/01/07 12:05:06 | 000,000,216 | ---- | C] () -- E:\Users\Sebastian Rosner\AppData\Roaming\wklnhst.dat

[2010/09/30 15:40:28 | 000,027,648 | ---- | C] () -- E:\Windows\SysWow64\AVSredirect.dll

[2010/06/15 04:51:10 | 000,120,200 | ---- | C] () -- E:\Windows\SysWow64\DLLDEV32i.dll

[2010/06/15 04:49:59 | 000,007,119 | ---- | C] () -- E:\Windows\mgxoschk.ini

[2010/05/23 09:09:43 | 000,000,132 | ---- | C] () -- E:\Program Files (x86)\loadbar4.dat

[2010/05/23 08:53:00 | 000,002,262 | ---- | C] () -- E:\Program Files (x86)\CaesarIV.ini

[2010/05/23 08:51:50 | 000,000,190 | ---- | C] () -- E:\Windows\ODBCINST.INI

[2010/01/11 11:18:48 | 000,000,056 | -H-- | C] () -- E:\Windows\SysWow64\ezsidmv.dat

[2009/12/25 14:14:35 | 000,089,044 | ---- | C] () -- E:\Windows\War3Unin.dat

[2009/10/20 14:19:30 | 000,053,299 | ---- | C] () -- E:\Windows\SysWow64\pthreadVC.dll

[2009/09/07 01:02:38 | 000,000,000 | ---- | C] () -- E:\Windows\VAIOUpdt.INI

[2009/09/07 00:36:51 | 000,002,835 | ---- | C] () -- E:\Windows\SysWow64\McOEMAppRules.dat

[2009/08/17 16:11:49 | 000,982,220 | ---- | C] () -- E:\Windows\SysWow64\igkrng500.bin

[2009/08/17 16:11:46 | 000,134,592 | ---- | C] () -- E:\Windows\SysWow64\igfcg500.bin

[2009/08/17 16:11:46 | 000,092,216 | ---- | C] () -- E:\Windows\SysWow64\igfcg500m.bin

[2009/08/17 16:11:44 | 000,439,300 | ---- | C] () -- E:\Windows\SysWow64\igcompkrng500.bin

[2009/08/17 08:27:21 | 000,000,000 | ---- | C] () -- E:\Windows\ativpsrm.bin

[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- E:\Windows\bootstat.dat

[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- E:\Windows\SysWow64\NOISE.DAT

[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- E:\Windows\SysWow64\dssec.dat

[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- E:\Windows\mib.bin

[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- E:\Windows\SysWow64\BWContextHandler.dll

[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- E:\Windows\SysWow64\ir32_32.dll

[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- E:\Windows\SysWow64\msjetoledb40.dll

[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- E:\Windows\SysWow64\mlang.dat

[2008/10/07 04:13:30 | 000,197,912 | ---- | C] () -- E:\Windows\SysWow64\physxcudart_20.dll

[2008/10/07 04:13:22 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelTraditionalChinese.dll

[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSwedish.dll

[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSpanish.dll

[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll

[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelPortugese.dll

[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelKorean.dll

[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelJapanese.dll

[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelGerman.dll

[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelFrench.dll

[2005/10/15 08:25:20 | 000,028,672 | ---- | C] () -- E:\Windows\SysWow64\myodbc3i.exe

[2005/10/15 08:25:20 | 000,011,776 | ---- | C] () -- E:\Windows\SysWow64\myodbc3m.exe

[1997/06/14 04:56:08 | 000,056,832 | ---- | C] () -- E:\Windows\SysWow64\iyvu9_32.dll

 
 ========== LOP Check ==========

 

[2009/12/23 12:28:15 | 000,000,000 | -HSD | M] -- E:\ProgramData\Anwendungsdaten

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Application Data

[2010/09/14 07:42:33 | 000,000,000 | ---D | M] -- E:\ProgramData\DAEMON Tools Lite

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Desktop

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Documents

[2009/12/23 12:28:15 | 000,000,000 | -HSD | M] -- E:\ProgramData\Dokumente

[2010/01/22 14:42:58 | 000,000,000 | ---D | M] -- E:\ProgramData\EPSON

[2009/12/23 12:28:15 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favoriten

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favorites

[2011/09/28 11:10:19 | 000,000,000 | ---D | M] -- E:\ProgramData\Hunter

[2011/08/03 17:59:28 | 000,000,000 | ---D | M] -- E:\ProgramData\MAGIX

[2009/09/07 00:54:37 | 000,000,000 | ---D | M] -- E:\ProgramData\MusicStation

[2010/01/24 08:59:30 | 000,000,000 | ---D | M] -- E:\ProgramData\Partner

[2011/06/13 20:47:01 | 000,000,000 | ---D | M] -- E:\ProgramData\PC Auto Shutdown

[2011/07/24 12:11:27 | 000,000,000 | ---D | M] -- E:\ProgramData\PMB Files

[2010/11/30 17:55:53 | 000,000,000 | ---D | M] -- E:\ProgramData\RapidSolution

[2011/12/14 19:20:15 | 000,000,000 | ---D | M] -- E:\ProgramData\Samsung

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Start Menu

[2009/12/23 12:28:15 | 000,000,000 | -HSD | M] -- E:\ProgramData\Startmenü

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Templates

[2012/01/16 15:21:37 | 000,000,000 | ---D | M] -- E:\ProgramData\TrackMania

[2009/09/07 00:56:09 | 000,000,000 | ---D | M] -- E:\ProgramData\Uninstall

[2009/12/23 12:28:15 | 000,000,000 | -HSD | M] -- E:\ProgramData\Vorlagen

[2010/06/05 16:17:29 | 000,000,000 | ---D | M] -- E:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}

[2012/03/06 05:20:59 | 000,032,640 | ---- | M] () -- E:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*. >

[2011/08/28 16:51:44 | 000,000,000 | -HSD | M] -- E:\$Recycle.Bin

[2009/09/07 01:07:08 | 000,000,000 | ---D | M] -- E:\Benutzerhandbuch

[2012/03/08 17:53:30 | 000,000,000 | -HSD | M] -- E:\Config.Msi

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\Documents and Settings

[2009/12/23 12:28:15 | 000,000,000 | -HSD | M] -- E:\Dokumente und Einstellungen

[2010/10/14 05:03:57 | 000,000,000 | ---D | M] -- E:\hochzeit

[2009/08/17 07:49:10 | 000,000,000 | ---D | M] -- E:\Intel

[2010/11/30 18:04:46 | 000,000,000 | ---D | M] -- E:\lang

[2009/09/07 00:48:19 | 000,000,000 | RH-D | M] -- E:\MSOCache

[2009/07/13 23:20:08 | 000,000,000 | ---D | M] -- E:\PerfLogs

[2011/12/30 09:23:53 | 000,000,000 | ---D | M] -- E:\Program Files

[2012/03/01 15:14:08 | 000,000,000 | ---D | M] -- E:\Program Files (x86)

[2012/03/06 05:40:34 | 000,000,000 | ---D | M] -- E:\ProgramData

[2009/12/23 12:28:15 | 000,000,000 | -HSD | M] -- E:\Programme

[2010/08/11 08:13:28 | 000,000,000 | -H-D | M] -- E:\SPLASH.000

[2009/09/07 00:35:34 | 000,000,000 | -H-D | M] -- E:\SPLASH.SYS

[2012/03/11 14:47:14 | 000,000,000 | -HSD | M] -- E:\System Volume Information

[2012/03/06 07:04:22 | 000,000,000 | R--D | M] -- E:\Users

[2012/03/01 15:14:14 | 000,000,000 | ---D | M] -- E:\Windows

[2009/09/07 01:07:08 | 000,000,000 | ---D | M] -- E:\_FS_SWRINFO

 
 < %PROGRAMFILES%\*.exe >

 

Invalid Environment Variable: %LOCALAPPDATA%\*.exe

 
 < %systemroot%\*. /mp /s >

 

 
 < MD5 for: AGP440.SYS  >

[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- E:\Windows\System32\drivers\AGP440.sys

[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- E:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- E:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- E:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- E:\Windows\System32\drivers\atapi.sys

[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- E:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- E:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- E:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- E:\Windows\SysWOW64\cngaudit.dll

[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- E:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- E:\Windows\System32\cngaudit.dll

[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- E:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: EXPLORER.EXE  >

[2011/02/26 02:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe

[2011/02/26 01:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe

[2009/07/13 21:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe

[2011/02/26 01:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe

[2009/10/31 01:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe

[2011/02/26 01:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe

[2011/02/25 02:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- E:\Windows\explorer.exe

[2011/02/25 02:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe

[2011/02/26 02:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe

[2010/11/20 08:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe

[2009/08/03 02:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe

[2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- E:\Windows\SysWOW64\explorer.exe

[2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe

[2009/10/31 02:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe

[2009/08/03 01:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe

[2010/11/20 09:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

[2009/10/31 02:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe

[2009/08/03 01:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe

[2009/07/13 21:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe

[2009/10/31 02:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe

[2011/02/26 02:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe

[2009/08/03 02:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe

 
 < MD5 for: IASTOR.SYS  >

[2009/06/04 12:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- E:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys

[2009/06/04 12:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- E:\Windows\System32\drivers\iaStor.sys

[2009/06/04 12:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- E:\Windows\System32\DriverStore\FileRepository\iaahci.inf_amd64_neutral_7fb62b08f6b7117a\iaStor.sys

[2009/06/04 12:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- E:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\IaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2010/11/20 09:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- E:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010/11/20 09:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011/03/11 02:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- E:\Windows\System32\drivers\iaStorV.sys

[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- E:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011/03/11 02:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011/03/11 02:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009/07/13 21:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009/07/13 21:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- E:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2010/11/20 09:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- E:\Windows\System32\netlogon.dll

[2010/11/20 09:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- E:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010/11/20 08:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- E:\Windows\SysWOW64\netlogon.dll

[2010/11/20 08:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- E:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2009/07/13 21:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- E:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009/07/13 21:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011/03/11 02:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011/03/11 02:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011/03/11 02:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- E:\Windows\System32\drivers\nvstor.sys

[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- E:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010/11/20 09:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- E:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010/11/20 09:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009/07/13 21:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- E:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009/07/13 21:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- E:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2010/11/20 08:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- E:\Windows\SysWOW64\scecli.dll

[2010/11/20 08:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- E:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010/11/20 09:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- E:\Windows\System32\scecli.dll

[2010/11/20 09:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- E:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010/11/20 08:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- E:\Windows\SysWOW64\user32.dll

[2010/11/20 08:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- E:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2009/07/13 21:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- E:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009/07/13 21:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- E:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2010/11/20 09:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- E:\Windows\System32\user32.dll

[2010/11/20 09:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- E:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010/11/20 08:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- E:\Windows\SysWOW64\userinit.exe

[2010/11/20 08:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- E:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009/07/13 21:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- E:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009/07/13 21:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- E:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2010/11/20 09:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- E:\Windows\System32\userinit.exe

[2010/11/20 09:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- E:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010/11/20 09:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- E:\Windows\System32\winlogon.exe

[2010/11/20 09:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- E:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2009/07/13 21:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- E:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2012/01/13 09:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- E:\Users\Sebastian Rosner\Desktop\Viren\MBAM\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009/10/28 03:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- E:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2009/10/28 02:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- E:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009/07/13 20:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- E:\Windows\System32\drivers\ws2ifsl.sys

[2009/07/13 20:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- E:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 

Invalid Environment Variable: %USERPROFILE%\*.*

 

Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe

 

Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll

 

Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe

< End of report >

auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

Code:

:OTL

O4 - HKU\Sebastian_Rosner_ON_E..\Run: [K3aRyluP6SiCkoR] E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe (All Alex,Inc)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O7 - HKU\Sebastian_Rosner_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1

O7 - HKU\Sebastian_Rosner_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKU\Sebastian_Rosner_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O20 - HKU\Sebastian_Rosner_ON_E Winlogon: Shell - (C:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe) - E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe

(All Alex,Inc)

O20 - HKU\Sebastian_Rosner_ON_E Winlogon: UserInit - (C:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe) - E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe

(All Alex,Inc)

:Files

E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe

:Commands

[purity]

[EMPTYFLASH] 

[emptytemp]

[Reboot]

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.

Öffne dein Systemlaufwerk ( meistens C: )
Suche nun
folgenden Ordner: _OTL und öffne diesen.
Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
Dies wird eine Movedfiles.zip Datei in _OTL erstellen
Lade diese bitte in unseren Uploadchannel
hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)
bei dir evtl. e:

moin.
habe ein problem und zwar an folgender stelle:
ich klicke auf das OTLPE icon,wähle den windows Ordner aus, klicke yes bei der frage, ob ich die remote user profiles for Scanning laden möchte, wähle systemprofile aus und mache den haken bei automatically load all reamining users weg.
dann öffnet sich otlpe. ich klicke auf run fix, wähle die fix.txt Datei aus und der Inhalt erscheint im Custom Scan/Fix-Fenster.

bis hierhin alles richtig, oder?

Wenn ich jetzt jedoch auf Run Fix klicke, passiert nichts. Also der startet nicht. (der Button wird sozusagen nicht heruntergedrückt)

Was mach ich nun?

EDIT: habs doch irgendwie hingekriegt. der pc startet gerade neu. ich werde dann weiter nach deiner Anleitung verfahren.
was ich allerdings noch nicht ganz verstehe.
was meinst du hiermit:Hinweis:

Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!

das versteh ich gerade noch gar nicht...

Edit2: und wenn ich windows normal starte, wird mir keine otl.txt-datei angezeigt. soll ich einfach OTL durchlaufen lassen und die txt-datei hier posten?

per hand eintragen, steht ja eig auch in der anleitung, dass du das bei problemen versuchen sollst

okay. also ich bin jetzt bei folgendem Punkt:
der laptop hat neu gestartet und vorher die cd ausgeworfen.
dann habe ich die desktop Symbole eingeblendet. allerdings erschein dann keine otl.txt-datei. also habe ich OTL manuell gestartet und nen scan gemacht, mit folgendem Resultat:

Code:

OTL logfile created on: 20.03.2012 19:59:10 - Run 2

OTL by OldTimer - Version 3.2.35.1     Folder = C:\Users\Sebastian Rosner\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,97 Gb Total Physical Memory | 2,65 Gb Available Physical Memory | 66,85% Memory free

7,93 Gb Paging File | 6,39 Gb Available in Paging File | 80,53% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 260,80 Gb Total Space | 91,87 Gb Free Space | 35,23% Space Free | Partition Type: NTFS

Drive S: | 195,31 Gb Total Space | 66,95 Gb Free Space | 34,28% Space Free | Partition Type: NTFS

 

Computer Name: SEBASTIANROSNER | User Name: Sebastian Rosner | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.03.06 12:51:54 | 000,584,704 | ---- | M] (OldTimer Tools) -- C:\Users\Sebastian Rosner\Desktop\OTL.exe

PRC - [2012.02.28 17:38:56 | 001,987,976 | ---- | M] (LogMeIn Inc.) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe

PRC - [2011.07.21 11:08:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.04.21 06:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

PRC - [2011.04.21 06:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.03.28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

PRC - [2010.06.07 11:35:35 | 000,618,496 | ---- | M] () -- C:\Windows\Samsung\PanelMgr\SSMMgr.exe

PRC - [2010.04.19 13:20:40 | 000,441,624 | ---- | M] (GoldSolution Software, Inc.) -- S:\Teamspeak\PC Auto Shutdown\ShutdownService.exe

PRC - [2010.04.01 10:16:20 | 000,357,696 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe

PRC - [2010.02.02 00:15:48 | 007,418,368 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin

PRC - [2010.02.02 00:15:46 | 007,424,000 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe

PRC - [2009.09.07 05:55:25 | 000,026,624 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe

PRC - [2009.07.23 09:39:38 | 000,313,264 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

PRC - [2009.07.23 09:39:36 | 000,206,336 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

PRC - [2009.07.22 14:03:04 | 000,642,920 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe

PRC - [2009.07.01 10:49:34 | 000,204,648 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe

PRC - [2009.07.01 10:49:34 | 000,112,488 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe

PRC - [2009.06.04 18:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

PRC - [2009.06.04 18:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

PRC - [2009.05.26 08:23:14 | 000,317,288 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe

PRC - [2008.09.18 09:59:10 | 000,104,960 | ---- | M] (ArcSoft, Inc.) -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe

PRC - [2007.01.04 18:48:50 | 000,112,152 | ---- | M] (InterVideo) -- C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.02.16 14:29:52 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\075d9c27aa02085fef8983b5f5f85834\System.ServiceProcess.ni.dll

MOD - [2012.02.16 14:29:06 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6c51e152e7404188914c9fa4d8503ff9\System.Windows.Forms.ni.dll

MOD - [2012.02.16 14:28:58 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ab87129c2b603f218e4aa5300c9b1bdd\System.Drawing.ni.dll

MOD - [2012.02.16 14:28:35 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\9866d1f6178e1cde25642f1ac293ff8d\System.Xml.ni.dll

MOD - [2012.02.16 14:28:31 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e620323cacb5b6bfd93fd28d263440e4\System.Configuration.ni.dll

MOD - [2012.02.16 14:28:28 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll

MOD - [2011.11.01 23:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2011.11.01 23:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

MOD - [2011.10.13 10:19:23 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll

MOD - [2010.11.13 00:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll

MOD - [2010.06.07 11:35:35 | 000,618,496 | ---- | M] () -- C:\Windows\Samsung\PanelMgr\SSMMgr.exe

MOD - [2010.03.01 15:20:42 | 000,970,752 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2010.09.22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)

SRV:64bit: - [2009.08.12 22:11:54 | 000,522,240 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Smart Network\VSNService.exe -- (VSNService)

SRV:64bit: - [2009.07.27 21:27:07 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2009.07.24 05:34:31 | 000,189,984 | ---- | M] (Realtek Semiconductor) [Auto | Running] -- C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe -- (RtkAudioService)

SRV:64bit: - [2009.07.16 08:36:56 | 000,411,496 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Power Management\SPMService.exe -- (VAIO Power Management)

SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV:64bit: - [2009.07.01 17:54:02 | 000,864,032 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)

SRV:64bit: - [2009.06.26 13:56:10 | 000,357,672 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe -- (VcmINSMgr)

SRV:64bit: - [2009.06.26 13:35:04 | 000,468,264 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe -- (VcmIAlzMgr)

SRV:64bit: - [2009.06.17 17:50:30 | 000,110,888 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe -- (VcmXmlIfHelper)

SRV - [2012.02.28 17:38:54 | 002,343,816 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)

SRV - [2011.11.30 23:23:10 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2011.07.21 11:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.04.21 06:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.04.01 11:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)

SRV - [2011.03.28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)

SRV - [2010.04.19 13:20:40 | 000,441,624 | ---- | M] (GoldSolution Software, Inc.) [Auto | Running] -- S:\Teamspeak\PC Auto Shutdown\ShutdownService.exe -- (PCAutoShutdown_Service)

SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010.03.18 10:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)

SRV - [2009.10.20 19:19:48 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)

SRV - [2009.07.27 15:58:40 | 000,091,432 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe -- (SOHPlMgr)

SRV - [2009.07.27 15:58:38 | 000,427,304 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe -- (SOHDms)

SRV - [2009.07.27 15:58:38 | 000,075,048 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe -- (SOHDs)

SRV - [2009.07.27 15:58:38 | 000,070,952 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe -- (SOHDBSvr)

SRV - [2009.07.27 15:58:36 | 000,120,104 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe -- (SOHCImp)

SRV - [2009.07.23 09:39:38 | 000,313,264 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe -- (Vcsw)

SRV - [2009.07.23 09:39:38 | 000,069,632 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe -- (VAIO Entertainment TV Device Arbitration Service)

SRV - [2009.07.23 09:39:36 | 000,206,336 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe -- (VzCdbSvc)

SRV - [2009.07.22 14:03:04 | 000,642,920 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe -- (VCFw)

SRV - [2009.07.01 10:49:34 | 000,204,648 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service)

SRV - [2009.06.26 10:25:36 | 000,362,992 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe -- (Roxio Upnp Server 10)

SRV - [2009.06.26 10:25:24 | 000,313,840 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe -- (Roxio UPnP Renderer 10)

SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009.06.04 18:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)

SRV - [2008.09.18 09:59:10 | 000,104,960 | ---- | M] (ArcSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe -- (uCamMonitor)

SRV - [2008.08.07 11:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)

SRV - [2007.01.11 04:02:00 | 000,126,464 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE -- (EPSON_PM_RPCV4_01) EPSON V3 Service4(01)

SRV - [2007.01.04 18:48:50 | 000,112,152 | ---- | M] (InterVideo) [Auto | Running] -- C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2011.08.02 17:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)

DRV:64bit: - [2011.07.21 11:11:10 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2011.07.21 11:11:09 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2011.05.13 15:37:54 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)

DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.20 10:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)

DRV:64bit: - [2010.09.14 13:03:11 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)

DRV:64bit: - [2010.09.14 13:03:11 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)

DRV:64bit: - [2010.09.14 12:43:22 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)

DRV:64bit: - [2010.04.19 19:29:18 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl)

DRV:64bit: - [2010.02.03 14:56:56 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)

DRV:64bit: - [2009.10.20 19:19:54 | 000,047,632 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF)

DRV:64bit: - [2009.08.05 02:22:40 | 000,139,264 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)

DRV:64bit: - [2009.08.05 02:20:51 | 007,345,632 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2009.08.03 21:06:34 | 000,250,928 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)

DRV:64bit: - [2009.07.31 21:29:11 | 001,484,800 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)

DRV:64bit: - [2009.07.31 21:14:14 | 000,076,288 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdsn64.sys -- (risdptsk)

DRV:64bit: - [2009.07.31 21:13:51 | 000,086,528 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimssn64.sys -- (rimsptsk)

DRV:64bit: - [2009.07.31 21:02:03 | 000,393,216 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)

DRV:64bit: - [2009.07.30 21:41:17 | 000,021,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)

DRV:64bit: - [2009.07.30 21:41:16 | 000,132,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)

DRV:64bit: - [2009.07.30 21:41:16 | 000,098,344 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)

DRV:64bit: - [2009.07.30 21:40:45 | 000,035,104 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)

DRV:64bit: - [2009.07.27 21:27:10 | 006,037,504 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)

DRV:64bit: - [2009.07.24 06:24:03 | 000,201,472 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtHDMIVX.sys -- (RTHDMIAzAudService)

DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 02:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.11 21:19:09 | 000,011,392 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SFEP.sys -- (SFEP)

DRV:64bit: - [2009.06.10 22:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)

DRV:64bit: - [2009.06.10 22:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)

DRV:64bit: - [2009.06.10 22:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)

DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.06.05 21:04:10 | 005,435,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5v64.sys -- (netw5v64) Intel(R)

DRV:64bit: - [2009.06.04 17:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2009.05.26 13:32:04 | 000,019,968 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys -- (ArcSoftKsUFilter)

DRV:64bit: - [2009.05.20 11:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)

DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)

DRV:64bit: - [2007.04.16 19:51:50 | 000,014,112 | R--- | M] (InterVideo) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\regi.sys -- (regi)

DRV:64bit: - [2007.04.11 15:35:30 | 000,056,080 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)

DRV:64bit: - [2007.04.11 15:35:22 | 000,053,520 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)

DRV - [2009.07.29 01:55:42 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\SSPORT.SYS -- (SSPORT)

DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E7 80 DE E2 36 FC CB 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1

FF - prefs.js..extensions.enabledItems: mail@gutscheinrausch.de:2.6

FF - prefs.js..extensions.enabledItems: {184AA5E6-741D-464a-820E-94B3ABC2F3B4}:1.0

FF - prefs.js..extensions.enabledItems: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}:7.3.0.0

FF - prefs.js..network.proxy.http: "127.0.0.1"

FF - prefs.js..network.proxy.http_port: 60323

FF - prefs.js..network.proxy.no_proxies_on: "*.local"

FF - prefs.js..network.proxy.type: 4

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: S:\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)

FF - HKLM\Software\MozillaPlugins\@gamersfirst.com/LiveLauncher: C:\Program Files (x86)\GamersFirst\LIVE!\nplivelauncher.dll File not found

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: S:\Program Files (x86)\Picasa 3\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.10\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.03.11 19:37:59 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.10\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.12.14 12:05:02 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\Sebastian Rosner\AppData\Roaming\5048 [2011.11.23 13:13:37 | 000,000,000 | ---D | M]

 

[2009.12.28 21:20:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sebastian Rosner\AppData\Roaming\mozilla\Extensions

[2012.03.13 20:13:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sebastian Rosner\AppData\Roaming\mozilla\Firefox\Profiles\2unxji1j.default\extensions

[2012.01.23 01:21:47 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\Sebastian Rosner\AppData\Roaming\mozilla\Firefox\Profiles\2unxji1j.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}

[2010.11.30 23:12:52 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Sebastian Rosner\AppData\Roaming\mozilla\Firefox\Profiles\2unxji1j.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2011.06.28 22:36:47 | 000,000,000 | ---D | M] (Gutscheinrausch.de) -- C:\Users\Sebastian Rosner\AppData\Roaming\mozilla\Firefox\Profiles\2unxji1j.default\extensions\yem5g0fm.ki0

[2010.05.31 17:17:25 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2011.11.23 13:13:37 | 000,000,000 | ---D | M] (Java String Helper) -- C:\USERS\SEBASTIAN ROSNER\APPDATA\ROAMING\5048

[2009.12.02 09:31:53 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2009.12.02 09:31:53 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2009.12.02 09:31:53 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2009.12.02 09:31:53 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2009.12.02 09:31:53 | 000,000,801 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

 

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2 - BHO: (no name) - {09628AAA-66AD-4FA2-82E2-698185B66463} - No CLSID value found.

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O4:64bit: - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)

O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)

O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)

O4 - HKLM..\Run: [MarketingTools] C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe (Sony Corporation)

O4 - HKLM..\Run: [PC Auto Shutdown] S:\Teamspeak\PC Auto Shutdown\AutoShutdown.exe (GoldSolution Software, Inc.)

O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\ssmmgr.exe ()

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [TrayServer] S:\chaostag\Trayserver.exe (MAGIX AG)

O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O4 - HKCU..\Run: [EPSON Stylus DX4400 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATICAE.EXE /FU "C:\Windows\TEMP\E_S7092.tmp" /EF "HKCU" File not found

O4 - HKCU..\Run: [ICQ] "C:\Program Files (x86)\ICQ6.5\ICQ.exe" silent File not found

O4 - HKCU..\Run: [K3aRyluP6SiCkoR] C:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe File not found

O4 - Startup: C:\Users\Sebastian Rosner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0

O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)

O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)

O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)

O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4B9B565C-06D3-446B-9A57-80B91D0C36EB}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{59F4ACDD-B2C9-4F4E-969D-FD30745D2CD0}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8342F6D1-A61B-4ABD-8936-1F3EBEBF7D0F}: DhcpNameServer = 193.189.244.225 193.189.244.206

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKCU Winlogon: Shell - (c:\users\sebastian rosner\appdata\roaming\flint4ytw.exe) -  File not found

O20 - HKCU Winlogon: UserInit - (c:\windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\SysWow64\VESWinlogon.dll (Sony Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{83b6dc45-bff5-11df-8ebd-0024be84fabd}\Shell - "" = AutoRun

O33 - MountPoints2\{83b6dc45-bff5-11df-8ebd-0024be84fabd}\Shell\AutoRun\command - "" = I:\Autorun.exe

O33 - MountPoints2\{9d1260d9-bf34-11df-bddd-0024be84fabd}\Shell - "" = AutoRun

O33 - MountPoints2\{9d1260d9-bf34-11df-bddd-0024be84fabd}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a

O33 - MountPoints2\{fff2edee-efd6-11de-94f5-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{fff2edee-efd6-11de-94f5-806e6f6e6963}\Shell\AutoRun\command - "" = F:\AUTOSTARTER.EXE

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.03.20 18:30:07 | 002,237,440 | R--- | C] (OldTimer Tools) -- C:\OTLPE.exe

[2012.03.20 18:29:37 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.03.20 16:10:51 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2012.03.13 18:57:10 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{D93FF6C6-6F29-4831-BD9A-F17A0FBF1675}

[2012.03.13 18:56:37 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{F28A3E22-78BC-409D-9CFC-335A3B438473}

[2012.03.12 18:22:44 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{55A03D60-06C4-44A5-8367-0083CD5EA881}

[2012.03.12 18:22:11 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{F191252B-6C7F-43EC-A97E-E2AC176BE4EA}

[2012.03.08 18:43:55 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{E7DEF6AF-882F-4AC4-AD03-AD44DB8A479E}

[2012.03.08 18:43:22 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{DA94EA3F-AED4-44AA-83F0-3CC53BCE4DDA}

[2012.03.07 22:52:15 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{B67D7E93-20BB-4243-83F6-F36D65068203}

[2012.03.07 22:51:42 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{9B979ED0-E1EF-45AE-BAA5-319F7329E720}

[2012.03.07 10:51:28 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{C6639BAC-5CCE-451F-B9D0-B8B5A0C8E1A1}

[2012.03.07 10:50:54 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{4C034C90-A2B2-40E3-9743-EF83195CA2A6}

[2012.03.06 12:51:52 | 000,584,704 | ---- | C] (OldTimer Tools) -- C:\Users\Sebastian Rosner\Desktop\OTL.exe

[2012.03.06 12:19:39 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{9DB697E4-666C-4A6E-AB16-AF0F03BD38FB}

[2012.03.06 12:19:26 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{0B6C1ADD-2AE7-4299-A6C8-87FB689860A0}

[2012.03.06 10:40:45 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Roaming\Malwarebytes

[2012.03.06 10:40:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.03.06 10:40:34 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.03.06 10:40:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.03.06 10:39:54 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\Desktop\Viren

[2012.03.05 15:02:52 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{C87D57AD-62C3-4F4D-99D9-9B38AEA61C3D}

[2012.03.05 15:02:20 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{FD492D71-14E2-4AC4-A165-CBAF84233B87}

[2012.03.04 11:28:32 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{29E72FC0-57B2-4AC7-845A-9B5C3AEAF8E2}

[2012.03.04 11:28:02 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{C0034C6B-713A-4039-B313-CADEDFBA083B}

[2012.03.03 14:06:04 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{71DE17F7-BEDD-4F00-8039-7BB039CCE67F}

[2012.03.03 14:05:35 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{5E748FBA-7EB2-4B60-B7BC-EF8FDE7B5F86}

[2012.03.02 15:31:50 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Roaming\EPSON

[2012.03.02 11:14:38 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{9072EE92-AB14-4941-9390-521C2A7E93BD}

[2012.03.02 11:14:08 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{3C1E01C8-2AA5-466E-9DF1-A5DF5F2A94E2}

[2012.03.01 20:36:04 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\Risen

[2012.03.01 20:14:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

[2012.03.01 20:14:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AGEIA Technologies

[2012.03.01 20:14:08 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\AGEIA

[2012.03.01 20:13:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard

[2012.03.01 20:13:23 | 000,518,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_3.dll

[2012.03.01 20:13:23 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_3.dll

[2012.03.01 20:13:23 | 000,074,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_2.dll

[2012.03.01 20:13:23 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_2.dll

[2012.03.01 20:13:22 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_3.dll

[2012.03.01 20:13:22 | 000,175,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_3.dll

[2012.03.01 20:13:22 | 000,025,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_5.dll

[2012.03.01 20:13:22 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_5.dll

[2012.03.01 20:13:20 | 001,942,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_39.dll

[2012.03.01 20:13:20 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_39.dll

[2012.03.01 20:13:19 | 004,992,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_39.dll

[2012.03.01 20:13:18 | 000,511,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_1.dll

[2012.03.01 20:13:18 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_1.dll

[2012.03.01 20:13:18 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_1.dll

[2012.03.01 20:13:18 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_1.dll

[2012.03.01 20:13:18 | 000,068,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_0.dll

[2012.03.01 20:13:18 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_0.dll

[2012.03.01 20:13:18 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_4.dll

[2012.03.01 20:13:18 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_4.dll

[2012.03.01 20:13:17 | 001,941,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_38.dll

[2012.03.01 20:13:17 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_38.dll

[2012.03.01 20:13:17 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_38.dll

[2012.03.01 20:13:17 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_38.dll

[2012.03.01 20:13:15 | 004,991,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_38.dll

[2012.03.01 20:13:15 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_38.dll

[2012.03.01 20:13:15 | 000,489,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_0.dll

[2012.03.01 20:13:15 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_0.dll

[2012.03.01 20:13:15 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_0.dll

[2012.03.01 20:13:15 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_0.dll

[2012.03.01 20:13:14 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_3.dll

[2012.03.01 20:13:14 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_3.dll

[2012.03.01 20:13:13 | 001,860,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_37.dll

[2012.03.01 20:13:13 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_37.dll

[2012.03.01 20:13:13 | 000,529,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_37.dll

[2012.03.01 20:13:13 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_37.dll

[2012.03.01 20:13:12 | 004,910,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_37.dll

[2012.03.01 20:13:12 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_37.dll

[2012.03.01 20:13:12 | 000,411,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_10.dll

[2012.03.01 20:13:12 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_10.dll

[2012.03.01 20:13:10 | 002,006,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_36.dll

[2012.03.01 20:13:10 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_36.dll

[2012.03.01 20:13:10 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_36.dll

[2012.03.01 20:13:10 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_36.dll

[2012.03.01 20:13:09 | 005,081,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_36.dll

[2012.03.01 20:13:09 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_36.dll

[2012.03.01 20:13:08 | 000,411,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_9.dll

[2012.03.01 20:13:08 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_9.dll

[2012.03.01 20:13:07 | 001,985,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_35.dll

[2012.03.01 20:13:07 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_35.dll

[2012.03.01 20:13:07 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_35.dll

[2012.03.01 20:13:07 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_35.dll

[2012.03.01 20:13:05 | 005,073,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_35.dll

[2012.03.01 20:13:05 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_35.dll

[2012.03.01 20:13:05 | 000,409,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_8.dll

[2012.03.01 20:13:05 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_8.dll

[2012.03.01 20:13:05 | 000,021,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_2.dll

[2012.03.01 20:13:05 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_2.dll

[2012.03.01 20:13:04 | 001,401,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_34.dll

[2012.03.01 20:13:04 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_34.dll

[2012.03.01 20:13:04 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_34.dll

[2012.03.01 20:13:04 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_34.dll

[2012.03.01 20:13:03 | 004,496,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_34.dll

[2012.03.01 20:13:03 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_34.dll

[2012.03.01 20:13:02 | 000,403,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_7.dll

[2012.03.01 20:13:02 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_7.dll

[2012.03.01 20:13:02 | 000,107,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_3.dll

[2012.03.01 20:13:02 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_3.dll

[2012.03.01 20:13:01 | 001,400,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_33.dll

[2012.03.01 20:13:01 | 001,123,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_33.dll

[2012.03.01 20:13:01 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_33.dll

[2012.03.01 20:13:01 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_33.dll

[2012.03.01 20:13:00 | 004,494,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_33.dll

[2012.03.01 20:13:00 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_33.dll

[2012.03.01 20:12:59 | 000,393,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_6.dll

[2012.03.01 20:12:59 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_6.dll

[2012.03.01 20:12:58 | 000,469,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10.dll

[2012.03.01 20:12:58 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10.dll

[2012.03.01 20:12:58 | 000,390,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_5.dll

[2012.03.01 20:12:58 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_5.dll

[2012.03.01 20:12:56 | 000,364,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_4.dll

[2012.03.01 20:12:56 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_4.dll

[2012.03.01 20:12:56 | 000,017,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_1.dll

[2012.03.01 20:12:56 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_1.dll

[2012.03.01 20:12:55 | 003,977,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_31.dll

[2012.03.01 20:12:55 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_31.dll

[2012.03.01 20:12:54 | 000,363,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_3.dll

[2012.03.01 20:12:54 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_3.dll

[2012.03.01 20:12:54 | 000,083,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_2.dll

[2012.03.01 20:12:54 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_2.dll

[2012.03.01 20:12:53 | 000,354,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_2.dll

[2012.03.01 20:12:53 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_2.dll

[2012.03.01 20:12:53 | 000,083,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_1.dll

[2012.03.01 20:12:53 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_1.dll

[2012.03.01 20:12:52 | 000,352,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_1.dll

[2012.03.01 20:12:52 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_1.dll

[2012.03.01 20:12:47 | 003,927,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_30.dll

[2012.03.01 20:12:47 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_30.dll

[2012.03.01 20:12:46 | 000,355,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_0.dll

[2012.03.01 20:12:46 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_0.dll

[2012.03.01 20:12:46 | 000,016,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_0.dll

[2012.03.01 20:12:46 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_0.dll

[2012.03.01 20:12:44 | 003,830,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_29.dll

[2012.03.01 20:12:44 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_29.dll

[2012.03.01 20:12:43 | 003,815,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_28.dll

[2012.03.01 20:12:43 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_28.dll

[2012.03.01 20:12:42 | 003,807,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_27.dll

[2012.03.01 20:12:42 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_27.dll

[2012.03.01 20:12:40 | 003,767,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_26.dll

[2012.03.01 20:12:40 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_26.dll

[2012.03.01 20:12:39 | 003,823,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_25.dll

[2012.03.01 20:12:39 | 002,337,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_25.dll

[2012.03.01 20:12:37 | 003,544,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_24.dll

[2012.03.01 20:12:37 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_24.dll

[2012.03.01 19:55:15 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{501BDB27-3108-44F5-A018-0F7EB9D07AFA}

[2012.03.01 19:54:45 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{4112FD1D-DD25-4F6C-B872-E9F804C290D7}

[2012.03.01 08:20:21 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\Desktop\Fotos Mama

[2012.03.01 08:15:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi

[2012.03.01 08:15:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi

[2012.03.01 00:44:01 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\Desktop\StonerockAlbumFotos

[2012.02.29 12:36:10 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{EF930F8C-8841-45FA-9BC7-B7C53A06B54A}

[2012.02.29 12:35:39 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{94006AB0-8C7E-487E-96EA-FE9FB471B2E7}

[2012.02.29 00:35:18 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{7814422E-90E3-4628-8C0A-D4CD50789E61}

[2012.02.29 00:34:49 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{52DDC274-298A-4351-B08E-8CA55F3644A2}

[2012.02.28 12:34:26 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{20EE24DA-8E03-4431-936D-5524FBA3F2A6}

[2012.02.28 12:33:56 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{16D07746-A325-4C5E-B73E-DA22B08D3AFD}

[2012.02.27 23:48:38 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{68F031A6-BBDC-4E74-B9A8-0029A2479D04}

[2012.02.27 23:48:08 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{137E188E-2B09-489F-998F-874AF7D7D596}

[2012.02.27 11:47:45 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{37FAD16E-1BE4-4BFD-BD99-1C3AC351005A}

[2012.02.27 11:47:15 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{A35111E5-D02A-46BD-A68B-1D9F829F1FFD}

[2012.02.26 21:35:34 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{15FBAA72-264E-453D-9E28-19AAB587795B}

[2012.02.26 21:35:05 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{1E3C63CE-49A1-4DF8-AFD1-F3E7E3229EAA}

[2012.02.26 20:59:41 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{F8C6E89C-4CAA-45AE-91F6-0410F4C6825A}

[2012.02.25 13:21:06 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{9DF0A60C-5C3F-43A6-8BD0-393B9CA8A5E8}

[2012.02.25 13:20:35 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{F5208DFE-9CCB-4B2D-99A6-CC4CA687831A}

[2012.02.24 12:25:47 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{76952553-17AC-4C55-BD93-E4BED1CD79C9}

[2012.02.24 12:25:17 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{9C990647-40B6-4138-9DB2-46DF625E6F0E}

[2012.02.23 13:51:09 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{21EAA541-6AAD-406D-A731-9BD94E910EC2}

[2012.02.23 13:50:51 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{83573AFC-90C7-463D-96BC-EE3584EAF2BB}

[2012.02.22 13:02:57 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{43C93030-F838-48B8-96E5-251BACA11A63}

[2012.02.22 13:02:27 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{7A759E95-74F1-47B2-9EBA-8974F0168EA1}

[2012.02.21 14:30:41 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{50584D68-E714-49E5-BF54-D9C5A02863D1}

[2012.02.21 14:30:23 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{02F2F4D5-81AA-47B6-8D5D-8E6331F43870}

[2012.02.20 11:41:56 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{22950753-6FB9-42C3-8438-F68C39D54E2C}

[2012.02.20 11:41:26 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{0957B350-4EA7-42E6-B655-89F1ED3B1714}

[2012.02.19 23:41:04 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{526A1907-2808-4B81-992F-2ECB30888DBC}

[2012.02.19 23:40:35 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{5631D1CD-C674-4FE1-8543-64A81BAC727E}

[1 C:\Users\Sebastian Rosner\AppData\Roaming\*.tmp files -> C:\Users\Sebastian Rosner\AppData\Roaming\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.03.20 20:05:21 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.03.20 20:05:21 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.03.20 19:56:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.03.20 19:55:56 | 3195,293,696 | -HS- | M] () -- C:\hiberfil.sys

[2012.03.13 18:50:17 | 000,038,910 | ---- | M] () -- C:\Users\Sebastian Rosner\Desktop\MM2.pdf

[2012.03.06 12:51:54 | 000,584,704 | ---- | M] (OldTimer Tools) -- C:\Users\Sebastian Rosner\Desktop\OTL.exe

[2012.03.06 10:40:35 | 000,001,005 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.04 19:15:17 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.03.04 19:15:17 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.03.04 19:15:17 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.03.04 19:15:17 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.03.04 19:15:17 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.03.01 16:15:34 | 000,387,586 | ---- | M] () -- C:\Users\Sebastian Rosner\Desktop\IMG_0953.JPG

[2012.03.01 08:15:13 | 000,000,886 | ---- | M] () -- C:\Users\Public\Desktop\LogMeIn Hamachi.lnk

[2012.02.28 13:40:02 | 000,009,346 | ---- | M] () -- C:\Users\Sebastian Rosner\Desktop\Plakat_StoneRock_quer.png

[2012.02.24 12:25:30 | 000,347,846 | ---- | M] () -- C:\Users\Sebastian Rosner\Desktop\Bandcontest2.jpg

[1 C:\Users\Sebastian Rosner\AppData\Roaming\*.tmp files -> C:\Users\Sebastian Rosner\AppData\Roaming\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.03.13 18:50:16 | 000,038,910 | ---- | C] () -- C:\Users\Sebastian Rosner\Desktop\MM2.pdf

[2012.03.06 10:40:35 | 000,001,005 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.02 13:49:37 | 000,387,586 | ---- | C] () -- C:\Users\Sebastian Rosner\Desktop\IMG_0953.JPG

[2012.02.28 13:40:01 | 000,009,346 | ---- | C] () -- C:\Users\Sebastian Rosner\Desktop\Plakat_StoneRock_quer.png

[2012.02.24 12:25:30 | 000,347,846 | ---- | C] () -- C:\Users\Sebastian Rosner\Desktop\Bandcontest2.jpg

[2011.12.21 15:57:55 | 000,004,608 | ---- | C] () -- C:\Users\Sebastian Rosner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.11.23 13:13:28 | 000,000,034 | ---- | C] () -- C:\Users\Sebastian Rosner\AppData\Roaming\blckdom.res

[2011.11.07 23:48:57 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat

[2011.09.13 14:04:44 | 000,482,408 | ---- | C] () -- C:\Windows\ssndii.exe

[2011.03.12 22:07:03 | 000,019,414 | ---- | C] () -- C:\Users\Sebastian Rosner\AppData\Roaming\UserTile.png

[2011.03.11 09:35:39 | 000,000,047 | ---- | C] () -- C:\Windows\NeroDigital.ini

[2011.03.05 15:45:12 | 000,000,760 | ---- | C] () -- C:\Users\Sebastian Rosner\AppData\Roaming\setup_ldm.iss

[2011.02.26 14:50:45 | 000,004,824 | ---- | C] () -- C:\Users\Sebastian Rosner\AppData\Roaming\DF20.D6A

[2011.01.07 17:05:06 | 000,000,216 | ---- | C] () -- C:\Users\Sebastian Rosner\AppData\Roaming\wklnhst.dat

[2010.09.30 20:40:28 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll

[2010.06.15 09:51:10 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll

[2010.06.15 09:49:59 | 000,007,119 | ---- | C] () -- C:\Windows\mgxoschk.ini

[2010.05.23 14:09:43 | 000,000,132 | ---- | C] () -- C:\Program Files (x86)\loadbar4.dat

[2010.05.23 13:53:00 | 000,002,262 | ---- | C] () -- C:\Program Files (x86)\CaesarIV.ini

[2010.05.23 13:51:50 | 000,000,190 | ---- | C] () -- C:\Windows\ODBCINST.INI
 

< End of report >

jetzt versuch ich mich mal an den zweiten teil deiner Anleitung zu machen. ich Hoffe, das klappt.
könntest du mir aber vielleicht sagen, was der upload bringen soll/wird?

an dieser stelle, aber bereits einen großen dank an deine Hilfsbereitschaft und Geduld

was ist mit dem upload.
welchen punkt verstehst du da nicht, ist ja eig nicht so schwer, moved files packen und im upload channel hochladen.

okay. hab die zip-datei nun hochgeladen.

und jetzt?

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
Tool

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Hinweis:
Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

hier die C:\ComboFix.txt-Datei:

An dieser Stelle vorweg noch einmal ein Dankeschön. Und noch eine kurze Frage: An welchem Punkt der Trojanerentfernung befinden wir uns gerade? Ich versteh von dem ganzen hier gerade nichts mehr und weiß nicht so recht, ob der schon weg ist und das nun noch Sicherheitsmaßnahmen sind oder was auch immer. Vielleicht könntest du dazu ja noch kurz was sagen. Danke. Hier nun die Datei.

Code:

ComboFix 12-03-20.02 - Sebastian Rosner 21.03.2012  10:52:50.1.2 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4063.2701 [GMT 1:00]

ausgeführt von:: c:\users\Sebastian Rosner\Desktop\ComboFix.exe

AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files (x86)\OfferBox

c:\program files (x86)\OfferBox\help.url

c:\program files (x86)\OfferBox\home.url

c:\program files (x86)\OfferBox\res\about_bk.bmp

c:\program files (x86)\OfferBox\res\Language.xml

c:\program files (x86)\OfferBox\res\loader.gif

c:\program files (x86)\OfferBox\search.url

c:\users\Sebastian Rosner\AppData\Roaming\AcroIEHelpe.txt

c:\users\Sebastian Rosner\AppData\Roaming\OfferBox

c:\users\Sebastian Rosner\AppData\Roaming\OfferBox\config.dat

c:\users\Sebastian Rosner\AppData\Roaming\OfferBox\config.xml

c:\users\Sebastian Rosner\AppData\Roaming\OfferBox\offerboxffx@offerbox.com\chrome\OfferBoxffx.jar

c:\users\Sebastian Rosner\AppData\Roaming\OfferBox\offerboxffx@offerbox.com\components\DataXPCOM_TypeLib.xpt

c:\users\Sebastian Rosner\AppData\Roaming\OfferBox\offerboxffx@offerbox.com\install.rdf

c:\users\Sebastian Rosner\AppData\Roaming\srvblck2.tmp

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-02-21 bis 2012-03-21  ))))))))))))))))))))))))))))))

.

.

2012-03-21 10:07 . 2012-03-21 10:07        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-03-21 10:07 . 2012-03-21 10:07        --------        d-----w-        c:\users\Walter\AppData\Local\temp

2012-03-21 10:00 . 2012-03-21 10:00        69000        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{5486ED5A-6DEB-4136-AC81-041D8BB45EF5}\offreg.dll

2012-03-21 00:20 . 2011-11-19 15:20        5559152        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-03-21 00:20 . 2011-11-19 14:50        3968368        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2012-03-21 00:20 . 2011-11-19 14:50        3913584        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2012-03-21 00:04 . 2012-02-03 04:34        3145728        ----a-w-        c:\windows\system32\win32k.sys

2012-03-21 00:04 . 2012-02-10 06:36        1544192        ----a-w-        c:\windows\system32\DWrite.dll

2012-03-21 00:04 . 2012-02-10 05:38        1077248        ----a-w-        c:\windows\SysWow64\DWrite.dll

2012-03-21 00:03 . 2012-02-08 07:13        8643640        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{5486ED5A-6DEB-4136-AC81-041D8BB45EF5}\mpengine.dll

2012-03-21 00:03 . 2012-01-25 06:38        77312        ----a-w-        c:\windows\system32\rdpwsx.dll

2012-03-21 00:03 . 2012-01-25 06:38        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll

2012-03-21 00:03 . 2012-01-25 06:33        9216        ----a-w-        c:\windows\system32\rdrmemptylst.exe

2012-03-21 00:03 . 2012-02-17 06:38        1031680        ----a-w-        c:\windows\system32\rdpcore.dll

2012-03-21 00:03 . 2012-02-17 05:34        826880        ----a-w-        c:\windows\SysWow64\rdpcore.dll

2012-03-21 00:03 . 2012-02-17 04:58        210944        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-03-21 00:03 . 2012-02-17 04:57        23552        ----a-w-        c:\windows\system32\drivers\tdtcp.sys

2012-03-20 17:30 . 2011-07-13 02:55        2237440        ----a-r-        C:\OTLPE.exe

2012-03-20 17:29 . 2012-03-20 22:12        --------        d-----w-        C:\_OTL

2012-03-06 09:40 . 2012-03-06 09:40        --------        d-----w-        c:\users\Sebastian Rosner\AppData\Roaming\Malwarebytes

2012-03-06 09:40 . 2012-03-06 09:40        --------        d-----w-        c:\programdata\Malwarebytes

2012-03-06 09:40 . 2011-12-10 14:24        23152        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-03-02 14:31 . 2012-03-02 14:31        --------        d-----w-        c:\users\Sebastian Rosner\AppData\Roaming\EPSON

2012-03-01 19:36 . 2012-03-01 19:36        --------        d-----w-        c:\users\Sebastian Rosner\AppData\Local\Risen

2012-03-01 19:14 . 2012-03-01 19:14        --------        d-----w-        c:\program files (x86)\AGEIA Technologies

2012-03-01 19:14 . 2012-03-01 19:14        --------        d-----w-        c:\windows\SysWow64\AGEIA

2012-03-01 19:12 . 2007-01-24 14:27        393576        ----a-w-        c:\windows\system32\xactengine2_6.dll

2012-03-01 07:15 . 2012-03-01 07:15        --------        d-----w-        c:\program files (x86)\LogMeIn Hamachi

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-02-23 08:18 . 2009-12-28 20:08        279656        ------w-        c:\windows\system32\MpSigStub.exe

2012-01-04 10:44 . 2012-02-15 23:41        509952        ----a-w-        c:\windows\system32\ntshrui.dll

2012-01-04 08:58 . 2012-02-15 23:41        442880        ----a-w-        c:\windows\SysWow64\ntshrui.dll

2011-12-30 06:26 . 2012-02-15 23:41        515584        ----a-w-        c:\windows\system32\timedate.cpl

2011-12-30 05:27 . 2012-02-15 23:41        478720        ----a-w-        c:\windows\SysWow64\timedate.cpl

2011-12-28 03:59 . 2012-02-15 23:41        498688        ----a-w-        c:\windows\system32\drivers\afd.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2009-05-26 317288]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-10 98304]

"MarketingTools"="c:\program files (x86)\Sony\Marketing Tools\MarketingTools.exe" [2009-09-07 26624]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]

"TrayServer"="s:\chaostag\TrayServer.exe" [2008-08-07 90112]

"PC Auto Shutdown"="s:\teamspeak\PC Auto Shutdown\AutoShutdown.exe" [2010-12-01 1387520]

"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\ssmmgr.exe" [2010-06-07 618496]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]

"iTunesHelper"="s:\itunes\iTunesHelper.exe" [2011-12-08 421736]

"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-02-28 1987976]

.

c:\users\Sebastian Rosner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-1 1079584]

GamersFirst LIVE!.lnk - c:\program files (x86)\GamersFirst\LIVE!\Live.exe [2011-3-3 2845552]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]

2009-07-01 09:49        98304        ----a-w-        c:\windows\System32\VESWinlogon.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer2"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R1 iehiknbe;iehiknbe;c:\windows\system32\drivers\iehiknbe.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-06-26 362992]

R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-04-01 183560]

R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]

R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]

R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x]

R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [x]

R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-06-26 313840]

R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2009-07-27 120104]

R3 SOHDBSvr;VAIO Media plus Database Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [2009-07-27 70952]

R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2009-07-27 427304]

R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2009-07-27 75048]

R3 SOHPlMgr;VAIO Media plus Playlist Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [2009-07-27 91432]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]

R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-06-26 468264]

R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2009-06-26 357672]

R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2009-06-17 110888]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]

S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-02-28 2343816]

S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x]

S2 PCAutoShutdown_Service;PCAutoShutdown_Service;s:\teamspeak\PC Auto Shutdown\ShutdownService.exe [2010-04-19 441624]

S2 regi;regi;c:\windows\system32\drivers\regi.sys [x]

S2 RtkAudioService;Realtek Audio Service;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe [2009-07-24 189984]

S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960]

S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2009-07-16 411496]

S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-07-22 642920]

S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2009-08-12 522240]

S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [x]

S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]

S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [x]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]

.

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-24 7938080]

"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-07-24 1833504]

"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-17 171520]

"MRT"="c:\windows\system32\MRT.exe" [2012-03-21 56297240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = <local>;*.local

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe

FF - ProfilePath - c:\users\Sebastian Rosner\AppData\Roaming\Mozilla\Firefox\Profiles\2unxji1j.default\

FF - prefs.js: network.proxy.http - 127.0.0.1

FF - prefs.js: network.proxy.http_port - 60323

FF - prefs.js: network.proxy.type - 4

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

FF - Ext: Gutscheinrausch.de: mail@gutscheinrausch.de - %profile%\extensions\yem5g0fm.ki0

FF - Ext: iMacros for Firefox: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} - %profile%\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}

FF - Ext: JavaString Helper: {184AA5E6-741D-464a-820E-94B3ABC2F3B4} - c:\users\Sebastian Rosner\AppData\Roaming\5048

FF - Ext: JavaString Helper: {184AA5E6-741D-464a-820E-94B3ABC2F3B4} - c:\users\Sebastian Rosner\AppData\Roaming\5048

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKCU-Run-ICQ - c:\program files (x86)\ICQ6.5\ICQ.exe

Wow6432Node-HKCU-Run-K3aRyluP6SiCkoR - c:\users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe

SafeBoot-mcmscsvc

SafeBoot-MCODS

HKLM-Run-Apoint - c:\program files (x86)\Apoint\Apoint.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-3643894325-2442357728-1046350489-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\S-1-5-21-3643894325-2442357728-1046350489-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_USERS\S-1-5-21-3643894325-2442357728-1046350489-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

@Allowed: (Read) (RestrictedCode)

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10a.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10a.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]

@Denied: (A 2) (Everyone)

@="IFlashBroker2"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2012-03-21  11:31:24

ComboFix-quarantined-files.txt  2012-03-21 10:31

.

Vor Suchlauf: 13 Verzeichnis(se), 101.270.581.248 Bytes frei

Nach Suchlauf: 18 Verzeichnis(se), 107.196.825.600 Bytes frei

.

- - End Of File - - 35CF8D50533D8EEF9B5C88F4BE8B5400

öffne malwarebytes, logdateien, poste alle berichte

Code:

Malwarebytes Anti-Malware 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.03.21.07
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 8.0.7601.17514

Sebastian Rosner :: SEBASTIANROSNER [Administrator]
 

21.03.2012 22:18:16

mbam-log-2012-03-21 (23-16-10).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 443562

Laufzeit: 54 Minute(n), 21 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 1

C:\_OTL\MovedFiles\03202012_132937\E_Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe (Spyware.Passwords) -> Keine Aktion durchgeführt.
 

(Ende)

lade den CCleaner standard:
CCleaner Download - CCleaner 3.16.1666
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Bei einigen bin ich mir nicht sicher, was sie für eine Funtkion haben, aber hier nun die Liste. Danke!

Code:

Adobe Flash Player 10 ActiveX        Adobe Systems Incorporated        22.12.2009                10.0.12.36   notwendig

Adobe Flash Player 11 Plugin        Adobe Systems Incorporated        03.10.2011        6,00MB        11.0.1.152   notwendig

Adobe Photoshop CS3        Adobe Systems Incorporated        29.11.2011        1.085MB        10.0   unnötig

Adobe Reader X (10.1.1) - Deutsch        Adobe Systems Incorporated        13.12.2011        119,2MB        10.1.1   notwendig

Alps Pointing-device for VAIO        ALPS ELECTRIC CO., LTD.        16.08.2009   unbekannt                

ANNO 1404        Ubisoft        14.09.2010                1.02.0000   unnötig

Any Video Converter 3.2.5        Any-Video-Converter.com        26.06.2011        91,1MB   unnötig

Apple Application Support        Apple Inc.        29.12.2011        61,2MB        2.1.6   unbekannt

Apple Mobile Device Support        Apple Inc.        29.12.2011        24,4MB        4.0.0.97   unbekannt

Apple Software Update        Apple Inc.        29.12.2011        2,38MB        2.1.3.127   unbekannt

ArcSoft Magic-i Visual Effects 2        ArcSoft        22.12.2009                2.0.1.85   unbekannt

ArcSoft WebCam Companion 3        ArcSoft        22.12.2009                3.0.21.193    notwendig

ATI Catalyst Install Manager        ATI Technologies, Inc.        06.09.2009        18,2MB        3.0.732.0   notwendig

Audacity 1.3.13 (Unicode)        Audacity Team        24.11.2011        40,2MB   unnötig

Avira AntiVir Personal - Free Antivirus        Avira GmbH        25.02.2012        90,4MB        10.2.0.707   notwendig

Bing Bar        Microsoft Corporation        19.11.2011        24,3MB        7.0.619.0   unnötig

Bonjour        Apple Inc.        29.12.2011        1,46MB        3.0.0.10   unbekannt

CCleaner        Piriform        21.03.2012                3.16   notwendig

Click to Disc        Sony Corporation        06.09.2009                1.2.70.06160   unbekannt

Click to Disc Editor        Sony Corporation        06.09.2009        191,8MB        2.0.02   unbekannt

Compatibility Pack für 2007 Office System        Microsoft Corporation        07.03.2012        223MB        12.0.6612.1000   notwendig

DIE SIEDLER - Das Erbe der Könige        Blue Byte        07.11.2011                1.00.0000   unnötig

DivX Codec        DivX, Inc.        03.01.2010                6.9.1   unnötig

DivX Converter        DivX, Inc.        03.01.2010                7.1.0   unnötig

DivX Player        DivX, Inc.        03.01.2010                7.2.0   notwendig

DivX Plus DirectShow Filters        DivX, Inc.        03.01.2010   unnötig

DivX Plus Web Player        DivX,Inc.        03.01.2010                2.0.0   unnötig

DVD Shrink 3.2 deutsch (DeCSS-frei)        DVD Shrink        27.06.2011 unbekannt

Einstellungen für VAIO-Inhaltsüberwachung        Sony Corporation        06.09.2009                2.4.0.06120   notwendig

EPSON Scan                18.10.2010   notwendig

EPSON-Drucker-Software        SEIKO EPSON Corporation        21.01.2010   notwendig                

Firebird SQL Server - MAGIX Edition        MAGIX AG        04.11.2010        10,1MB        2.1.27.0   unbekannt

Free Studio version 5.0.0        DVDVideoSoft Limited.        29.11.2010        226MB   unnötig

GamersFirst LIVE!        GamersFirst        22.04.2011  unbekannt/unnötig

Gothic II        JoWooD Productions Software AG        06.11.2011   unnötig                

Grand Theft Auto San Andreas        Rockstar Games        27.09.2011                1.00.00001    unnötig

GUILD WARS                25.07.2010    unnötig

ICQ7.4        ICQ        10.03.2011                7.4    notwendig

Intel® Matrix Storage Manager        Intel Corporation        22.12.2009    notwendig                

iTunes        Apple Inc.        29.12.2011        170,5MB        10.5.2.11    notwendig

Java(TM) 6 Update 14 (64-bit)        Sun Microsystems, Inc.        16.08.2009        90,6MB        6.0.140   notwendig

Java(TM) 6 Update 17        Sun Microsystems, Inc.        16.08.2009        97,5MB        6.0.170   notwendig

LAME v3.98.3 for Audacity                04.12.2011        1,17MB   unnötig

League of Legends        Riot Games        28.02.2011                1.02.0000   unnötig

Logitech SetPoint 6.20        Logitech        05.03.2011        39,1MB        6.20.64     unnötig

LogMeIn Hamachi        LogMeIn, Inc.        29.02.2012                2.1.0.166   unnötig

MAGIX 3D Maker (embeded)        MAGIX AG        14.06.2010                6.0.0.8   unnötig

MAGIX Screenshare        MAGIX AG        24.05.2011        1,43MB        4.3.6.1987    unnötig

MAGIX Speed burnR (MSI)        MAGIX AG        24.05.2011        51,1MB        7.0.2.6    unnötig

MAGIX Video deluxe 17 Premium Download-Version        MAGIX AG        24.05.2011                10.0.1.14    unnötig

MAGIX Xtreme Foto Designer 6 6.0.25.0 (D)        MAGIX AG        04.11.2010                6.0.25.0    unnötig

Malwarebytes Anti-Malware Version 1.60.1.1000        Malwarebytes Corporation        05.03.2012        17,4MB        1.60.1.1000    notwendig

Max Payne 2                22.10.2011                1.0.98    unnötig

MegaTrainer eXperience V1.0.1.3                14.09.2010   unnötig

Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        26.06.2010        38,8MB        4.0.30319    notwendig

Microsoft .NET Framework 4 Client Profile DEU Language Pack        Microsoft Corporation        26.06.2010        2,94MB        4.0.30319    notwendig

Microsoft Age of Empires II                28.05.2010    unnötig

Microsoft Age of Empires II: The Conquerors Expansion                11.06.2010    unnötig                

Microsoft Office File Validation Add-In        Microsoft Corporation        12.10.2011        7,95MB        14.0.5130.5003   notwendig

Microsoft Office Home and Student 2007        Microsoft Corporation        07.03.2012                12.0.6612.1000   notwendig

Microsoft Office PowerPoint Viewer 2007 (German)        Microsoft Corporation        07.03.2012        40,6MB        12.0.6612.1000   notwendig

Microsoft Office Suite Activation Assistant        Microsoft Corporation        06.09.2009        8,37MB        2.9    notwendig

Microsoft Silverlight        Microsoft Corporation        15.02.2012        60,3MB        4.1.10111.0     notwendig

Microsoft SQL Server 2005 Compact Edition [ENU]        Microsoft Corporation        29.11.2010        1,70MB        3.1.0000    notwendig

Microsoft SQL Server Compact 3.5 SP1 English        Microsoft Corporation        06.09.2009        2,59MB        3.5.5692.0   notwendig

Microsoft SQL Server Compact 3.5 SP1 x64 English        Microsoft Corporation        06.09.2009        3,69MB        3.5.5692.0    notwendig

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053        Microsoft Corporation        06.01.2010        0,25MB        8.0.50727.4053    notwendig

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053        Microsoft Corporation        06.01.2010        0,25MB        8.0.50727.4053    notwenndig

Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        15.06.2011        0,29MB        8.0.56336    notwendig

Microsoft Visual C++ 2005 Redistributable (x64)        Microsoft Corporation        04.03.2011        0,82MB        8.0.61000    notwendig

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175        Microsoft Corporation        03.05.2011        0,57MB        8.0.51011    notwendig

Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148        Microsoft Corporation        07.03.2011        0,21MB        9.0.30729.4148    notwendig

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148        Microsoft Corporation        06.01.2010        0,20MB        9.0.30729.4148    notwendig

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570        Microsoft Corporation        27.04.2011        0,77MB        9.0.30729.5570    notwendig

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570        Microsoft Corporation        27.04.2011        0,58MB        9.0.30729.5570    notwendig

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17        Microsoft Corporation        05.03.2011        0,77MB        9.0.30729    notwendig

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161        Microsoft Corporation        15.06.2011        0,77MB        9.0.30729.6161    notwendig

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        27.12.2009        0,57MB        9.0.30729    notwenndig

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161        Microsoft Corporation        15.06.2011        0,59MB        9.0.30729.6161   notwendig

Microsoft Works        Microsoft Corporation        16.12.2010        877MB        9.7.0621   notwendig

mIRC        mIRC Co. Ltd.        16.01.2012                7.22   unnötig

Moorhuhn Remake                18.06.2011                1.00.0000    unnötig

Mozilla Firefox (3.5.10)        Mozilla        23.06.2010                3.5.10 (de)     notwendig

MSXML 4.0 SP2 (KB954430)        Microsoft Corporation        23.12.2009        1,28MB        4.20.9870.0   unbekannt

MSXML 4.0 SP2 (KB973688)        Microsoft Corporation        23.12.2009        1,33MB        4.20.9876.0   unbekannt

Music Transfer        Sony Corporation        06.09.2009                1.3.01.13160    unbekannt

MusicStation        Omnifone        06.09.2009        17,6MB        1.2.2.180     unbekannt

MySQL Connector/ODBC 3.51        MySQL AB        22.05.2010        3,98MB        3.51.12    unbekannt

Nero Suite                21.06.2010    notwendig

NVIDIA PhysX        NVIDIA Corporation        29.02.2012        119,9MB        9.09.0203    notwendig

OpenOffice.org 3.2        OpenOffice.org        28.02.2010        371MB        3.2.9483    unnötig

Pando Media Booster        Pando Networks Inc.        28.02.2011        5,47MB        2.3.5.2    unbekannt

PC Auto Shutdown 4.5        GoldSolution Software, Inc.        13.06.2011                4.5    unnötig

Picasa 3        Google, Inc.        05.10.2011                3.8    notwenndig

QuickTime        Apple Inc.        10.03.2011        73,7MB        7.69.80.9    notwendig

Realtek HDMI Audio Driver for ATI        Realtek Semiconductor Corp.        16.08.2009                6.0.1.5897  unbekannt

Realtek High Definition Audio Driver        Realtek Semiconductor Corp.        16.08.2009                6.0.1.5886   unbekannt

Risen        Deep Silver        29.02.2012                1.00.0000    notwendig

Roxio Easy Media Creator 10 LJ        Roxio        22.12.2009        130,9MB        10.3    unbekannt

Setting Utility Series        Sony Corporation        06.09.2009                5.0.0.07300   unbekannt

Shutter        [den4b] Denis Kozlov        13.07.2010                2.90    unnötig

Skype™ 5.5        Skype Technologies S.A.        29.10.2011        17,0MB        5.5.124    notwendig

Sony Home Network Library        Sony Corporation        06.09.2009                2.0.0.07280   notwendig

Sony Picture Utility        Sony Corporation        06.09.2009                4.2.12.16210    notwendig

Stronghold                11.09.2011    unnötig

TeamSpeak 3 Client        TeamSpeak Systems GmbH        12.04.2011    unnötig                

theHunter (remove only)        Expansive Worlds        27.09.2011   unbekannt

TmNationsForever        Nadeo        08.10.2011   notwendig

Uninstall 1.0.0.1                29.11.2010        10,2MB    unbekannt        

Unterstützung für VAIO-Präsentation        Sony Corporation        06.09.2009                2.0.0.05270   notwendig

VAIO Content Metadata Intelligent Analyzing Manager        Sony Corporation        06.09.2009                3.5.0.06261    notwendig

VAIO Content Metadata Intelligent Network Service Manager        Sony Corporation        06.09.2009                3.5.0.06260    notwendig

VAIO Content Metadata Manager Settings        Sony Corporation        06.09.2009                3.5.0.06260    notwendig

VAIO Content Metadata XML Interface Library        Sony Corporation        06.09.2009                3.5.0.06180    notwendig

VAIO Control Center        Sony Corporation        06.09.2009                4.0.0.06120    notwendig

VAIO Data Restore Tool        Sony Corporation        06.09.2009                1.1.01.06290    notwendig

VAIO DVD Menu Data Basic        Sony Corporation        06.09.2009                1.0.00.08130   notwendig

VAIO Energie Verwaltung        Sony Corporation        06.09.2009                4.0.0.07160   notwendig

VAIO Entertainment Platform        Sony Corporation        06.09.2009                3.5.0.07230   notwendig

VAIO Event Service        Sony Corporation        06.09.2009                5.0.0.07010   notwendig

VAIO Gate        Sony Corporation        06.09.2009                1.0.0.08050   notwendig

VAIO Marketing Tools        Sony Corporation        22.12.2009   notwendig

VAIO Media plus        Sony Corporation        06.09.2009                2.0.0.07280   notwendig

VAIO Media plus Opening Movie        Sony Corporation        06.09.2009                1.2.0.09100   notwendig

VAIO Movie Story        Sony Corporation        06.09.2009                1.5.00.06191    notwendig

VAIO Movie Story Template Data        Sony Corporation        06.09.2009                1.5.00.06010   notwendig

VAIO NW screensaver        Sony Europe        22.12.2009                1.0.0.0   notwendig

VAIO Original Funktion Einstellungen        Sony Corporation        06.09.2009                2.0.0.07010   notwendig

VAIO Premium Partners 1.00                22.12.2009   notwendig

VAIO Quick Web Access        Sony Corporation        06.09.2009        143,7MB        1.1.2.4    notwendig

VAIO Smart Network        Sony Corporation        06.09.2009                3.0.0.08120    notwendig

VAIO Update 4        Sony Corporation        06.09.2009                4.2.0.07300    notwendig

VAIO Wallpaper Contents        Sony Corporation        06.09.2009                2.0.0.06010    notwendig

VAIO-Support für Übertragungen        Sony Corporation        06.09.2009                1.0.0.07290    notwendig

VLC media player 1.0.3        VideoLAN Team        08.01.2010                1.0.3    notwendig

Warcraft III                24.12.2009 unnötig

Warcraft III: All Products                24.12.2009   unnötig                

Wartung Samsung ML-1660 Series        Samsung Electronics Co., Ltd.        12.09.2011   unbekannt                

WIDCOMM Bluetooth Software        Broadcom Corporation        16.08.2009        144,3MB        6.2.0.9600    unbekannt

Windows Live Essentials        Microsoft Corporation        20.11.2011                15.4.3538.0513    notwendig

Windows Live Mesh ActiveX control for remote connections        Microsoft Corporation        19.11.2011        5,58MB        15.4.5722.2    notwendig

WinDVD BD for VAIO        InterVideo Inc.        06.09.2009        133,2MB        8.0.20.79    notwendig

WinPcap 4.1.1        CACE Technologies        23.03.2010                4.1.0.1753    unbekannt

WinRAR                18.01.2010 notwendig

WinRAR                05.07.2010 unnötig

deinstaliere:
Adobe Photoshop
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
ANNO
Any Video
Audacity
Bing
DIE SIEDLER
DVD Shrink
Free Studio
GamersFirst
Gothic
Grand Theft
GUILD
Java: beide
Download der kostenlosen Java-Software
downloade java jre, instalieren.

deinstaliere:
LAME
League
Logitech
LogMeIn
MAGIX : alle
Max Payne
MegaTrainer
Microsoft Age : beide
Microsoft Silverlight : wenn du es nicht nutzt, weg
mIRC
Moorhuhn

firefox 11 laden:
Webbrowser Firefox auf Deutsch | Schneller, sicherer und anpassbar
instalieren.

deinstaliere:
Music beide
OpenOffice
PC Auto
Shutter
Stronghold
TeamSpeak
theHunter
Warcraft : beide
WinPcap

öffne ccleaner analysieren, starten, pc neustarten, testen wie das system läuft