Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   SystemTool 2011 - und nun? (https://www.trojaner-board.de/94619-systemtool-2011-a.html)

supidupi 09.01.2011 18:26
SystemTool 2011 - und nun?
 
Hallo,

ich bin schon ganz verzweifelt. Mein Sohn kam heute aus den USA zurück und erzählte mir, an dem PC seines Vaters war so ein komischer Virus und nichts ging mehr.
Dann dauerte es 1 Stunde, und er kam zu mir - mit seinem Lappi - und zeigte mir, "genau so sah es bei Papa auch aus". Nichts ging mehr.

Ich habe dann mit meinem PC recherchiert und gefunden, dass es sich um Malware handelt. Verschiedene Freeware Programme habe ich probiert - aber keiner erkennt es. Wenn es einer erkennt - muss man das Programm kaufen. Ein Schlem, wer sich dabei denkt, dass die beiden Firmen zusammenarbeiten:rolleyes:.

Die manuelle Entfernung, wie sie oft im Web erwähnt wird, traue ich mir nicht zu. Ich bin noch im abgesicherten Modus.

Er vermutet übrigens, dass auf dem Chip aus der Kamera seines Vaters etwas drauf gewesen sein muss - denn er hatte hier noch nichts installiert oder so - nur den Chip in den Slot gesteckt, wie bei seinem Vater auch.

Kann mir jemand sagen, was ich genau machen muss, um den Mist wieder runterzubekommen?

Danke.

markusg 09.01.2011 18:50
du bist im abgesicherten modus? bleib gleich dort.
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
beide posten.

supidupi 09.01.2011 19:24
OK, gemacht. Also:

OTL.TxTOTL Logfile:
Code:
OTL logfile created on: 09.01.2011 19:10:51 - Run 1
OTL by OldTimer - Version 3.2.20.1    Folder = C:\Users\Brandon\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 82,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 95,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 192,06 Gb Total Space | 154,81 Gb Free Space | 80,61% Space Free | Partition Type: NTFS
Drive D: | 97,03 Gb Total Space | 44,98 Gb Free Space | 46,36% Space Free | Partition Type: NTFS
 
Computer Name: BRANDON-PC | User Name: Brandon | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Brandon\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Brandon\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (sp_rssrv) -- C:\Program Files\Spyware Terminator\sp_rsser.exe (Crawler.com)
SRV - (AVKService) -- C:\Program Files\G Data\AntiVirus\AVK\AVKService.exe (G Data Software AG)
SRV - (AVKProxy) -- C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG)
SRV - (AVKWCtl) -- C:\Program Files\G Data\AntiVirus\AVK\AVKWCtl.exe ()
SRV - (GDScan) -- C:\Program Files\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (TestHandler) -- C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WisLMSvc) -- C:\Program Files\Launch Manager\WisLMSvc.exe (Wistron Corp.)
SRV - (GoogleDesktopManager-022208-143751) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (FSCLBaseUpdaterService) -- C:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (GRD) -- C:\Windows\System32\drivers\GRD.sys (G Data Software)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (ahcix86s) -- C:\Windows\system32\drivers\ahcix86s.sys (AMD Technologies Inc.)
DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)
DRV - (JMCR) -- C:\Windows\System32\drivers\jmcr.sys (JMicron Technology Corp.)
DRV - (JRAID) -- C:\Windows\system32\drivers\jraid.sys (JMicron Technology Corp.)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (GDMnIcpt) -- C:\Windows\System32\drivers\MiniIcpt.sys (G Data Software AG)
DRV - (HookCentre) -- C:\Windows\System32\drivers\HookCentre.sys (G Data Software AG)
DRV - (GDBehave) -- C:\Windows\system32\drivers\GDBehave.sys (G Data Software AG)
DRV - (gdwfpcd) -- C:\Windows\System32\drivers\gdwfpcd32.sys (G DATA Software AG)
DRV - (iaStor) -- C:\Windows\system32\drivers\iastor.sys (Intel Corporation)
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (Hotkey) -- C:\Windows\System32\drivers\HOTKEY.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
 
 
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
IE - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2008.01.12 20:05:09 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2008.01.12 21:13:26 | 000,000,000 | ---D | M]
 
[2008.01.12 20:05:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Brandon\AppData\Roaming\mozilla\Extensions
[2008.01.12 20:05:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Brandon\AppData\Roaming\mozilla\Firefox\Profiles\wb3p44e5.default\extensions
[2011.01.09 10:54:43 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.01.09 10:54:43 | 000,000,000 | ---D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011.01.09 10:54:43 | 000,000,000 | ---D | M] (Skype extension) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{AB2CE124-6272-4B12-94A9-7303C7397BD1}
[2010.12.03 19:14:08 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.12.03 19:14:08 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.12.03 19:14:08 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.12.03 19:14:08 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.12.03 19:14:08 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Programme\G Data\AntiVirus\Webfilter\AvkWebIE.dll (G Data Software AG)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Programme\G Data\AntiVirus\Webfilter\AvkWebIE.dll (G Data Software AG)
O4 - HKLM..\Run: [FSCRecovery] c:\Programme\Fujitsu Siemens Computers\Fujitsu Siemens Computers Recovery\FSCRecoveryReminder.exe (Fujitsu Siemens Computers GmbH)
O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Programme\G Data\AntiVirus\AVKTray\AVKTray.exe (G Data Software AG)
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [Google EULA Launcher] c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe ( )
O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe ()
O4 - HKLM..\Run: [LMgrVolOSD] C:\Program Files\Launch Manager\OSD.exe (Wistron Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SynTPStart] C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WisKeyState] C:\Program Files\Launch Manager\WisKeyState.exe (Wistron Corp.)
O4 - HKU\.DEFAULT..\Run: [fsc-reg] c:\fsc-reg\fscreg.exe File not found
O4 - HKU\.DEFAULT..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.)
O4 - HKU\S-1-5-18..\Run: [fsc-reg] c:\fsc-reg\fscreg.exe File not found
O4 - HKU\S-1-5-18..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.)
O4 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000..\Run: [SpywareTerminatorUpdate] C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
O4 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000..\RunOnce: [eFjBp01804] C:\ProgramData\eFjBp01804\eFjBp01804.exe ()
O7 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000\..Trusted Ranges: GD ([http] in Local intranet)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Brandon\Pictures\Fledermaus.jpg
O24 - Desktop BackupWallPaper: C:\Users\Brandon\Pictures\Fledermaus.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger -  File not found
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
%SYSTEMROOT%\SYSTEM32\*.DLL /LOCKEDFILES CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.01.09 17:44:38 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\Spyware Terminator
[2011.01.09 17:44:34 | 000,000,000 | ---D | C] -- C:\Programme\Spyware Terminator
[2011.01.09 17:44:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Spyware Terminator
[2011.01.09 17:44:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Terminator
[2011.01.09 17:29:15 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2011.01.09 16:46:39 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsSearch
[2011.01.09 16:38:50 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tool
[2011.01.09 16:29:19 | 000,000,000 | ---D | C] -- C:\ProgramData\eFjBp01804
[2011.01.09 15:58:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment
[2011.01.09 15:45:24 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Blizzard Entertainment
[2011.01.09 10:56:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2011.01.09 10:56:03 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\skypePM
[2011.01.09 10:54:17 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Skype
[2011.01.09 10:54:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.01.09 10:54:16 | 000,000,000 | R--D | C] -- C:\Programme\Skype
[2011.01.09 10:54:15 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\Skype
[2011.01.09 10:54:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2011.01.09 09:14:36 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
[2011.01.09 09:09:04 | 000,000,000 | ---D | C] -- C:\Programme\Windows Portable Devices
[2010.12.26 18:13:51 | 000,092,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAnimation.dll
[2010.12.26 18:13:50 | 003,023,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIRibbon.dll
[2010.12.26 18:13:50 | 001,164,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIRibbonRes.dll
[2010.12.26 18:12:33 | 000,829,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2010.12.26 18:12:33 | 000,369,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMPhoto.dll
[2010.12.26 18:12:33 | 000,037,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2010.12.26 18:12:33 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll
[2010.12.26 18:12:32 | 001,554,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xpsservices.dll
[2010.12.26 18:12:32 | 001,064,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2010.12.26 18:12:32 | 001,030,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll
[2010.12.26 18:12:32 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecs.dll
[2010.12.26 18:12:32 | 000,847,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\OpcServices.dll
[2010.12.26 18:12:32 | 000,828,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2010.12.26 18:12:32 | 000,793,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FntCache.dll
[2010.12.26 18:12:32 | 000,667,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe
[2010.12.26 18:12:32 | 000,519,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d11.dll
[2010.12.26 18:12:32 | 000,486,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2010.12.26 18:12:32 | 000,481,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxgi.dll
[2010.12.26 18:12:32 | 000,351,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2010.12.26 18:12:32 | 000,321,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PhotoMetadataHandler.dll
[2010.12.26 18:12:32 | 000,280,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2010.12.26 18:12:32 | 000,252,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxdiag.exe
[2010.12.26 18:12:32 | 000,218,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2010.12.26 18:12:32 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxdiagn.dll
[2010.12.26 18:12:32 | 000,190,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll
[2010.12.26 18:12:32 | 000,189,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecsExt.dll
[2010.12.26 18:12:32 | 000,161,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2010.12.26 18:12:32 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll
[2010.12.26 18:11:24 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\BthMtpContextHandler.dll
[2010.12.26 18:11:24 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDShextAutoplay.exe
[2010.12.26 18:11:23 | 000,060,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceConnectApi.dll
[2010.12.26 18:11:22 | 000,546,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wpd_ci.dll
[2010.12.26 18:11:22 | 000,334,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceApi.dll
[2010.12.26 18:11:22 | 000,160,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceTypes.dll
[2010.12.26 18:11:22 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceClassExtension.dll
[2010.12.26 18:11:21 | 000,350,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDSp.dll
[2010.12.26 18:11:21 | 000,196,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceWMDRM.dll
[2010.12.26 18:09:11 | 000,555,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAutomationCore.dll
[2010.12.26 18:09:11 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oleaccrc.dll
[2010.12.26 17:50:09 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe
[2010.12.26 17:50:09 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll
[2010.12.26 17:50:09 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll
[2010.12.26 17:48:38 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe
[2010.12.26 17:30:46 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\nshhttp.dll
[2010.12.26 17:30:45 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\httpapi.dll
[2010.12.26 17:29:33 | 000,000,000 | ---D | C] -- C:\Programme\MSXML 4.0
[2010.12.26 16:22:57 | 008,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL
[2010.12.26 16:22:34 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netiohlp.dll
[2010.12.26 16:22:33 | 000,027,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NETSTAT.EXE
[2010.12.26 16:22:33 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ARP.EXE
[2010.12.26 16:22:33 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ROUTE.EXE
[2010.12.26 16:22:33 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netevent.dll
[2010.12.26 16:22:33 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MRINFO.EXE
[2010.12.26 16:22:33 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\finger.exe
[2010.12.26 16:22:33 | 000,008,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\HOSTNAME.EXE
[2010.12.26 16:22:20 | 000,302,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlansec.dll
[2010.12.26 16:22:20 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanmsm.dll
[2010.12.26 16:22:20 | 000,127,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\L2SecHC.dll
[2010.12.26 16:22:19 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanapi.dll
[2010.12.26 16:22:11 | 000,081,920 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll
[2010.12.26 16:22:06 | 002,386,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVCORE.DLL
[2010.12.26 16:22:05 | 002,868,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll
[2010.12.26 16:22:04 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll
[2010.12.26 16:22:03 | 000,430,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2010.12.26 16:21:48 | 002,038,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010.12.26 16:21:45 | 000,157,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll
[2010.12.26 16:21:39 | 000,714,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\timedate.cpl
[2010.12.26 16:21:36 | 001,696,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gameux.dll
[2010.12.26 16:21:34 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll
[2010.12.26 16:21:34 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll
[2010.12.26 16:21:32 | 000,317,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MP4SDECD.DLL
[2010.12.26 16:21:31 | 000,623,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\localspl.dll
[2010.12.26 16:21:29 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll
[2010.12.26 16:21:29 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll
[2010.12.26 16:21:27 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rtutils.dll
[2010.12.26 16:21:16 | 001,259,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\lsasrv.dll
[2010.12.26 16:21:12 | 003,600,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2010.12.26 16:21:12 | 003,548,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2010.12.26 16:21:10 | 000,867,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll
[2010.12.26 16:21:09 | 000,220,672 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codecp.acm
[2010.12.26 16:21:09 | 000,062,464 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm
[2010.12.26 16:21:06 | 000,512,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2010.12.26 16:21:01 | 000,352,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll
[2010.12.26 16:21:00 | 000,345,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll
[2010.12.26 16:20:59 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll
[2010.12.26 16:20:57 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2010.12.26 16:20:55 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2010.12.26 16:20:55 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
[2010.12.26 16:20:55 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2010.12.26 16:20:55 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dciman32.dll
[2010.12.26 16:20:52 | 002,452,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2010.12.26 16:20:48 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2010.12.26 16:20:48 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2010.12.26 16:20:47 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2010.12.26 16:20:47 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010.12.26 16:20:47 | 000,180,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2010.12.26 16:20:47 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll
[2010.12.26 16:20:46 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2010.12.26 16:20:40 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2010.12.26 16:20:14 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdxm.tlb
[2010.12.26 16:20:14 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\amcompat.tlb
[2010.12.26 16:20:11 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_isv.dll
[2010.12.26 16:20:11 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc.dll
[2010.12.26 16:20:10 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_isv.exe
[2010.12.26 16:20:10 | 000,347,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp.exe
[2010.12.26 16:20:10 | 000,346,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp_isv.exe
[2010.12.26 16:20:09 | 000,518,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate.exe
[2010.12.26 16:20:09 | 000,332,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdrm.dll
[2010.12.26 16:20:09 | 000,152,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp_isv.dll
[2010.12.26 16:20:09 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp.dll
[2010.12.26 16:19:50 | 000,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rastls.dll
[2010.12.26 16:19:48 | 000,355,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSDApi.dll
[2010.12.26 16:19:22 | 000,231,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll
[2010.12.26 16:19:20 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2010.12.26 16:19:19 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msvfw32.dll
[2010.12.26 16:19:19 | 000,091,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\avifil32.dll
[2010.12.26 16:19:19 | 000,082,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciavi32.dll
[2010.12.26 16:19:17 | 000,604,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMSPDMOD.DLL
[2010.12.26 16:19:06 | 000,310,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\unregmp2.exe
[2010.12.26 16:19:05 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spwmp.dll
[2010.12.26 16:19:05 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdxm.ocx
[2010.12.26 16:19:05 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxmasf.dll
[2010.12.26 15:50:06 | 000,222,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2010.12.26 15:48:35 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\Macromedia
[2010.12.25 22:09:21 | 000,029,992 | ---- | C] (G Data Software) -- C:\Windows\System32\drivers\GRD.sys
[2010.12.25 21:55:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IZArc
[2010.12.25 21:54:56 | 000,000,000 | ---D | C] -- C:\Programme\IZArc
 
========== Files - Modified Within 30 Days ==========
 
[2011.01.09 19:05:43 | 000,620,966 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.01.09 19:05:43 | 000,589,472 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.01.09 19:05:43 | 000,123,268 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.01.09 19:05:43 | 000,101,484 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.01.09 18:42:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.01.09 18:40:45 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.01.09 18:40:40 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.01.09 18:40:40 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.01.09 17:44:46 | 000,000,925 | ---- | M] () -- C:\Users\Public\Desktop\Spyware Terminator.lnk
[2011.01.09 17:44:39 | 000,142,592 | ---- | M] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys
[2011.01.09 17:02:59 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.01.09 16:38:50 | 000,000,772 | ---- | M] () -- C:\Users\Brandon\Desktop\System Tool 2011.lnk
[2011.01.09 14:36:02 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2011.01.09 10:56:46 | 000,001,977 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2011.01.09 10:56:12 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat
[2011.01.09 10:54:17 | 000,001,880 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011.01.09 09:12:36 | 000,380,136 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.12.26 16:27:05 | 000,029,992 | ---- | M] (G Data Software) -- C:\Windows\System32\drivers\GRD.sys
[2010.12.25 22:08:23 | 000,002,631 | ---- | M] () -- C:\Users\Brandon\Desktop\Microsoft Office Word 2007.lnk
[2010.12.25 21:56:48 | 000,002,735 | ---- | M] () -- C:\Users\Brandon\Desktop\Microsoft Office Outlook 2007.lnk
 
========== Files Created - No Company Name ==========
 
[2011.01.09 17:44:46 | 000,000,925 | ---- | C] () -- C:\Users\Public\Desktop\Spyware Terminator.lnk
[2011.01.09 17:44:39 | 000,142,592 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys
[2011.01.09 16:38:48 | 000,000,772 | ---- | C] () -- C:\Users\Brandon\Desktop\System Tool 2011.lnk
[2011.01.09 14:36:02 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2011.01.09 10:56:46 | 000,001,977 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2011.01.09 10:56:12 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.01.09 10:55:46 | 000,001,098 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.01.09 10:55:45 | 000,001,094 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.01.09 10:54:17 | 000,001,880 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2010.12.26 16:22:19 | 002,501,921 | ---- | C] () -- C:\Windows\System32\wlan.tmf
[2008.10.22 13:02:51 | 000,009,867 | ---- | C] () -- C:\Windows\System32\drivers\HOTKEY.sys
[2008.10.22 13:01:42 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008.10.22 12:53:31 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008.04.25 14:23:38 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll
[2008.01.12 20:27:13 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2008.01.12 19:30:48 | 000,000,342 | ---- | C] () -- C:\Windows\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}_WiseFW.ini
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
 
========== LOP Check ==========
 
[2011.01.09 17:46:25 | 000,000,000 | ---D | M] -- C:\Users\Brandon\AppData\Roaming\Spyware Terminator
[2011.01.09 18:39:16 | 000,009,658 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. >
 
< %APPDATA%\*.exe /s >
[2008.01.12 19:30:53 | 000,008,704 | R--- | M] () -- C:\Users\Brandon\AppData\Roaming\Microsoft\Installer\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}\Icon9A3BC1573.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: AHCIX86S.SYS  >
[2008.05.27 12:55:54 | 000,173,576 | ---- | M] (AMD Technologies Inc.) MD5=FBE4016F9EF3AB3DB547E40A936B6CD9 -- C:\DRIVER\SATA\AMD\ahcix86s.sys
[2008.05.27 12:55:54 | 000,173,576 | ---- | M] (AMD Technologies Inc.) MD5=FBE4016F9EF3AB3DB547E40A936B6CD9 -- C:\Windows\System32\drivers\ahcix86s.sys
[2008.05.27 12:55:54 | 000,173,576 | ---- | M] (AMD Technologies Inc.) MD5=FBE4016F9EF3AB3DB547E40A936B6CD9 -- C:\Windows\System32\DriverStore\FileRepository\ahcix86s.inf_c617648e\ahcix86s.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.08.16 13:03:39 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=66A1A71D66C5235A31C16F30147E7AF6 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_181d523c\atapi.sys
[2008.08.16 13:03:39 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=66A1A71D66C5235A31C16F30147E7AF6 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22245_none_dd9b888d3ac35a04\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2007.09.29 23:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\drivers\iaStor.sys
[2007.09.29 23:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_7baf6192\iaStor.sys
[2007.09.29 23:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_41af7b1f\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.10 23:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.10 23:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.10 23:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.10 23:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll
[2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >
--- --- ---




Extras.Txt
OTL Logfile:
Code:
OTL Extras logfile created on: 09.01.2011 19:10:51 - Run 1
OTL by OldTimer - Version 3.2.20.1    Folder = C:\Users\Brandon\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 82,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 95,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 192,06 Gb Total Space | 154,81 Gb Free Space | 80,61% Space Free | Partition Type: NTFS
Drive D: | 97,03 Gb Total Space | 44,98 Gb Free Space | 46,36% Space Free | Partition Type: NTFS
 
Computer Name: BRANDON-PC | User Name: Brandon | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_USERS\S-1-5-21-4048956899-1286244931-2967521482-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{099A04C9-9840-40F7-8A67-2ABDE9D9A08E}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{3E48C035-0396-4DE6-8F0C-956A06124BFC}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe |
"{5D1602A8-F88E-44B6-9CAD-672D96FDBFE4}" = protocol=6 | dir=in | app=f:\brandon!\wow\launcher.exe |
"{7D451B0E-3D95-4F83-AFE7-48E7FB21AEC4}" = protocol=6 | dir=in | app=f:\brandon!\wow\launcher.patch.exe |
"{8A51C416-37E4-4620-A8EA-D388962C784F}" = protocol=17 | dir=in | app=f:\brandon!\wow\launcher.exe |
"{D3DBF350-7B60-4353-B56F-7B66A572CB30}" = protocol=6 | dir=in | app=c:\program files\fujitsu siemens computers\fsclounge\fscwbaseupdaterservice\2\fscwbaseupdaterservice.exe |
"{EC113663-81B6-48F6-8AE6-52D51DFDEEC1}" = protocol=17 | dir=in | app=f:\brandon!\wow\launcher.patch.exe |
"{FB55B487-F0AE-432B-968C-601E404181F5}" = protocol=17 | dir=in | app=c:\program files\fujitsu siemens computers\fsclounge\fscwbaseupdaterservice\2\fscwbaseupdaterservice.exe |
"{FF07C710-2504-4828-842E-C7042B226CCE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{8944A0F0-3A9A-40F3-9A83-8271E89E77BF}C:\program files\spyware terminator\spywareterminatorupdate.exe" = protocol=6 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
"TCP Query User{BA2F84DC-2EC3-4B8D-B0FB-A622D3809D8C}F:\brandon!\wow\blizzard downloader.exe" = protocol=6 | dir=in | app=f:\brandon!\wow\blizzard downloader.exe |
"UDP Query User{63C55140-173C-46BF-AE51-C43886711065}F:\brandon!\wow\blizzard downloader.exe" = protocol=17 | dir=in | app=f:\brandon!\wow\blizzard downloader.exe |
"UDP Query User{6C36225E-ACBE-4FAB-B84C-1EF73747061E}C:\program files\spyware terminator\spywareterminatorupdate.exe" = protocol=17 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{016F5FA1-FD85-FA69-885F-96A03EEEF9C1}" = CCC Help Dutch
"{017C6E75-766C-DE1C-1B48-D0230CB155BC}" = Catalyst Control Center Localization Korean
"{021C8270-F2A6-C941-3A19-EBE139C966E7}" = Catalyst Control Center Graphics Full Existing
"{04FC3DE9-BC19-E2A2-2FB9-24684DA82A36}" = CCC Help Spanish
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05DD3745-0898-FCA7-0A52-689F128B84F9}" = CCC Help French
"{0739951F-27F4-F7FF-C26D-3C44A681933F}" = ccc-utility
"{099F2D26-B862-F04A-FC7B-E7B0B6196CA7}" = CCC Help Chinese Standard
"{0C58BA84-88A3-39FD-61DB-4DF780D1E0B9}" = CCC Help Polish
"{0C8DFC9B-FB65-1444-3E12-9DF64270347A}" = CCC Help Korean
"{139B7164-4C7B-BF85-4CA6-0DD5C611179B}" = Catalyst Control Center Localization Turkish
"{14D68B6D-4C3E-6771-1C77-4384BB653B9E}" = Catalyst Control Center Localization Chinese Traditional
"{22E719FE-F76D-0BF3-229D-7A9337458CD0}" = CCC Help German
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller
"{26D421BE-752E-1070-0C26-2DE993ED00B0}" = CCC Help Portuguese
"{2A63E819-5359-62CF-FCDB-3707391A08A0}" = CCC Help Chinese Traditional
"{2F926AE7-9FB7-4B34-906F-9C29A6D146A7}" = SystemDiagnostics
"{31F2D65F-84A8-D3AD-E3AF-DF127860E39E}" = CCC Help Turkish
"{373C3C97-2FA9-4E18-85A2-255060C21031}" = Nero 8 Essentials
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3F026B88-D153-93DB-A99B-2A78AFEFF813}" = Catalyst Control Center Localization Polish
"{3F03121C-CA62-D0E1-7957-5C82A4CF3C69}" = Catalyst Control Center Localization Norwegian
"{45A34A3F-3597-AA37-E44B-9B95852055A9}" = CCC Help Swedish
"{4811A487-6830-E60D-CD37-816E46C8988D}" = Catalyst Control Center Localization Portuguese
"{49083280-8601-EF0D-EC78-6A8FD9C54172}" = CCC Help Thai
"{4A5DC837-AD1B-D80E-FDE5-4793DC47F695}" = CCC Help Finnish
"{4AAF1376-9CB5-B232-22EE-D0EE53ED9148}" = Catalyst Control Center Localization Danish
"{4EBE8518-B14F-B69E-082B-E6FB85F6B52E}" = CCC Help Italian
"{4F2E897D-39A4-73B7-6614-F1EC2B43A1B5}" = CCC Help Czech
"{5413DF9C-4FCC-39A1-FB67-6945428DA718}" = Catalyst Control Center Localization Russian
"{55035C7B-61D2-1DC1-EC53-CFD01C3F82F9}" = CCC Help Hungarian
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{58BAA8D0-404E-4585-9FD3-ED1BB72AC2EE}" = Adobe Flash Player 9 ActiveX
"{60DCEC40-8854-B0B5-7828-A6E14DBE71EC}" = Catalyst Control Center Graphics Previews Vista
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6DC0B476-B032-83DE-9637-3F6809A344C1}" = Skins
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{774715EC-6B2F-092E-0221-B464A80F565A}" = Catalyst Control Center Localization Italian
"{78B1919F-EFDD-5A23-7393-7887C53BE013}" = CCC Help Danish
"{7E1043B7-AA4D-A877-9A26-D1B3E78DF051}" = CCC Help Norwegian
"{81758E18-D5EA-4049-844A-E2DDDDDA9798}" = CCC Help English
"{81794E08-21DA-189A-1DD5-AEDBBE0BE37B}" = CCC Help Russian
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PROPLUSR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUSR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUSR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_PROPLUSR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_PROPLUSR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{95104E32-1B84-0E33-14BE-BA115643629C}" = Catalyst Control Center Graphics Light
"{9687697B-1055-E1E5-2D31-061CC502AB31}" = ATI Catalyst Install Manager
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1.2
"{98383302-798D-2089-9143-D64E35D666BD}" = Catalyst Control Center Localization Greek
"{9860F761-0ADB-1149-1A0D-1CBBFD693A3D}" = Catalyst Control Center Localization Finnish
"{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}" = FSCLounge
"{9D26F264-EFA2-31BB-D49F-380FD60207FA}" = Catalyst Control Center Core Implementation
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A777FF2A-942F-CBB0-C36B-F9B72E95B7D9}" = Catalyst Control Center Localization Czech
"{A7FB84F1-FA4F-4B50-9AEC-4F83AB1DFEBE}" = G Data AntiVirus 2011
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AFC454ED-A26F-4816-826B-C35129D82E1F}" = Fujitsu Siemens Computers Recovery
"{B1EEB795-48EE-AA3B-7CF9-5CE4B7883792}" = Catalyst Control Center Localization German
"{B3905755-64EC-422E-A4D9-644D6D8FDE5E}" = ccc-core-static
"{B3D068F7-34DD-2BB7-6F2F-D67274819ACC}" = Catalyst Control Center Localization Swedish
"{C698749A-7BB4-BE2A-9551-EC85C8A65E2F}" = CCC Help Greek
"{CA45B622-88F9-4836-A529-DBF14698498D}" = Catalyst Control Center - Branding
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF06DB43-2F14-EA98-AB1B-124FD65A8AEE}" = Catalyst Control Center InstallProxy
"{D0846526-66DD-4DC9-A02C-98F9A2806812}" = Launch Manager V1.5.4
"{D21E879C-8400-BEE3-23AB-9399DEF9F7D1}" = Catalyst Control Center Localization Hungarian
"{DCA2E1BC-7FB4-217C-54C6-B99D4EA7FFCF}" = Catalyst Control Center Localization Dutch
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{E7B4D6A2-D6B1-29A3-7720-C35599A8718B}" = Catalyst Control Center Localization Thai
"{EBFD0EFA-9AEF-D432-9330-717FE34FB717}" = Catalyst Control Center Localization French
"{ED3B736A-7C2E-35DB-0F33-E8C9CF101662}" = Catalyst Control Center Localization Chinese Standard
"{EECA2BE9-BB32-8E29-3293-536B600B04B4}" = Catalyst Control Center Localization Spanish
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2E272DA-CB23-936D-268E-030DE425AD11}" = Catalyst Control Center Graphics Full New
"{F87C6FBE-FBD2-CC11-FF28-AC687D08EDF0}" = CCC Help Japanese
"{FD65BBF8-5EEB-BE96-44E8-5887B035E0F6}" = Catalyst Control Center Localization Japanese
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Google Chrome" = Google Chrome
"Google Desktop" = Google Desktop
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Picasa2" = Picasa 2
"PROPLUSR" = Microsoft Office Professional Plus 2007
"Spyware Terminator_is1" = Spyware Terminator
"SynTPDeinstKey" = Synaptics Pointing Device Driver
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 12.01.2008 14:39:52 | Computer Name = Brandon-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 12.01.2008 14:41:55 | Computer Name = Brandon-PC | Source = VSS | ID = 8194
Description =
 
[ System Events ]
Error - 12.01.2008 15:03:14 | Computer Name = Brandon-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description =
 
Error - 12.01.2008 15:03:14 | Computer Name = Brandon-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =
 
Error - 12.01.2008 15:03:14 | Computer Name = Brandon-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description =
 
Error - 12.01.2008 15:13:15 | Computer Name = Brandon-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description =
 
Error - 12.01.2008 15:13:15 | Computer Name = Brandon-PC | Source = HTTP | ID = 15016
Description =
 
Error - 12.01.2008 15:28:20 | Computer Name = Brandon-PC | Source = W32Time | ID = 39452706
Description = Der Zeitdienst hat festgestellt, dass die Systemzeit um +93139235
Sekunden geändert werden muss. Die Systemzeit kann durch den Zeitdienst um maximal
 +54000 Sekunden geändert werden. Stellen Sie sicher, dass die Uhrzeit und Zeitzone
 korrekt sind und dass die Zeitquelle time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->207.46.232.182:123)
 funktionsfähig ist.
 
Error - 12.01.2008 15:50:24 | Computer Name = Brandon-PC | Source = DCOM | ID = 10010
Description =
 
Error - 12.01.2008 15:57:30 | Computer Name = Brandon-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description =
 
Error - 12.01.2008 15:58:05 | Computer Name = Brandon-PC | Source = W32Time | ID = 39452706
Description = Der Zeitdienst hat festgestellt, dass die Systemzeit um +93139234
Sekunden geändert werden muss. Die Systemzeit kann durch den Zeitdienst um maximal
 +54000 Sekunden geändert werden. Stellen Sie sicher, dass die Uhrzeit und Zeitzone
 korrekt sind und dass die Zeitquelle time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->207.46.232.182:123)
 funktionsfähig ist.
 
Error - 26.12.2010 10:37:38 | Computer Name = Brandon-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description =
 
 
< End of report >
--- --- ---



....... und nun???

markusg 09.01.2011 20:00
• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000..\RunOnce: [eFjBp01804] C:\ProgramData\eFjBp01804\eFjBp01804.exe ()
[2011.01.09 16:46:39 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsSearch
[2011.01.09 16:38:50 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming
[2011.01.09 16:29:19 | 000,000,000 | ---D | C] -- C:\ProgramData\eFjBp01804
[2011.01.09 16:38:50 | 000,000,772 | ---- | M] () -- C:\Users\Brandon\Desktop\System Tool 2011.lnk
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
öffne computer, c: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
lade das archiv in unserem upload channel hoch.
http://www.trojaner-board.de/54791-a...ner-board.html

supidupi 09.01.2011 20:07
Den Rechner dann wieder im angesicherten Modus hochfahren? sonst bekomme ich ja vielleicht keinen Zugang zum Internet.

markusg 09.01.2011 20:08
doch solltest du.
falls nicht, im abgesicherten :-)

supidupi 09.01.2011 20:19
All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-4048956899-1286244931-2967521482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\eFjBp01804 deleted successfully.
C:\ProgramData\eFjBp01804\eFjBp01804.exe moved successfully.
C:\ProgramData\WindowsSearch\MiniDumps folder moved successfully.
C:\ProgramData\WindowsSearch folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Spyware Terminator\Reports folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Spyware Terminator\LanguageAct folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Spyware Terminator folder moved successfully.
C:\Users\Brandon\AppData\Roaming\skypePM folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_httpfe folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\production folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\languages folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\images\fancybox folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\images\buttons folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\images\avatarview folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\images folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\js\languages folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\js folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\images\promotions folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\images\buttons folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\images\backgrounds folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\images folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\css folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\assets\promotions folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\assets folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_dynco folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\My Skype Received Files folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2\voicemail folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2\httpfe folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync\ff folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync\fe folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync\dc folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync\61 folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync\3e folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2 folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default\minidumps folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default\extensions folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default\chrome folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default\bookmarkbackups folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Crash Reports folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Extensions folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Word\STARTUP folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Word folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Templates folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tool folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fujitsu Siemens Computers folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programme folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\SendTo folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Recent folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Printer Shortcuts folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Network Shortcuts folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Cookies\Low folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Cookies folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\UProof folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Templates folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates\My folder moved successfully.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates scheduled to be moved on reboot.
C:\Users\Brandon\AppData\Roaming\Microsoft\Protect\S-1-5-21-4048956899-1286244931-2967521482-1000 folder moved successfully.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Protect scheduled to be moved on reboot.
C:\Users\Brandon\AppData\Roaming\Microsoft\Proof folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Outlook folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Office\Recent folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Office folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Internet Explorer folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Installer\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655} folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Installer folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Document Building Blocks\1031 folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Document Building Blocks folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4048956899-1286244931-2967521482-1000 folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto\RSA folder moved successfully.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Credentials scheduled to be moved on reboot.
C:\Users\Brandon\AppData\Roaming\Microsoft\AddIns folder moved successfully.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft scheduled to be moved on reboot.
C:\Users\Brandon\AppData\Roaming\Media Center Programs folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.daredorm.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.ytimg.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#mpsnare.iesnare.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#img.livejasmin.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#img.6waves.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#freeporn.youngleafs.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#chatango.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cdnbakmi.kaltura.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\www.daredorm.com\swf\flowplayer\flowplayer.commercial-3.1.1.swf folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\www.daredorm.com\swf\flowplayer folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\www.daredorm.com\swf folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\www.daredorm.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\skype.com\#user folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\skype.com\#ui folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\skype.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\s.ytimg.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\mpsnare.iesnare.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\img.6waves.com\create-my-app\save_banana\game.swf folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\img.6waves.com\create-my-app\save_banana folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\img.6waves.com\create-my-app folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\img.6waves.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\freeporn.youngleafs.com\#kernelteam folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\freeporn.youngleafs.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\chatango.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp\19257200\flash\kdp3\v3.4.10.1\kdp3.swf folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp\19257200\flash\kdp3\v3.4.10.1 folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp\19257200\flash\kdp3 folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp\19257200\flash folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp\19257200 folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572 folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Identities\{E339429E-95C8-4122-ABCE-3B45431A0279} folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Identities folder moved successfully.
C:\Users\Brandon\AppData\Roaming\ATI\ACE folder moved successfully.
C:\Users\Brandon\AppData\Roaming\ATI folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Adobe\Flash Player\AssetCache\36AXTJXZ folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Adobe\Flash Player\AssetCache folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Adobe\Flash Player folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Adobe folder moved successfully.
Folder move failed. C:\Users\Brandon\AppData\Roaming scheduled to be moved on reboot.
Folder C:\ProgramData\eFjBp01804\ not found.
C:\Users\Brandon\Desktop\System Tool 2011.lnk moved successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Brandon

User: Default

User: Default User

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Brandon
->Temp folder emptied: 64549594 bytes
->Temporary Internet Files folder emptied: 42348258 bytes
->FireFox cache emptied: 85994028 bytes
->Google Chrome cache emptied: 6353877 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 118238874 bytes
RecycleBin emptied: 36331389 bytes

Total Files Cleaned = 337,00 mb


OTL by OldTimer - Version 3.2.20.1 log created on 01092011_201324

Files\Folders moved on Reboot...
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Protect scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Credentials scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Protect scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Credentials scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Protect scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Credentials scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming scheduled to be moved on reboot.

Registry entries deleted on Reboot...



Den Rest muss ich mir noch einmal ansehen - was ich da jetzt machen muss...

markusg 09.01.2011 20:30
noch nichts. ich hab nen fehler gemacht.
noch nichts, ich hab nen fehler gemacht!
öffne mal mein computer. dort öffnest du mal _OTL, dort ist nen ordner mit heutigem datum und den öffnest du ebenfalls. dort findest du doch sicher:
C:\Users\Brandon\AppData\Roaming
diesen ordner einmal anklicken und mache dann einen rechtsklick, wähle kopieren.
der ordner muss dann hier eingefügt werden
C:\Users\Brandon\AppData\
also navigiere dort hin, rechtsklick und einfügen.

supidupi 09.01.2011 20:43
???

Ich soll den Roaming Ordner aus AppData

in AppData einfügen?

Das ist doch das gleiche Verzeichnis - oder? Es gibt keinen weiteren AppData Ordner.
Oder soll ich ihn in Brandon einfügen - neben AppData ?

markusg 09.01.2011 20:46
wenn du den ordner moved files öffnest, dann den ordner mit heutigem datum findest du dort
C:\Users\Brandon\AppData\Roaming
und den musst du wieder an seinen ursprungsort einfügen
C:\Users\Brandon\AppData\
wenn der ordner
C:\Users\Brandon\AppData\
noch vorhanden ist. musst du ihn in moved files öffnen, und den inhalt wieder im original ordner einfügen.

supidupi 09.01.2011 20:56
Ich steh auf dem Schlauch.

Also, ich öffne den Datums-Ordner von heute in moved files

Da gibt es 2 Ordner

C_ProgramData
C_Users

In

C_Users gibt es den Ordner

Brandon - darin

AppData - und darin

Roaming

Und den soll ich jetzt genau Wohin kopieren?

markusg 09.01.2011 21:08
C:\Users\Brandon\AppData\Roaming
dort hin.
wenn es den ordner
Roaming
dort bereits gibt. öffnest du ihn jeweils in moved files und im original verzeichniss
C:\Users\Brandon\AppData\
und kopierst den inhalt des Roaming
von moved files in den original Roaming
ordner.

supidupi 09.01.2011 21:21
Also in dem regulären Ordner (nicht dem _OTL.....)

c:\User\Brandon\

gibt es nur folgende Ordner

Bilder
Desktop
Dokumente
Download
Favoriten
Gespeicherte Spiele
Kontakt
Links
Musik
Suchvorgänge
Videos


Und wenn ich das mit meinem PC vergleiche, da gibt es dort auch keinen AppData Ordner.

markusg 09.01.2011 21:29
blende versteckte datein + ordner ein.
Anzeigen versteckter Dateien
weiterhin geschützte systemdateien, warnmeldung mit ja bestätigen, und inhalte von systemordnern oder ähnlich. dann solltest du ihn sehen.

supidupi 09.01.2011 21:53
Vielen Dank - es hat geklappt. Wobei es offenbar ein paar Dateien gab, die nicht kopiert werden konnten, weil irgendwelche Programme geöffnet waren. Aber es war nix auf. Hmmm, na ja.

Er ist normal hochgefahren, alles scheint zu klappen.

Vielen, vielen Dank für die Mühe und die Geduld.

markusg 10.01.2011 14:24
wir sind noch nicht fertig, und sorry für den blöden fehler!

öffne mal moved files, datum und dort packe mit winrar oder zip
C_ProgramData
und lad den im upload channel hoch.

supidupi 10.01.2011 15:24
OK, erledigt. Sorry, den Teil hatte ich schon vergessen.

Mann, ist der langsam heute. Ich schreibe einen ganzen Satz und der ist immer noch beim 3. Wort .....:headbang:

markusg 10.01.2011 15:40
ok dann weiter:
download malwarebytes:
Malwarebytes
instalieren, öffnen, registerkarte aktualisierung, programm updaten.
schalte alle laufenden programme ab, trenne die internetverbindung.
registerkarte scanner, komplett scan, funde entfernen, log posten.

supidupi 10.01.2011 18:13
LOG:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5495

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18999

10.01.2011 18:10:02
mbam-log-2011-01-10 (18-10-02).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 251321
Laufzeit: 2 Stunde(n), 11 Minute(n), 45 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\_OTL\movedfiles\01092011_201324\c_programdata\efjbp01804\efjbp01804.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

markusg 10.01.2011 18:22
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix
läuft der gesammte pc langsam, also alle programme oder nur bestimmtes?

supidupi 10.01.2011 19:09
So ein Mist - jetzt habe ich das Combo durchlaufen lassen, den LOG - aber ich kann nichts mehr machen.

Mozzilla geht nicht mehr auf, Explorer geht nicht auf, Systemstuerung geht nicht mehr auf, .....

Es kommt immer die Fehlermeldung:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

Gleiches steht dort, wenn ich den LOG c:\combofix.txt aufrufen will.

Was nun????

markusg 10.01.2011 19:13
speichere das log als txt starte neu öffne es dann und poste es.

supidupi 10.01.2011 19:35
Combofix Logfile:
Code:
ComboFix 11-01-10.04 - Brandon 10.01.2011  18:44:16.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.2813.1651 [GMT 1:00]
ausgeführt von:: c:\users\Brandon\Desktop\ComboFix.exe
AV: G Data AntiVirus 2011 *Disabled/Updated* {54ACC2FC-837E-E665-7A92-5352D560D5EF}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\_otl\MovedFiles\01092011_201324\C_Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tool
c:\windows\system32\drivers\FSC__PI__AMILO Pa 3515  __  _P1  __Ver 1.00PARTTBL_FSC - 6040000_V1.13  __ATI Radeon HD 3200 Graphics .MRK
c:\windows\system32\drivers\rlmbcdil.sys

.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ggfteb


(((((((((((((((((((((((  Dateien erstellt von 2010-12-10 bis 2011-01-10  ))))))))))))))))))))))))))))))
.

2011-01-10 14:53 . 2011-01-10 14:53        --------        d-----w-        c:\users\Brandon\AppData\Roaming\Malwarebytes
2011-01-10 14:53 . 2010-12-20 17:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-10 14:53 . 2011-01-10 14:53        --------        d-----w-        c:\programdata\Malwarebytes
2011-01-10 14:53 . 2011-01-10 17:09        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2011-01-10 14:53 . 2010-12-20 17:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-01-09 21:19 . 2010-10-19 04:27        7680        ----a-w-        c:\program files\Internet Explorer\iecompat.dll
2011-01-09 21:16 . 2009-03-08 11:32        72704        ----a-w-        c:\windows\system32\admparse.dll
2011-01-09 20:39 . 2008-01-12 18:30        8704        ----a-r-        c:\users\Brandon\AppData\Roaming\Microsoft\Installer\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}\Icon9A3BC1573.exe
2011-01-09 20:38 . 2011-01-10 15:04        --------        d-----w-        c:\users\Brandon\AppData\Roaming\skypePM
2011-01-09 20:38 . 2006-11-02 12:37        --------        d-----w-        c:\users\Brandon\AppData\Roaming\Media Center Programs
2011-01-09 19:16 . 2011-01-09 19:16        --------        d-----w-        c:\users\Brandon\AppData\Roaming\ATI
2011-01-09 19:16 . 2011-01-10 18:00        --------        d-----w-        c:\users\Brandon\AppData\Roaming\Skype
2011-01-09 19:16 . 2011-01-10 14:52        --------        d-----w-        c:\users\Brandon\AppData\Roaming\Spyware Terminator
2011-01-09 19:13 . 2011-01-09 19:28        --------        d-----w-        C:\_OTL
2011-01-09 16:44 . 2011-01-09 16:44        142592        ----a-w-        c:\windows\system32\drivers\sp_rsdrv2.sys
2011-01-09 16:44 . 2011-01-10 14:14        --------        d-----w-        c:\programdata\Spyware Terminator
2011-01-09 16:44 . 2011-01-09 21:51        --------        d-----w-        c:\program files\Spyware Terminator
2011-01-09 15:29 . 2011-01-09 19:13        --------        d-----w-        c:\programdata\eFjBp01804
2011-01-09 14:58 . 2011-01-09 14:58        --------        d-----w-        c:\programdata\Blizzard Entertainment
2011-01-09 14:45 . 2011-01-09 14:45        --------        d-----w-        c:\program files\Common Files\Blizzard Entertainment
2011-01-09 09:54 . 2011-01-09 09:54        --------        d-----w-        c:\program files\Common Files\Skype
2011-01-09 09:54 . 2011-01-09 09:54        --------        d-----r-        c:\program files\Skype
2011-01-09 09:54 . 2011-01-09 09:54        --------        d-----w-        c:\programdata\Skype
2011-01-09 08:31 . 2009-08-24 11:36        377344        ----a-w-        c:\windows\system32\winhttp.dll
2011-01-09 08:31 . 2010-09-06 16:20        125952        ----a-w-        c:\windows\system32\srvsvc.dll
2011-01-09 08:31 . 2010-09-06 16:19        17920        ----a-w-        c:\windows\system32\netevent.dll
2011-01-09 08:31 . 2010-09-06 13:45        304128        ----a-w-        c:\windows\system32\drivers\srv.sys
2011-01-09 08:31 . 2010-09-06 13:45        145408        ----a-w-        c:\windows\system32\drivers\srv2.sys
2011-01-09 08:31 . 2010-09-06 13:45        102400        ----a-w-        c:\windows\system32\drivers\srvnet.sys
2011-01-09 08:31 . 2010-05-27 20:08        739328        ----a-w-        c:\windows\system32\inetcomm.dll
2011-01-09 08:26 . 2010-11-16 11:01        6273872        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{23BB9415-F2ED-40D0-BC8C-F8C832E72B73}\mpengine.dll
2011-01-09 08:09 . 2011-01-09 08:09        --------        d-----w-        c:\program files\Windows Portable Devices
2010-12-26 17:13 . 2009-09-10 02:00        92672        ----a-w-        c:\windows\system32\UIAnimation.dll
2010-12-26 17:13 . 2009-09-10 02:01        3023360        ----a-w-        c:\windows\system32\UIRibbon.dll
2010-12-26 17:13 . 2009-09-10 02:00        1164800        ----a-w-        c:\windows\system32\UIRibbonRes.dll
2010-12-26 17:11 . 2009-10-01 01:02        30208        ----a-w-        c:\windows\system32\WPDShextAutoplay.exe
2010-12-26 17:11 . 2009-10-01 01:02        31232        ----a-w-        c:\windows\system32\BthMtpContextHandler.dll
2010-12-26 17:11 . 2009-10-01 01:01        81920        ----a-w-        c:\windows\system32\wpdbusenum.dll
2010-12-26 17:11 . 2009-10-01 01:01        60928        ----a-w-        c:\windows\system32\PortableDeviceConnectApi.dll
2010-12-26 17:11 . 2009-10-01 01:02        2537472        ----a-w-        c:\windows\system32\wpdshext.dll
2010-12-26 17:11 . 2009-10-01 01:02        334848        ----a-w-        c:\windows\system32\PortableDeviceApi.dll
2010-12-26 17:11 . 2009-10-01 01:02        87552        ----a-w-        c:\windows\system32\WPDShServiceObj.dll
2010-12-26 17:11 . 2009-10-01 01:01        546816        ----a-w-        c:\windows\system32\wpd_ci.dll
2010-12-26 17:11 . 2009-10-01 01:01        160256        ----a-w-        c:\windows\system32\PortableDeviceTypes.dll
2010-12-26 17:11 . 2009-10-01 01:01        100864        ----a-w-        c:\windows\system32\PortableDeviceClassExtension.dll
2010-12-26 17:11 . 2009-10-01 01:01        350208        ----a-w-        c:\windows\system32\WPDSp.dll
2010-12-26 17:11 . 2009-10-01 01:01        196608        ----a-w-        c:\windows\system32\PortableDeviceWMDRM.dll
2010-12-26 17:11 . 2009-10-01 01:01        227840        ----a-w-        c:\windows\system32\drivers\UMDF\WpdFs.dll
2010-12-26 17:09 . 2009-10-08 21:08        555520        ----a-w-        c:\windows\system32\UIAutomationCore.dll
2010-12-26 17:09 . 2009-10-08 21:08        234496        ----a-w-        c:\windows\system32\oleacc.dll
2010-12-26 17:09 . 2009-10-08 21:07        4096        ----a-w-        c:\windows\system32\oleaccrc.dll
2010-12-26 16:50 . 2009-11-08 09:55        99176        ----a-w-        c:\windows\system32\PresentationHostProxy.dll
2010-12-26 16:50 . 2009-11-08 09:55        49472        ----a-w-        c:\windows\system32\netfxperf.dll
2010-12-26 16:50 . 2009-11-08 09:55        297808        ----a-w-        c:\windows\system32\mscoree.dll
2010-12-26 16:50 . 2009-11-08 09:55        295264        ----a-w-        c:\windows\system32\PresentationHost.exe
2010-12-26 16:50 . 2009-11-08 09:55        1130824        ----a-w-        c:\windows\system32\dfshim.dll
2010-12-26 16:48 . 2010-02-12 10:32        293376        ----a-w-        c:\windows\system32\browserchoice.exe
2010-12-26 16:47 . 2010-12-26 16:47        --------        d-----w-        c:\users\Default\AppData\Local\Microsoft Help
2010-12-26 16:30 . 2010-02-20 23:06        24064        ----a-w-        c:\windows\system32\nshhttp.dll
2010-12-26 16:30 . 2010-02-20 23:05        30720        ----a-w-        c:\windows\system32\httpapi.dll
2010-12-26 16:30 . 2010-02-20 20:53        411648        ----a-w-        c:\windows\system32\drivers\http.sys
2010-12-26 16:29 . 2010-12-26 16:29        --------        d-----w-        c:\program files\MSXML 4.0
2010-12-26 15:21 . 2010-08-17 14:11        128000        ----a-w-        c:\windows\system32\spoolsv.exe
2010-12-26 15:20 . 2010-11-04 18:55        270336        ----a-w-        c:\windows\system32\taskcomp.dll
2010-12-26 14:55 . 2009-12-23 11:33        172032        ----a-w-        c:\windows\system32\wintrust.dll
2010-12-26 14:54 . 2010-01-13 17:34        98304        ----a-w-        c:\windows\system32\cabview.dll
2010-12-26 14:50 . 2010-10-19 09:41        222080        ------w-        c:\windows\system32\MpSigStub.exe
2010-12-25 21:09 . 2010-12-26 15:27        29992        ----a-w-        c:\windows\system32\drivers\GRD.sys
2010-12-25 20:54 . 2011-01-09 19:24        --------        d-----w-        c:\program files\IZArc

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-01-03 15028104]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2011-01-09 3318784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"RtHDVCpl"="RtHDVCpl.exe" [2008-06-13 6183456]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-08-17 102400]
"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2008-05-23 192512]
"WisKeyState"="c:\program files\Launch Manager\WisKeyState.exe" [2008-03-07 208896]
"LMgrVolOSD"="c:\program files\Launch Manager\OSD.exe" [2008-03-03 258048]
"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2007-12-25 241664]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"FSCRecovery"="c:\program files\Fujitsu Siemens Computers\Fujitsu Siemens Computers Recovery\FSCRecoveryReminder.exe" [2008-06-18 268096]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-10-28 72736]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-10-11 62760]
"Google EULA Launcher"="c:\program files\Google\Google EULA\GoogleEULALauncher.exe" [2008-05-28 20480]
"G Data AntiVirus Tray Application"="c:\program files\G Data\AntiVirus\AVKTray\AVKTray.exe" [2010-08-27 996936]
"Skytel"="Skytel.exe" [2007-11-20 1826816]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2011-01-09 2216960]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys [2008-01-12 33480]
S1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys [2008-01-12 62024]
S1 gdwfpcd;G DATA WFP CD;c:\windows\system32\drivers\gdwfpcd32.sys [2008-01-12 40904]
S1 GRD;G Data Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [2010-12-26 29992]
S1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys [2008-01-12 38856]
S1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2011-01-09 142592]
S2 AVKProxy;G Data AntiVirus Proxy;c:\program files\Common Files\G Data\AVKProxy\AVKProxy.exe [2010-08-27 1178184]
S2 AVKService;G Data Scheduler;c:\program files\G Data\AntiVirus\AVK\AVKService.exe [2010-08-27 410696]
S2 AVKWCtl;G Data Dateisystem Wächter;c:\program files\G Data\AntiVirus\AVK\AVKWCtl.exe [2010-08-27 1330792]
S2 FSCLBaseUpdaterService;FSCLBaseUpdaterService;c:\program files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe [2007-06-04 65536]
S3 GDScan;G Data Scanner;c:\program files\Common Files\G Data\GDScan\GDScan.exe [2010-08-26 340552]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2008-04-11 84240]
S3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [2008-01-15 118784]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKU-Default-Run-fsc-reg - c:\fsc-reg\fscreg.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-01-10 18:59
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\IoctlSvc.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\program files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
c:\windows\system32\conime.exe
c:\windows\RtHDVCpl.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Synaptics\SynTP\SynTPEnh.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-01-10  19:03:08 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-01-10 18:03

Vor Suchlauf: 17 Verzeichnis(se), 160.571.695.104 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 160.115.187.712 Bytes frei

- - End Of File - - EAF13FBB43A82717A8497CA948CD44C7
--- --- ---

markusg 10.01.2011 19:38
lade den ccleaner slim:
Piriform - Builds
falls der ccleaner bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

supidupi 10.01.2011 19:54
Activation Assistant for the 2007 Microsoft Office suites - Microsoft Corporation 11.01.2008 14,0MB - unbekannt

Adobe Flash Player 10 Plugin Adobe Systems Incorporated 25.12.2010 10.1.102.64 - notwendig

Adobe Flash Player 9 ActiveX Adobe Systems, Inc. 11.01.2008 3,05MB 9.0.124.0 - notwendig

Adobe Reader 9 - Deutsch Adobe Systems Incorporated 21.10.2008 232MB 9.0.0 - notwendig

ATI Catalyst Install Manager ATI Technologies, Inc. 21.10.2008 13,9MB 3.0.678.0 - notwendig (Grafikkarte, oder?)

CCleaner Piriform 09.01.2011 3,41MB 3.02 - zz. notwendig

Compatibility Pack für 2007 Office System Microsoft Corporation 08.01.2011 56,2MB 12.0.6425.1000 - unbekannt

FSCLounge Fujitsu Siemens Computers 11.01.2008 8,47MB 1.0.0 - unbekannt (ist ein FSC Laptop)

Fujitsu Siemens Computers Recovery Fujitsu Siemens Computers 11.01.2008 7,06MB 1.3.9 - notwendig

G Data AntiVirus 2011 G Data Software AG 11.01.2008 186,9MB 21.0.0.0 - notwendig

IZArc 3.81 Ivan Zahariev 08.01.2011 14,0MB 3.81 Build 1550 - notwendig

JMicron JMB38X Flash Media Controller JMicron Technology Corp. 21.10.2008 2,26MB 1.00.11.02 - unbekannt

Launch Manager V1.5.4 Wistron Corp. 21.10.2008 1,35MB 1.5.4 - unbekannt

Malwarebytes' Anti-Malware Malwarebytes Corporation 09.01.2011 4,81MB - unbekannt

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU Microsoft Corporation 25.12.2010 37,0MB - unbekannt

Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 25.12.2010 37,0MB - unbekannt

Microsoft Office Professional Plus 2007 Microsoft Corporation 25.12.2010 536MB 12.0.6425.1000 - notwendig

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Corporation 25.12.2010 0,25MB 8.0.50727.4053 - unbekannt, s.u.

Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 21.10.2008 0,54MB 8.0.50727.42 - unbekannt, aber bestimmt notwendig

Mozilla Firefox (3.6.13) Mozilla 11.01.2008 28,8MB 3.6.13 (de) - notwendig

MSXML 4.0 SP2 (KB927978) Microsoft Corporation 25.12.2010 34,00KB 4.20.9841.0 - unbekannt
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 25.12.2010 35,00KB 4.20.9870.0 - unbekannt
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 25.12.2010 1,34MB 4.20.9876.0 - unbekannt

Nero 8 Essentials Nero AG 21.10.2008 1.759MB 8.3.228 - notwendig

Picasa 2 Google, Inc. 11.01.2008 35,3MB 2.0 - unbekannt

PowerDVD CyberLink Corporation 11.01.2008 63,1MB 7.3.3516a.0 - notwendig

Realtek High Definition Audio Driver Realtek Semiconductor Corp. 21.10.2008 - notwendig

Skype Toolbars Skype Technologies S.A. 08.01.2011 7,10MB 5.0.4137 - für meinen sohn bestimmt notwendig

Skype™ 5.1 Skype Technologies S.A. 08.01.2011 22,6MB 5.1.104 - notwendig

Spyware Terminator Crawler Inc. 08.01.2011 25,9MB 2.8.2.192 - unbekannt

Synaptics Pointing Device Driver Synaptics 21.10.2008 13,6MB 10.0.12.0 - unbekannt

SystemDiagnostics Fujitsu Siemens Computers 11.01.2008 13,6MB 2.01.0004 - notwendig

markusg 10.01.2011 20:12
Adobe Reader 9
ersetzen:
Adobe - Adobe Reader herunterladen - Alle Versionen

bitte den mcafee security scan nicht mit instalieren.
öffne den adobe reader, bearbeiten, voreinstellungen, javascript, dort den haken raus, internet, ebenfalls alle haken raus.
so werden keine pdfs mehr automatisch geladen und es kann dir kein schadcode mehr auf diese weise untergeschoben werden.
unter allgemein, nur zertifizierte zusatzmodule verwenden anhaken.
unter update, auf instalieren stellen.
klicke übernehmen /ok

deinstaliere:
Skype Toolbars
Spyware Terminator
das war die ganze liste?
falls ja, bereinige dann mit dem ccleaner dateien + registry

supidupi 10.01.2011 20:43
OK, Adobe geladen und Häkchen gesetzt bzw. entfernt.

Programme entfernt

Neustart

CCleaner:
- Registry - nach Fehlern suchen

danach dann "Fehler beheben" anklicken, korrekt?

- Aber den Button "Dateien" finde ich bei CCleaner nicht.

markusg 10.01.2011 20:44
genau.
das andere müsste analysieren/beheben oder ähnlich heißen mal in der anleitung gucken

http://www.trojaner-board.de/51464-a...-ccleaner.html

supidupi 10.01.2011 21:00
OK, erledigt. Jetzt fertig?

Wenn der noch einmal irgendwas ungeprüft auf seinen Rechner lädt, kann er das alleine machen! Aber er meint ja, es kam von dem Kamerachip seiner Vaters.

markusg 10.01.2011 21:12
läuft der pc wieder gewohnt schnell? dann würde ich ihn noch absichern wollen mit dir zusammen

supidupi 10.01.2011 21:17
Scheint gut zu funktionieren. Das Problem mit dem "vorher" ist, ich habe ihn nach der 3. Reparatur (die 1. wo FSC etwas gemacht hat), neu aufgesetzt, weil vorher vieles nicht richtig lief. Daher ist jetzt noch nicht so viel wieder drauf. Aber Web geht, Word und Excel geht schnell auf, ... daher vermute ich mal, alles ist OK.

Was mache ich jetzt eigentlich mit dem OTL auf C:?
Darüber steht auch noch "$RECYCLEBIN" - was mache ich damit?

markusg 10.01.2011 21:24
du hast den pc jetzt wo wir miteinander gearbeitet haben neu aufgesetzt und mir davon nichts geschrieben oder wie? das ist jetzt nicht dein ernst :d

supidupi 10.01.2011 21:35
Nein, den hatte ich vor 2 Wochen neu gemacht - nachdem er von FSC zurückkam. Jetzt nicht.
Dann hätten wir die ganze Arbeit ja nicht machen müssen, oder?

markusg 10.01.2011 21:40
ja eben :d
okmache nen scan mit gdata nach update und morgen gebe ich dir weitere tipps, für heute ist schluss.

supidupi 11.01.2011 17:02
So, da bin ich wieder.

GData ist durchgelaufen und hat unter dem "movedFiles" Ordner einen Virus gefunden gehabt. Den habe ich dann erstmal in Quarantäne geschoben.

Und was mache ich jetzt?

markusg 11.01.2011 17:30
na ich würd sagen, erst mal freuhe dich ne minute lang, wir sind fertig soweit.
besuche windows update, spiele alle updates ein, auch den internet explorer 8.
automatische updates aktivieren:
Aktivieren oder Deaktivieren von automatischen Updates

dep für alle prozesse:
Datenausführungsverhinderung (DEP)
• "Datenausführungsverhinderung für alle Programme und Dienste mit Ausnahme der ausgewählten einschalten:".
wenn es zu problemen kommen sollte, kann man die betroffenen prozesse aus der Überwachung entfernen.

SEHOP aktivieren:
Aktivieren von SEHOP &#40;Structured Exception Handling Overwrite Protection&#41; in Windows-Betriebssystemen
klicke auf "Feature automatisch aktivieren"
und folge den anweisungen

als browser solltest du den opera nutzen, er ist sicherer und schneller.
wenn er dir nicht gefällt passe ich meine anleitung für den ff an.
Opera Webbrowser | Schneller & sicherer | Die neuen Internet-Browser kostenlos herunterladen
mit diesem tool lässt sich ein werbeblocker laden
Opera URLFilter Downloader ? OperaWiki
dieses tool 1x pro woche manuell ausführen.
zusätzlich kannst du das auch manuell erledigen, falls mal etwas nicht geblockt wird:

zusätzlich kannst du das auch manuell erledigen, falls mal etwas nicht geblockt wird:
Computerbase - Werbung blockieren
auch diese tutorial seite mal ansehen.
Opera Tutorial- Übersicht
hier besonders die abschnitte sicherheit (kookies) und passwort durchlesen

lesezeichen importieren:
Lesezeichen ? OperaWiki
um das surfen sicherer zu machen, würde ich sandboxie empfehlen.
Download:
http://filepony.de/download-sandboxie/
anleitung:
Sandbox*Einstellungen |

(als pdf)
hier noch ein paar zusatzeinstellungen, nicht verunsichern lassen, wenn du das programm instaliert hast, werden sie klar.
den direkten datei zugriff bitte auf opera beschrenken,
bei
Internetzugriff:
opera.exe
öffne dann sandboxie, dann oben im menü auf sandbox klickem, wähle deine sandbox aus und klicke dann auf sandboxeinstellung.
dort auf anwendung, webbrowser, andere dort auf direkten zugriff auf opera bookmarks erlauben. dann auf hinzufügen und ok.
somit kannst du deine lesezeichen auch in der sandbox dauerhaft abspeichern.

wenn du mit dem programm gut auskommst, ist ne lizenz zu empfehlen.
1. es gibt dann noch ein paar mehr funktionen.
2. kommt nach nem monat die anzeige, dass das programm freeware ist, die verschwindet erst nach ner zeit, find ich n bissel nerfig.
3. ist die lizenz lebenslang gültig, kostenpunkt rund 30 €, und du kannst sie auf allen pcs in deinem haushalt einsetzen.

autorun deaktivieren:
über diesen weg werden sehr häufig schaddateien verbreitet, schalte die funktion also ab.
Tipparchiv - Autorun/Autoplay gezielt für Laufwerkstypen oder -buchstaben abschalten - WinTotal.de
usb sticks, festplatten etc, sollte man mit panda vaccine impfen:
ANTIMALWARE: Panda USB Vaccine - Download FREE - PANDA SECURITY
so holt man sich keine infektionen ins haus, wenn man mal die festplatte etc verleit.
hake an:
run panda usb vaccine automatically when computer boots
automatically vaccine any new insert usb key
enable ntfs file suport

Updates sind für dein system genauso wichtig, wie ein antivirenscanner. Sehr häufig gelangen schädlinge nur aufs system, weil der user veraltete software nutzt.
instaliere die folgenden update checker.
Secunia:
http://www.trojaner-board.de/83959-s...ector-psi.html
bitte die erweiterte ansicht auswählen
und file hippo update checker:
FileHippo.com Update Checker - FileHippo.com
das file Hippo Symbol wird im infobereich neben der uhr auftauchen, mache bitte nen rechtsklick darauf, wähle settings, results, setze einen haken bei "hide beta updates" klicke ok.
dann doppelklicke file hippo, eine Internetseite wird geöffnet, auf der dier die aktuellsten updates gezeigt werden, diese downloaden und instalieren.

Beide programme sollten im autostart bleiben, und sobald eines der programme updates anzeigt sollten diese umgehend instaliert werden.


achtung:
bei einigen programmen werden englische setups angeboten. das sollte man ersehen können, die setupdateien sollten ein .en oder .us enthalten. wenn dem so ist, sollte man beim hersteller schauen, dort gibts die deutschen setups zu laden.
Falls du die hersteller seite nicht kennst, google wird bestimmt behilflich sein :-)

regelmäßige Backups des systems sind sehr wichtig, du weist nie, ob deine festplatte mal kaputt geht.
Paragon Backup & Recovery Free Edition - Das Produkt
außerdem kannst du, bei neuerlichem malware befall das system zurücksetzen.
Das Backup sollte möglichst auf eine externe festplatte etc emacht werden, nicht auf die selbe, wo sich die zu sichernden daten befinden.
Von sehr wichtigen Daten könnte man noch eine zusätzliche Sicherung auf dvds/cds erstellen, dazu könnte man auch wiederbeschreibbare verwenden (rws) falls die sammlung mal erneuert werden soll.



allgemeines.
- verzichte auf tuning programme, sie bringen nichts.
- keine illegalen downloads.
90 % bringen malware mit sich!
- keine streaming seiten wie kino.to sie verbreiten malware.
- wenn möglich, instalationen immer benutzerdefiniert ausführen, dann kannst du unnötiges zeug abwählen.
- programme pa
falls ihr onlinebanking macht:
online banking:

ich würde zu online banking mit chipcard raten, dazu benötigst du, ein lesegerät, lasse dich von deiner bank beraten, es sollte aber mindestens ein klasse2 lesegerät sein, besser sogar ein klasse3 leser, das sind die besten für den privat kunden.
Kartenlesegerät ? Wikipedia
endere alle passwörter!
surfe nur noch in der sandbox, mit klick auf sandboxed web browser.

reinige mit otcleanit:
http://oldtimer.geekstogo.com/OTM.exe
Klicke cleanup!
dein pc wird evtl. neu starten
programm löscht sich selbst, + die verwendeten tools
Bitte lies diese 10 tipps. diese helfen dir dein system sicher zu machen. instaliere und nutze

supidupi 11.01.2011 17:47
Vielen Dank für die vielen Tipps. Die werde ich die nächsten Tage Stück für Stück umsetzen.
Super, dass es solche Experten wie euch gibt - mit so viel Wissen. 1.000 Dank.

markusg 11.01.2011 18:00
kannst dich ja melden, wenn alles erfolgreich war, bzw wenns probleme gibt.
diese tipps kann man übrigens auf allen pcs umsetzen.
und danke :-)


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:35 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131