Hey,
das ist ja mehr als sch....ich hoffe es besteht keine unmittelbare Gefahr für meine Daten.Mein Umgang war wohl etwas leichtfertig......
Aus meiner Sicht läuft der Rechner gut aber ich bin Laie und SpyHunter4 ist noch da..
Zwischendurch auch schon mal mein Dank an dich !
All processes killed
========== OTL ==========
C:\Users\mischa\AppData\Roaming\13001.009\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.009 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.011\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.011 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.012\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.012 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.013\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.013 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.014\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.014 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.015\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.015 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.016\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.016 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.017\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.017 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.018\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.018 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.019\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.019 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.020\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.020 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.021\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.021 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.022\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.022 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.023\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.023 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.024\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.024 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.025\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.025 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.026\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.026 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.027\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.027 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.028\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.028 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13002\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13002 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13003\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13003 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13004\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13004 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13005\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13005 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13006\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13006 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13007\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13007 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13008\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13008 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.002\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.002 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.003\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.003 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.004\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.004 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.005\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.005 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.006\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.006 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.007\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.007 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.008\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.008 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.009\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.009 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.010\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.010 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.011\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.011 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.012\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.012 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.013\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.013 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.014\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.014 folder moved successfully.
C:\Users\mischa\AppData\Roaming\kock folder moved successfully.
C:\Users\mischa\AppData\Roaming\UAs folder moved successfully.
C:\Users\mischa\AppData\Roaming\Wuatly folder moved successfully.
C:\Users\mischa\AppData\Roaming\xmldm folder moved successfully.
C:\Users\mischa\AppData\Roaming\urhtps.dat moved successfully.
C:\Users\mischa\AppData\Roaming\Ykyqv folder moved successfully.
C:\Users\mischa\AppData\Roaming\Yvar folder moved successfully.
ADS C:\ProgramData\TEMP:373E1720 deleted successfully.
C:\Users\mischa\AppData\Roaming\blckdom.res moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: mischa
->Temp folder emptied: 3024 bytes
->Temporary Internet Files folder emptied: 3949654 bytes
->Java cache emptied: 1364735 bytes
->FireFox cache emptied: 80463285 bytes
->Google Chrome cache emptied: 115930941 bytes
->Flash cache emptied: 616 bytes
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 3613801 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 196,00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 02092013_232300
Files\Folders moved on Reboot...
C:\Users\mischa\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Malwarebytes Anti-Rootkit BETA 1.01.0.1020
Malwarebytes : Free anti-malware download
Database version: v2013.02.04.09
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
mischa :: MISCHA-PC [administrator]
09.02.2013 23:47:20
mbar-log-2013-02-09 (23-47-20).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 28625
Time elapsed: 13 minute(s), 28 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 2
HKCU\SOFTWARE\CLASSES\linkrdr.AIEbho (Trojan.Banker) -> Delete on reboot.
HKCU\SOFTWARE\CLASSES\linkrdr.AIEbho.1 (Trojan.Banker) -> Delete on reboot.
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 1
c:\Users\mischa\Downloads\triggerfinger__all_this_dancin_around_2012_id3637671id.exe (PUP.Adware.MediaGet) -> Delete on reboot.
(end)
Malwarebytes Anti-Rootkit BETA 1.01.0.1020
Malwarebytes : Free anti-malware download
Database version: v2013.02.09.07
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
mischa :: MISCHA-PC [administrator]
10.02.2013 00:13:05
mbar-log-2013-02-10 (00-13-05).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 28588
Time elapsed: 19 minute(s), 44 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
2013/02/10 00:17:59 +0100 MISCHA-PC mischa MESSAGE Stopping IP protection
2013/02/10 00:18:00 +0100 MISCHA-PC mischa MESSAGE IP Protection stopped successfully
2013/02/10 00:18:10 +0100 MISCHA-PC mischa MESSAGE Protection stopped
2013/02/10 00:18:21 +0100 MISCHA-PC mischa MESSAGE Starting protection
2013/02/10 00:18:21 +0100 MISCHA-PC mischa MESSAGE Protection started successfully
2013/02/10 00:18:21 +0100 MISCHA-PC mischa MESSAGE Starting IP protection
2013/02/10 00:18:24 +0100 MISCHA-PC mischa MESSAGE IP Protection started successfully
2013/02/10 00:18:37 +0100 MISCHA-PC mischa MESSAGE Starting database refresh
2013/02/10 00:18:37 +0100 MISCHA-PC mischa MESSAGE Stopping IP protection
2013/02/10 00:18:37 +0100 MISCHA-PC mischa MESSAGE IP Protection stopped successfully
2013/02/10 00:18:40 +0100 MISCHA-PC mischa MESSAGE Database refreshed successfully
2013/02/10 00:18:40 +0100 MISCHA-PC mischa MESSAGE Starting IP protection
2013/02/10 00:18:45 +0100 MISCHA-PC mischa MESSAGE IP Protection started successfully
2013/02/10 00:23:43 +0100 MISCHA-PC mischa MESSAGE Stopping protection
2013/02/10 00:23:43 +0100 MISCHA-PC mischa MESSAGE Protection stopped successfully
2013/02/10 00:23:43 +0100 MISCHA-PC mischa MESSAGE Stopping IP protection
2013/02/10 00:23:43 +0100 MISCHA-PC mischa MESSAGE IP Protection stopped successfully
2013/02/10 00:23:43 +0100 MISCHA-PC mischa MESSAGE Protection stopped
C:\Qoobox\Quarantine\C\Windows\Installer\{b9108c6b-a523-9cc9-f8d0-5a2152aedf5a}\U\00000004.@.vir Win64/Conedex.C trojan
C:\Users\mischa\Documents\Mischa Windows Old\AppData\Local\Temp\Low\Recycle.Bi\12A5481B0BFE8C4 Win32/Spy.SpyEye.CFG.A trojan
C:\_OTL\MovedFiles\02092013_232300\C_Users\mischa\AppData\Roaming\14001.014\components\AcroFF014.dll a variant of Win32/Spy.Banker.YIL trojanOTL Logfile:
Code:
OTL logfile created on: 10.02.2013 08:38:55 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\mischa\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,99 Gb Total Physical Memory | 2,32 Gb Available Physical Memory | 58,26% Memory free
7,98 Gb Paging File | 6,07 Gb Available in Paging File | 76,05% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 424,66 Gb Total Space | 230,92 Gb Free Space | 54,38% Space Free | Partition Type: NTFS
Computer Name: MISCHA-PC | User Name: mischa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013.02.08 13:40:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\mischa\Downloads\OTL.exe
PRC - [2013.01.26 03:35:08 | 001,248,208 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2012.08.08 19:42:30 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.09 07:31:28 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.09 07:31:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
========== Modules (No Company Name) ==========
MOD - [2013.02.05 18:33:37 | 012,459,888 | ---- | M] () -- C:\Users\mischa\AppData\Local\Google\Chrome\User Data\PepperFlash\11.5.31.139\pepflashplayer.dll
MOD - [2013.01.26 03:35:06 | 000,460,240 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll
MOD - [2013.01.26 03:35:04 | 004,012,496 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\pdf.dll
MOD - [2013.01.26 03:34:19 | 000,597,968 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\libglesv2.dll
MOD - [2013.01.26 03:34:18 | 000,124,368 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\libegl.dll
MOD - [2013.01.26 03:34:16 | 001,552,848 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\ffmpegsumo.dll
========== Services (SafeList) ==========
SRV:64bit: - [2009.08.18 01:36:20 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.11.09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.10.26 19:15:26 | 000,234,776 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.313\McCHSvc.exe -- (McComponentHostService)
SRV - [2012.08.25 02:59:11 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.17 15:25:28 | 000,580,648 | ---- | M] (WiseCleaner.com) [Auto | Stopped] -- C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe -- (WiseBootAssistant)
SRV - [2012.07.17 15:14:44 | 002,292,480 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2012.05.09 07:31:28 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.09 07:31:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2012.12.14 16:49:28 | 000,024,176 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.09.12 15:20:04 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2012.05.09 07:31:28 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.09 07:31:28 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.10.11 14:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.01.19 16:55:34 | 001,088,544 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192se.sys -- (rtl8192se)
DRV:64bit: - [2010.01.10 17:49:30 | 000,291,328 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.08.18 02:48:48 | 006,037,504 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2011.03.02 17:17:20 | 000,013,088 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Google
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 61 0E 7E 74 5D 8B CC 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://findgala.com/?&uid=5762&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/ncr"
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.313\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Users\mischa\AppData\Local\Mozilla Firefox\components [2012.08.30 13:17:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0\extensions\\Components: C:\Users\mischa\AppData\Local\Mozilla Thunderbird\components [2013.01.11 08:53:55 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}: C:\Users\mischa\AppData\Roaming\14001.014
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0\extensions\\Components: C:\Users\mischa\AppData\Local\Mozilla Thunderbird\components [2013.01.11 08:53:55 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Users\mischa\AppData\Local\Mozilla Thunderbird\components [2013.01.11 08:53:55 | 000,000,000 | ---D | M]
[2011.10.15 19:02:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mischa\AppData\Roaming\mozilla\Extensions
[2012.12.28 12:01:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mischa\AppData\Roaming\mozilla\Firefox\Profiles\gfnwj2jv.default\extensions
[2012.12.09 09:30:58 | 000,003,576 | ---- | M] () -- C:\Users\mischa\AppData\Roaming\mozilla\firefox\profiles\gfnwj2jv.default\searchplugins\Google.xml
========== Chrome ==========
CHR - homepage:
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage:
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - Extension: Google Drive = C:\Users\mischa\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\mischa\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\mischa\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Mail = C:\Users\mischa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Google Drive = C:\Users\mischa\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\mischa\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\mischa\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Mail = C:\Users\mischa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2013.02.09 16:57:54 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.313\McAfeeMSS_IE.dll (McAfee, Inc.)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [Z1] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 221
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {01E54593-BE14-4D6B-9310-37C0145EFE42} file:///E:/CDVIEWER11/CdViewer.cab (AMI DicomDir TreeView Control 1.1)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {FC11A119-C2F7-46F4-9E32-937ABA26816E} file:///E:/CDVIEWER21/CdViewer.cab (AMI DicomDir TreeView Control 2.1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AE1F19A2-A837-4E6C-A936-CE1FFB84DB86}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2013.02.10 00:24:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2013.02.10 00:23:02 | 002,347,384 | ---- | C] (ESET) -- C:\Users\mischa\Desktop\esetsmartinstaller_enu.exe
[2013.02.10 00:16:09 | 010,156,344 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\mischa\Desktop\mbam-setup-1.70.0.1100 (1).exe
[2013.02.09 23:32:39 | 006,292,552 | ---- | C] (Nokia Corporation and/or its subsidiary(-ies)) -- C:\Users\mischa\Desktop\QtGui4.dll
[2013.02.09 23:32:39 | 002,169,416 | ---- | C] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\mbamnet.dll
[2013.02.09 23:32:39 | 002,030,664 | ---- | C] (Nokia Corporation and/or its subsidiary(-ies)) -- C:\Users\mischa\Desktop\QtCore4.dll
[2013.02.09 23:32:39 | 001,363,528 | ---- | C] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\mbar.exe
[2013.02.09 23:32:39 | 001,093,192 | ---- | C] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\mbamcore.dll
[2013.02.09 23:32:39 | 000,748,616 | ---- | C] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\fixdamage.exe
[2013.02.09 23:32:39 | 000,500,296 | ---- | C] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\mbam.dll
[2013.02.09 23:32:39 | 000,000,000 | ---D | C] -- C:\Users\mischa\Desktop\Languages
[2013.02.09 23:32:39 | 000,000,000 | ---D | C] -- C:\Users\mischa\Desktop\imageformats
[2013.02.09 23:32:38 | 000,000,000 | ---D | C] -- C:\Users\mischa\Desktop\Data
[2013.02.09 23:23:00 | 000,000,000 | ---D | C] -- C:\_OTL
[2013.02.09 17:30:10 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.02.09 16:45:56 | 005,030,592 | R--- | C] (Swearware) -- C:\Users\mischa\Desktop\ComboFix.exe
[2013.02.09 01:28:38 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.02.09 01:28:38 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.02.09 01:28:38 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.02.09 01:26:45 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.02.09 01:26:24 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.02.08 10:19:23 | 000,000,000 | ---D | C] -- C:\Users\mischa\AppData\Roaming\Malwarebytes
[2013.02.08 10:19:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.02.08 10:19:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.02.08 10:19:17 | 000,024,176 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.02.08 10:19:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.02.08 10:18:59 | 000,000,000 | ---D | C] -- C:\Users\mischa\AppData\Local\Programs
[2013.02.08 09:40:52 | 000,000,000 | ---D | C] -- C:\Users\mischa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
[2013.02.08 09:25:59 | 000,000,000 | ---D | C] -- C:\Users\mischa\AppData\Roaming\Wise Care 365
[2013.02.08 09:25:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365
[2013.02.08 09:25:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Wise
[2013.02.03 15:11:40 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2013.02.03 13:03:24 | 000,000,000 | ---D | C] -- C:\Windows\de
[2013.02.03 13:00:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live
[2013.02.03 12:57:00 | 000,000,000 | ---D | C] -- C:\Users\mischa\AppData\Local\Windows Live
[2013.02.01 17:28:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2013.01.11 08:53:54 | 000,000,000 | ---D | C] -- C:\Users\mischa\AppData\Local\Mozilla Thunderbird
========== Files - Modified Within 30 Days ==========
File not found -- C:\Windows\SysNative\
[2013.02.10 08:34:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.02.10 00:23:50 | 000,000,424 | ---- | M] () -- C:\Windows\tasks\Wise Care 365.job
[2013.02.10 00:23:05 | 002,347,384 | ---- | M] (ESET) -- C:\Users\mischa\Desktop\esetsmartinstaller_enu.exe
[2013.02.10 00:18:14 | 000,001,117 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.02.10 00:16:20 | 010,156,344 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\mischa\Desktop\mbam-setup-1.70.0.1100 (1).exe
[2013.02.09 23:57:51 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.09 23:57:51 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.09 23:49:47 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.02.09 23:49:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.09 23:49:22 | 3212,230,656 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.09 23:31:12 | 013,711,621 | ---- | M] () -- C:\Users\mischa\Desktop\mbar-1.01.0.1020.zip
[2013.02.09 16:57:54 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.02.09 16:46:06 | 005,030,592 | R--- | M] (Swearware) -- C:\Users\mischa\Desktop\ComboFix.exe
[2013.02.09 09:19:57 | 000,001,501 | ---- | M] () -- C:\Users\mischa\Desktop\adwcleaner - Verknüpfung.lnk
[2013.02.08 13:41:16 | 000,001,428 | ---- | M] () -- C:\Users\mischa\Desktop\OTL - Verknüpfung.lnk
[2013.02.08 13:34:50 | 000,000,759 | ---- | M] () -- C:\Users\mischa\Desktop\gmer.tex - Verknüpfung.lnk
[2013.02.08 13:26:28 | 000,001,166 | ---- | M] () -- C:\Users\mischa\Desktop\hhhmt89c - Verknüpfung.lnk
[2013.02.08 13:10:28 | 000,001,483 | ---- | M] () -- C:\Users\mischa\Desktop\v8hexwbw - Verknüpfung.lnk
[2013.02.08 13:08:34 | 000,000,000 | ---- | M] () -- C:\Users\mischa\defogger_reenable
[2013.02.08 09:40:53 | 000,002,264 | ---- | M] () -- C:\Users\mischa\Desktop\SpyHunter.lnk
[2013.02.08 09:25:46 | 000,001,164 | ---- | M] () -- C:\Users\Public\Desktop\Wise Care 365.lnk
[2013.02.05 22:38:03 | 000,138,254 | ---- | M] () -- C:\Users\mischa\Documents\Mein FilmFinnland 2011.wlmp
[2013.02.05 14:50:22 | 006,292,552 | ---- | M] (Nokia Corporation and/or its subsidiary(-ies)) -- C:\Users\mischa\Desktop\QtGui4.dll
[2013.02.05 14:50:22 | 002,169,416 | ---- | M] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\mbamnet.dll
[2013.02.05 14:50:22 | 002,030,664 | ---- | M] (Nokia Corporation and/or its subsidiary(-ies)) -- C:\Users\mischa\Desktop\QtCore4.dll
[2013.02.05 14:50:22 | 001,093,192 | ---- | M] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\mbamcore.dll
[2013.02.05 14:50:21 | 000,500,296 | ---- | M] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\mbam.dll
[2013.02.05 14:50:19 | 001,363,528 | ---- | M] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\mbar.exe
[2013.02.05 14:50:19 | 000,748,616 | ---- | M] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\fixdamage.exe
[2013.02.04 12:22:10 | 000,001,923 | ---- | M] () -- C:\Users\mischa\Documents\Mein Film.wlmp
[2013.02.01 17:28:30 | 000,002,050 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013.02.01 09:23:59 | 000,014,284 | ---- | M] () -- C:\Users\mischa\Documents\Stunden 2012 - Kopie.odt
[2013.02.01 09:18:40 | 000,013,066 | ---- | M] () -- C:\Users\mischa\Documents\Stunden 2011 - Kopie.odt
[2013.02.01 08:58:48 | 000,013,098 | ---- | M] () -- C:\Users\mischa\Documents\Stunden 2010 - Kopie.odt
[2013.01.30 08:58:00 | 000,001,025 | ---- | M] () -- C:\Users\mischa\Desktop\Dropbox.lnk
[2013.01.18 16:00:38 | 000,020,253 | ---- | M] () -- C:\Users\mischa\Documents\Placke Hoch.odt
[2013.01.12 00:58:09 | 000,002,263 | ---- | M] () -- C:\Users\mischa\Desktop\Google Chrome.lnk
========== Files Created - No Company Name ==========
File not found -- C:\Windows\SysNative\
[2013.02.09 23:32:40 | 000,540,917 | ---- | C] () -- C:\Users\mischa\Desktop\ReadMe.rtf
[2013.02.09 23:32:39 | 000,067,432 | ---- | C] () -- C:\Users\mischa\Desktop\License.rtf
[2013.02.09 23:30:52 | 013,711,621 | ---- | C] () -- C:\Users\mischa\Desktop\mbar-1.01.0.1020.zip
[2013.02.09 09:19:57 | 000,001,501 | ---- | C] () -- C:\Users\mischa\Desktop\adwcleaner - Verknüpfung.lnk
[2013.02.09 01:28:38 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.02.09 01:28:38 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.02.09 01:28:38 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.02.09 01:28:38 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.02.09 01:28:38 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.02.08 13:41:16 | 000,001,428 | ---- | C] () -- C:\Users\mischa\Desktop\OTL - Verknüpfung.lnk
[2013.02.08 13:34:50 | 000,000,759 | ---- | C] () -- C:\Users\mischa\Desktop\gmer.tex - Verknüpfung.lnk
[2013.02.08 13:26:28 | 000,001,166 | ---- | C] () -- C:\Users\mischa\Desktop\hhhmt89c - Verknüpfung.lnk
[2013.02.08 13:10:28 | 000,001,483 | ---- | C] () -- C:\Users\mischa\Desktop\v8hexwbw - Verknüpfung.lnk
[2013.02.08 13:08:34 | 000,000,000 | ---- | C] () -- C:\Users\mischa\defogger_reenable
[2013.02.08 10:19:19 | 000,001,117 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.02.08 09:40:53 | 000,002,264 | ---- | C] () -- C:\Users\mischa\Desktop\SpyHunter.lnk
[2013.02.08 09:26:22 | 000,000,424 | ---- | C] () -- C:\Windows\tasks\Wise Care 365.job
[2013.02.08 09:25:46 | 000,001,164 | ---- | C] () -- C:\Users\Public\Desktop\Wise Care 365.lnk
[2013.02.04 12:22:10 | 000,001,923 | ---- | C] () -- C:\Users\mischa\Documents\Mein Film.wlmp
[2013.02.03 17:47:59 | 000,138,254 | ---- | C] () -- C:\Users\mischa\Documents\Mein FilmFinnland 2011.wlmp
[2013.02.03 13:03:01 | 000,001,309 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
[2013.02.03 13:02:53 | 000,001,378 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
[2013.02.03 13:02:35 | 000,001,462 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
[2013.02.03 13:02:24 | 000,002,490 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2013.01.18 15:49:27 | 000,020,253 | ---- | C] () -- C:\Users\mischa\Documents\Placke Hoch.odt
[2012.01.15 09:54:05 | 000,000,080 | ---- | C] () -- C:\Windows\wiso.ini
[2011.11.22 19:23:46 | 003,008,021 | ---- | C] () -- C:\Users\mischa\Finnland 2011 2011-02-11 016.JPG
[2011.11.22 19:23:10 | 002,644,198 | ---- | C] () -- C:\Users\mischa\Finnland 2011 2011-02-11 012.JPG
[2011.11.22 19:22:05 | 002,952,465 | ---- | C] () -- C:\Users\mischa\Finnland 2011 2011-02-10 017.JPG
[2011.11.22 19:21:13 | 002,874,154 | ---- | C] () -- C:\Users\mischa\Finnland 2011 2011-02-10 015.JPG
[2011.11.22 19:19:55 | 002,705,651 | ---- | C] () -- C:\Users\mischa\Finnland 2011 2011-02-10 003.JPG
[2011.11.22 19:18:38 | 002,601,578 | ---- | C] () -- C:\Users\mischa\Finnland 2011 2011-02-06 031.JPG
[2011.11.22 19:17:43 | 002,566,700 | ---- | C] () -- C:\Users\mischa\Finnland 2011 2011-02-06 003.JPG
[2011.11.22 19:16:21 | 002,951,612 | ---- | C] () -- C:\Users\mischa\Finnland 2011 2011-02-03 018.JPG
[2011.10.09 11:33:33 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe
[2011.10.06 16:23:06 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
========== ZeroAccess Check ==========
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"ThreadingModel" = Both
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2012.08.30 12:35:04 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\Diwii
[2013.02.08 09:33:26 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\Dropbox
[2012.08.27 19:32:50 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\Fuushe
[2012.12.06 15:24:36 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\JDownloaderDownloadManagerPackages
[2011.11.02 19:07:00 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\OpenOffice.org
[2012.08.30 12:37:59 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\Saiwy
[2012.03.17 09:25:34 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\TeamViewer
[2012.07.26 08:05:12 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\Thunderbird
[2013.02.09 23:51:46 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\Wise Care 365
========== Purity Check ==========
< End of report >
--- --- ---
Hey,
das ist ja mehr als sch....ich hoffe es besteht keine unmittelbare Gefahr für meine Daten.Mein Umgang war wohl etwas leichtfertig......
Aus meiner Sicht läuft der Rechner gut aber ich bin Laie und SpyHunter4 ist noch da..
Zwischendurch auch schon mal mein Dank an dich !
All processes killed
========== OTL ==========
C:\Users\mischa\AppData\Roaming\13001.009\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.009 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.011\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.011 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.012\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.012 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.013\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.013 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.014\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.014 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.015\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.015 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.016\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.016 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.017\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.017 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.018\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.018 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.019\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.019 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.020\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.020 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.021\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.021 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.022\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.022 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.023\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.023 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.024\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.024 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.025\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.025 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.026\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.026 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.027\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.027 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.028\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13001.028 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13002\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13002 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13003\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13003 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13004\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13004 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13005\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13005 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13006\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13006 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13007\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13007 folder moved successfully.
C:\Users\mischa\AppData\Roaming\13008\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\13008 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.002\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.002 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.003\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.003 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.004\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.004 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.005\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.005 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.006\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.006 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.007\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.007 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.008\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.008 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.009\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.009 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.010\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.010 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.011\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.011 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.012\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.012 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.013\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.013 folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.014\components folder moved successfully.
C:\Users\mischa\AppData\Roaming\14001.014 folder moved successfully.
C:\Users\mischa\AppData\Roaming\kock folder moved successfully.
C:\Users\mischa\AppData\Roaming\UAs folder moved successfully.
C:\Users\mischa\AppData\Roaming\Wuatly folder moved successfully.
C:\Users\mischa\AppData\Roaming\xmldm folder moved successfully.
C:\Users\mischa\AppData\Roaming\urhtps.dat moved successfully.
C:\Users\mischa\AppData\Roaming\Ykyqv folder moved successfully.
C:\Users\mischa\AppData\Roaming\Yvar folder moved successfully.
ADS C:\ProgramData\TEMP:373E1720 deleted successfully.
C:\Users\mischa\AppData\Roaming\blckdom.res moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: mischa
->Temp folder emptied: 3024 bytes
->Temporary Internet Files folder emptied: 3949654 bytes
->Java cache emptied: 1364735 bytes
->FireFox cache emptied: 80463285 bytes
->Google Chrome cache emptied: 115930941 bytes
->Flash cache emptied: 616 bytes
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 3613801 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 196,00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 02092013_232300
Files\Folders moved on Reboot...
C:\Users\mischa\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Malwarebytes Anti-Rootkit BETA 1.01.0.1020
Malwarebytes : Free anti-malware download
Database version: v2013.02.04.09
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
mischa :: MISCHA-PC [administrator]
09.02.2013 23:47:20
mbar-log-2013-02-09 (23-47-20).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 28625
Time elapsed: 13 minute(s), 28 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 2
HKCU\SOFTWARE\CLASSES\linkrdr.AIEbho (Trojan.Banker) -> Delete on reboot.
HKCU\SOFTWARE\CLASSES\linkrdr.AIEbho.1 (Trojan.Banker) -> Delete on reboot.
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 1
c:\Users\mischa\Downloads\triggerfinger__all_this_dancin_around_2012_id3637671id.exe (PUP.Adware.MediaGet) -> Delete on reboot.
(end)
Malwarebytes Anti-Rootkit BETA 1.01.0.1020
Malwarebytes : Free anti-malware download
Database version: v2013.02.09.07
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
mischa :: MISCHA-PC [administrator]
10.02.2013 00:13:05
mbar-log-2013-02-10 (00-13-05).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 28588
Time elapsed: 19 minute(s), 44 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
2013/02/10 00:17:59 +0100 MISCHA-PC mischa MESSAGE Stopping IP protection
2013/02/10 00:18:00 +0100 MISCHA-PC mischa MESSAGE IP Protection stopped successfully
2013/02/10 00:18:10 +0100 MISCHA-PC mischa MESSAGE Protection stopped
2013/02/10 00:18:21 +0100 MISCHA-PC mischa MESSAGE Starting protection
2013/02/10 00:18:21 +0100 MISCHA-PC mischa MESSAGE Protection started successfully
2013/02/10 00:18:21 +0100 MISCHA-PC mischa MESSAGE Starting IP protection
2013/02/10 00:18:24 +0100 MISCHA-PC mischa MESSAGE IP Protection started successfully
2013/02/10 00:18:37 +0100 MISCHA-PC mischa MESSAGE Starting database refresh
2013/02/10 00:18:37 +0100 MISCHA-PC mischa MESSAGE Stopping IP protection
2013/02/10 00:18:37 +0100 MISCHA-PC mischa MESSAGE IP Protection stopped successfully
2013/02/10 00:18:40 +0100 MISCHA-PC mischa MESSAGE Database refreshed successfully
2013/02/10 00:18:40 +0100 MISCHA-PC mischa MESSAGE Starting IP protection
2013/02/10 00:18:45 +0100 MISCHA-PC mischa MESSAGE IP Protection started successfully
2013/02/10 00:23:43 +0100 MISCHA-PC mischa MESSAGE Stopping protection
2013/02/10 00:23:43 +0100 MISCHA-PC mischa MESSAGE Protection stopped successfully
2013/02/10 00:23:43 +0100 MISCHA-PC mischa MESSAGE Stopping IP protection
2013/02/10 00:23:43 +0100 MISCHA-PC mischa MESSAGE IP Protection stopped successfully
2013/02/10 00:23:43 +0100 MISCHA-PC mischa MESSAGE Protection stopped
C:\Qoobox\Quarantine\C\Windows\Installer\{b9108c6b-a523-9cc9-f8d0-5a2152aedf5a}\U\00000004.@.vir Win64/Conedex.C trojan
C:\Users\mischa\Documents\Mischa Windows Old\AppData\Local\Temp\Low\Recycle.Bi\12A5481B0BFE8C4 Win32/Spy.SpyEye.CFG.A trojan
C:\_OTL\MovedFiles\02092013_232300\C_Users\mischa\AppData\Roaming\14001.014\components\AcroFF014.dll a variant of Win32/Spy.Banker.YIL trojanOTL Logfile:
Code:
OTL logfile created on: 10.02.2013 08:38:55 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\mischa\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,99 Gb Total Physical Memory | 2,32 Gb Available Physical Memory | 58,26% Memory free
7,98 Gb Paging File | 6,07 Gb Available in Paging File | 76,05% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 424,66 Gb Total Space | 230,92 Gb Free Space | 54,38% Space Free | Partition Type: NTFS
Computer Name: MISCHA-PC | User Name: mischa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013.02.08 13:40:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\mischa\Downloads\OTL.exe
PRC - [2013.01.26 03:35:08 | 001,248,208 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2012.08.08 19:42:30 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.09 07:31:28 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.09 07:31:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
========== Modules (No Company Name) ==========
MOD - [2013.02.05 18:33:37 | 012,459,888 | ---- | M] () -- C:\Users\mischa\AppData\Local\Google\Chrome\User Data\PepperFlash\11.5.31.139\pepflashplayer.dll
MOD - [2013.01.26 03:35:06 | 000,460,240 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll
MOD - [2013.01.26 03:35:04 | 004,012,496 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\pdf.dll
MOD - [2013.01.26 03:34:19 | 000,597,968 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\libglesv2.dll
MOD - [2013.01.26 03:34:18 | 000,124,368 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\libegl.dll
MOD - [2013.01.26 03:34:16 | 001,552,848 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\ffmpegsumo.dll
========== Services (SafeList) ==========
SRV:64bit: - [2009.08.18 01:36:20 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.11.09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.10.26 19:15:26 | 000,234,776 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.313\McCHSvc.exe -- (McComponentHostService)
SRV - [2012.08.25 02:59:11 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.17 15:25:28 | 000,580,648 | ---- | M] (WiseCleaner.com) [Auto | Stopped] -- C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe -- (WiseBootAssistant)
SRV - [2012.07.17 15:14:44 | 002,292,480 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2012.05.09 07:31:28 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.09 07:31:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2012.12.14 16:49:28 | 000,024,176 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.09.12 15:20:04 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2012.05.09 07:31:28 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.09 07:31:28 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.10.11 14:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.01.19 16:55:34 | 001,088,544 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192se.sys -- (rtl8192se)
DRV:64bit: - [2010.01.10 17:49:30 | 000,291,328 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.08.18 02:48:48 | 006,037,504 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2011.03.02 17:17:20 | 000,013,088 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Google
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 61 0E 7E 74 5D 8B CC 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://findgala.com/?&uid=5762&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/ncr"
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.313\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Users\mischa\AppData\Local\Mozilla Firefox\components [2012.08.30 13:17:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0\extensions\\Components: C:\Users\mischa\AppData\Local\Mozilla Thunderbird\components [2013.01.11 08:53:55 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}: C:\Users\mischa\AppData\Roaming\14001.014
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0\extensions\\Components: C:\Users\mischa\AppData\Local\Mozilla Thunderbird\components [2013.01.11 08:53:55 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Users\mischa\AppData\Local\Mozilla Thunderbird\components [2013.01.11 08:53:55 | 000,000,000 | ---D | M]
[2011.10.15 19:02:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mischa\AppData\Roaming\mozilla\Extensions
[2012.12.28 12:01:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mischa\AppData\Roaming\mozilla\Firefox\Profiles\gfnwj2jv.default\extensions
[2012.12.09 09:30:58 | 000,003,576 | ---- | M] () -- C:\Users\mischa\AppData\Roaming\mozilla\firefox\profiles\gfnwj2jv.default\searchplugins\Google.xml
========== Chrome ==========
CHR - homepage:
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage:
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - Extension: Google Drive = C:\Users\mischa\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\mischa\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\mischa\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Mail = C:\Users\mischa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Google Drive = C:\Users\mischa\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\mischa\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\mischa\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Mail = C:\Users\mischa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2013.02.09 16:57:54 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.313\McAfeeMSS_IE.dll (McAfee, Inc.)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [Z1] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 221
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {01E54593-BE14-4D6B-9310-37C0145EFE42} file:///E:/CDVIEWER11/CdViewer.cab (AMI DicomDir TreeView Control 1.1)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {FC11A119-C2F7-46F4-9E32-937ABA26816E} file:///E:/CDVIEWER21/CdViewer.cab (AMI DicomDir TreeView Control 2.1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AE1F19A2-A837-4E6C-A936-CE1FFB84DB86}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2013.02.10 00:24:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2013.02.10 00:23:02 | 002,347,384 | ---- | C] (ESET) -- C:\Users\mischa\Desktop\esetsmartinstaller_enu.exe
[2013.02.10 00:16:09 | 010,156,344 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\mischa\Desktop\mbam-setup-1.70.0.1100 (1).exe
[2013.02.09 23:32:39 | 006,292,552 | ---- | C] (Nokia Corporation and/or its subsidiary(-ies)) -- C:\Users\mischa\Desktop\QtGui4.dll
[2013.02.09 23:32:39 | 002,169,416 | ---- | C] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\mbamnet.dll
[2013.02.09 23:32:39 | 002,030,664 | ---- | C] (Nokia Corporation and/or its subsidiary(-ies)) -- C:\Users\mischa\Desktop\QtCore4.dll
[2013.02.09 23:32:39 | 001,363,528 | ---- | C] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\mbar.exe
[2013.02.09 23:32:39 | 001,093,192 | ---- | C] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\mbamcore.dll
[2013.02.09 23:32:39 | 000,748,616 | ---- | C] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\fixdamage.exe
[2013.02.09 23:32:39 | 000,500,296 | ---- | C] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\mbam.dll
[2013.02.09 23:32:39 | 000,000,000 | ---D | C] -- C:\Users\mischa\Desktop\Languages
[2013.02.09 23:32:39 | 000,000,000 | ---D | C] -- C:\Users\mischa\Desktop\imageformats
[2013.02.09 23:32:38 | 000,000,000 | ---D | C] -- C:\Users\mischa\Desktop\Data
[2013.02.09 23:23:00 | 000,000,000 | ---D | C] -- C:\_OTL
[2013.02.09 17:30:10 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.02.09 16:45:56 | 005,030,592 | R--- | C] (Swearware) -- C:\Users\mischa\Desktop\ComboFix.exe
[2013.02.09 01:28:38 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.02.09 01:28:38 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.02.09 01:28:38 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.02.09 01:26:45 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.02.09 01:26:24 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.02.08 10:19:23 | 000,000,000 | ---D | C] -- C:\Users\mischa\AppData\Roaming\Malwarebytes
[2013.02.08 10:19:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.02.08 10:19:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.02.08 10:19:17 | 000,024,176 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.02.08 10:19:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.02.08 10:18:59 | 000,000,000 | ---D | C] -- C:\Users\mischa\AppData\Local\Programs
[2013.02.08 09:40:52 | 000,000,000 | ---D | C] -- C:\Users\mischa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
[2013.02.08 09:25:59 | 000,000,000 | ---D | C] -- C:\Users\mischa\AppData\Roaming\Wise Care 365
[2013.02.08 09:25:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365
[2013.02.08 09:25:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Wise
[2013.02.03 15:11:40 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2013.02.03 13:03:24 | 000,000,000 | ---D | C] -- C:\Windows\de
[2013.02.03 13:00:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live
[2013.02.03 12:57:00 | 000,000,000 | ---D | C] -- C:\Users\mischa\AppData\Local\Windows Live
[2013.02.01 17:28:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2013.01.11 08:53:54 | 000,000,000 | ---D | C] -- C:\Users\mischa\AppData\Local\Mozilla Thunderbird
========== Files - Modified Within 30 Days ==========
File not found -- C:\Windows\SysNative\
[2013.02.10 08:34:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.02.10 00:23:50 | 000,000,424 | ---- | M] () -- C:\Windows\tasks\Wise Care 365.job
[2013.02.10 00:23:05 | 002,347,384 | ---- | M] (ESET) -- C:\Users\mischa\Desktop\esetsmartinstaller_enu.exe
[2013.02.10 00:18:14 | 000,001,117 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.02.10 00:16:20 | 010,156,344 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\mischa\Desktop\mbam-setup-1.70.0.1100 (1).exe
[2013.02.09 23:57:51 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.09 23:57:51 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.09 23:49:47 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.02.09 23:49:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.09 23:49:22 | 3212,230,656 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.09 23:31:12 | 013,711,621 | ---- | M] () -- C:\Users\mischa\Desktop\mbar-1.01.0.1020.zip
[2013.02.09 16:57:54 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.02.09 16:46:06 | 005,030,592 | R--- | M] (Swearware) -- C:\Users\mischa\Desktop\ComboFix.exe
[2013.02.09 09:19:57 | 000,001,501 | ---- | M] () -- C:\Users\mischa\Desktop\adwcleaner - Verknüpfung.lnk
[2013.02.08 13:41:16 | 000,001,428 | ---- | M] () -- C:\Users\mischa\Desktop\OTL - Verknüpfung.lnk
[2013.02.08 13:34:50 | 000,000,759 | ---- | M] () -- C:\Users\mischa\Desktop\gmer.tex - Verknüpfung.lnk
[2013.02.08 13:26:28 | 000,001,166 | ---- | M] () -- C:\Users\mischa\Desktop\hhhmt89c - Verknüpfung.lnk
[2013.02.08 13:10:28 | 000,001,483 | ---- | M] () -- C:\Users\mischa\Desktop\v8hexwbw - Verknüpfung.lnk
[2013.02.08 13:08:34 | 000,000,000 | ---- | M] () -- C:\Users\mischa\defogger_reenable
[2013.02.08 09:40:53 | 000,002,264 | ---- | M] () -- C:\Users\mischa\Desktop\SpyHunter.lnk
[2013.02.08 09:25:46 | 000,001,164 | ---- | M] () -- C:\Users\Public\Desktop\Wise Care 365.lnk
[2013.02.05 22:38:03 | 000,138,254 | ---- | M] () -- C:\Users\mischa\Documents\Mein FilmFinnland 2011.wlmp
[2013.02.05 14:50:22 | 006,292,552 | ---- | M] (Nokia Corporation and/or its subsidiary(-ies)) -- C:\Users\mischa\Desktop\QtGui4.dll
[2013.02.05 14:50:22 | 002,169,416 | ---- | M] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\mbamnet.dll
[2013.02.05 14:50:22 | 002,030,664 | ---- | M] (Nokia Corporation and/or its subsidiary(-ies)) -- C:\Users\mischa\Desktop\QtCore4.dll
[2013.02.05 14:50:22 | 001,093,192 | ---- | M] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\mbamcore.dll
[2013.02.05 14:50:21 | 000,500,296 | ---- | M] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\mbam.dll
[2013.02.05 14:50:19 | 001,363,528 | ---- | M] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\mbar.exe
[2013.02.05 14:50:19 | 000,748,616 | ---- | M] (Malwarebytes Corporation) -- C:\Users\mischa\Desktop\fixdamage.exe
[2013.02.04 12:22:10 | 000,001,923 | ---- | M] () -- C:\Users\mischa\Documents\Mein Film.wlmp
[2013.02.01 17:28:30 | 000,002,050 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013.02.01 09:23:59 | 000,014,284 | ---- | M] () -- C:\Users\mischa\Documents\Stunden 2012 - Kopie.odt
[2013.02.01 09:18:40 | 000,013,066 | ---- | M] () -- C:\Users\mischa\Documents\Stunden 2011 - Kopie.odt
[2013.02.01 08:58:48 | 000,013,098 | ---- | M] () -- C:\Users\mischa\Documents\Stunden 2010 - Kopie.odt
[2013.01.30 08:58:00 | 000,001,025 | ---- | M] () -- C:\Users\mischa\Desktop\Dropbox.lnk
[2013.01.18 16:00:38 | 000,020,253 | ---- | M] () -- C:\Users\mischa\Documents\Placke Hoch.odt
[2013.01.12 00:58:09 | 000,002,263 | ---- | M] () -- C:\Users\mischa\Desktop\Google Chrome.lnk
========== Files Created - No Company Name ==========
File not found -- C:\Windows\SysNative\
[2013.02.09 23:32:40 | 000,540,917 | ---- | C] () -- C:\Users\mischa\Desktop\ReadMe.rtf
[2013.02.09 23:32:39 | 000,067,432 | ---- | C] () -- C:\Users\mischa\Desktop\License.rtf
[2013.02.09 23:30:52 | 013,711,621 | ---- | C] () -- C:\Users\mischa\Desktop\mbar-1.01.0.1020.zip
[2013.02.09 09:19:57 | 000,001,501 | ---- | C] () -- C:\Users\mischa\Desktop\adwcleaner - Verknüpfung.lnk
[2013.02.09 01:28:38 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.02.09 01:28:38 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.02.09 01:28:38 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.02.09 01:28:38 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.02.09 01:28:38 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.02.08 13:41:16 | 000,001,428 | ---- | C] () -- C:\Users\mischa\Desktop\OTL - Verknüpfung.lnk
[2013.02.08 13:34:50 | 000,000,759 | ---- | C] () -- C:\Users\mischa\Desktop\gmer.tex - Verknüpfung.lnk
[2013.02.08 13:26:28 | 000,001,166 | ---- | C] () -- C:\Users\mischa\Desktop\hhhmt89c - Verknüpfung.lnk
[2013.02.08 13:10:28 | 000,001,483 | ---- | C] () -- C:\Users\mischa\Desktop\v8hexwbw - Verknüpfung.lnk
[2013.02.08 13:08:34 | 000,000,000 | ---- | C] () -- C:\Users\mischa\defogger_reenable
[2013.02.08 10:19:19 | 000,001,117 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.02.08 09:40:53 | 000,002,264 | ---- | C] () -- C:\Users\mischa\Desktop\SpyHunter.lnk
[2013.02.08 09:26:22 | 000,000,424 | ---- | C] () -- C:\Windows\tasks\Wise Care 365.job
[2013.02.08 09:25:46 | 000,001,164 | ---- | C] () -- C:\Users\Public\Desktop\Wise Care 365.lnk
[2013.02.04 12:22:10 | 000,001,923 | ---- | C] () -- C:\Users\mischa\Documents\Mein Film.wlmp
[2013.02.03 17:47:59 | 000,138,254 | ---- | C] () -- C:\Users\mischa\Documents\Mein FilmFinnland 2011.wlmp
[2013.02.03 13:03:01 | 000,001,309 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
[2013.02.03 13:02:53 | 000,001,378 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
[2013.02.03 13:02:35 | 000,001,462 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
[2013.02.03 13:02:24 | 000,002,490 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2013.01.18 15:49:27 | 000,020,253 | ---- | C] () -- C:\Users\mischa\Documents\Placke Hoch.odt
[2012.01.15 09:54:05 | 000,000,080 | ---- | C] () -- C:\Windows\wiso.ini
[2011.11.22 19:23:46 | 003,008,021 | ---- | C] () -- C:\Users\mischa\Finnland 2011 2011-02-11 016.JPG
[2011.11.22 19:23:10 | 002,644,198 | ---- | C] () -- C:\Users\mischa\Finnland 2011 2011-02-11 012.JPG
[2011.11.22 19:22:05 | 002,952,465 | ---- | C] () -- C:\Users\mischa\Finnland 2011 2011-02-10 017.JPG
[2011.11.22 19:21:13 | 002,874,154 | ---- | C] () -- C:\Users\mischa\Finnland 2011 2011-02-10 015.JPG
[2011.11.22 19:19:55 | 002,705,651 | ---- | C] () -- C:\Users\mischa\Finnland 2011 2011-02-10 003.JPG
[2011.11.22 19:18:38 | 002,601,578 | ---- | C] () -- C:\Users\mischa\Finnland 2011 2011-02-06 031.JPG
[2011.11.22 19:17:43 | 002,566,700 | ---- | C] () -- C:\Users\mischa\Finnland 2011 2011-02-06 003.JPG
[2011.11.22 19:16:21 | 002,951,612 | ---- | C] () -- C:\Users\mischa\Finnland 2011 2011-02-03 018.JPG
[2011.10.09 11:33:33 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe
[2011.10.06 16:23:06 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
========== ZeroAccess Check ==========
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"ThreadingModel" = Both
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2012.08.30 12:35:04 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\Diwii
[2013.02.08 09:33:26 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\Dropbox
[2012.08.27 19:32:50 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\Fuushe
[2012.12.06 15:24:36 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\JDownloaderDownloadManagerPackages
[2011.11.02 19:07:00 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\OpenOffice.org
[2012.08.30 12:37:59 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\Saiwy
[2012.03.17 09:25:34 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\TeamViewer
[2012.07.26 08:05:12 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\Thunderbird
[2013.02.09 23:51:46 | 000,000,000 | ---D | M] -- C:\Users\mischa\AppData\Roaming\Wise Care 365
========== Purity Check ==========
< End of report >
--- --- ---
Hinweise zum Ablauf