Trojaner-Board - Win 7 Home Security eingefangen

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Win 7 Home Security eingefangen (https://www.trojaner-board.de/99059-win-7-home-security-eingefangen.html)

Win 7 Home Security eingefangen

Hallo erstmal.

Heute Nachmittag war ich auf der Suche nach einem neuen Hintergrundbild. Kurz darauf kam eine Meldung von Win 7 Home Security, die sagte, dass ich 33 Viren habe. McAfee hat nichts gefunden.

Malwarebytes Log:

Code:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org
 

Datenbank Version: 6569
 

Windows 6.1.7600

Internet Explorer 8.0.7600.16385
 

14.05.2011 01:42:46

mbam-log-2011-05-14 (01-42-46).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|Q:\|)

Durchsuchte Objekte: 361791

Laufzeit: 1 Stunde(n), 46 Minute(n), 3 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 3

Infizierte Verzeichnisse: 0

Infizierte Dateien: 4
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Lisa\AppData\Local\wsn.exe" -a "C:\Program Files (x86)\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Lisa\AppData\Local\wsn.exe" -a "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Lisa\AppData\Local\wsn.exe" -a "C:\Program Files (x86)\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

c:\Users\Lisa\AppData\Local\wsn.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.

c:\Users\Lisa\documents\ICQ\201338738\receivedfiles\437033087 marcel\lichtschalter.exe (PUP.Joke.Buttons) -> Quarantined and deleted successfully.

e:\ICQ\201338738\receivedfiles\437033087 marcel\lichtschalter.exe (PUP.Joke.Buttons) -> Quarantined and deleted successfully.

c:\Users\Lisa\Desktop\eXplorer.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

OTL:

Code:

OTL logfile created on: 14.05.2011 01:47:26 - Run 1

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\Lisa\Desktop

64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 45,00% Memory free

8,00 Gb Paging File | 5,00 Gb Available in Paging File | 58,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 451,01 Gb Total Space | 388,16 Gb Free Space | 86,06% Space Free | Partition Type: NTFS

Drive E: | 7,51 Gb Total Space | 2,13 Gb Free Space | 28,39% Space Free | Partition Type: FAT32

Drive F: | 3,80 Gb Total Space | 2,31 Gb Free Space | 60,87% Space Free | Partition Type: FAT32

 

Computer Name: DELLA | User Name: Lisa | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Lisa\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe (TeamViewer GmbH)

PRC - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)

PRC - c:\program files (x86)\teamviewer\version6\TeamViewer_Desktop.exe (TeamViewer GmbH)

PRC - C:\Program Files (x86)\TeamViewer\Version6\tv_w32.exe (TeamViewer GmbH)

PRC - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)

PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe (SoftThinks - Dell)

PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe (SoftThinks - Dell)

PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE ()

PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)

PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)

PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)

PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)

PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)

PRC - C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe ()

PRC - C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe ()

PRC - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.)

PRC - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)

PRC - C:\Programme\Dell\DellDock\DockLogin.exe (Stardock Corporation)

PRC - C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)

PRC - C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Users\Lisa\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\Program Files (x86)\TeamViewer\Version6\tv_w32.dll (TeamViewer GmbH)

MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)

MOD - C:\Windows\SysWOW64\crtdll.dll (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - (mfefire) -- C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)

SRV:64bit: - (McShield) -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()

SRV:64bit: - (McODS) -- C:\Program Files\mcafee\VirusScan\mcods.exe (McAfee, Inc.)

SRV:64bit: - (McProxy) -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)

SRV:64bit: - (McOobeSv) -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)

SRV:64bit: - (McNASvc) -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)

SRV:64bit: - (McNaiAnn) -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)

SRV:64bit: - (mcmscsvc) -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)

SRV:64bit: - (McMPFSvc) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)

SRV - (TeamViewer6) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)

SRV - (BBSvc) -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)

SRV - (SeaPort) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)

SRV - (SftService) -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)

SRV - (mfevtp) -- C:\Programme\Common Files\mcafee\systemcore\mfevtps.exe (McAfee, Inc.)

SRV - (IAStorDataMgrSvc) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)

SRV - (AERTFilters) -- C:\Programme\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation)

SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)

SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (DockLoginService) -- C:\Programme\Dell\DellDock\DockLogin.exe (Stardock Corporation)

SRV - (GameConsoleService) -- C:\Program Files (x86)\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe (WildTangent, Inc.)

SRV - (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (mfehidk) -- C:\Windows\SysNative\drivers\mfehidk.sys (McAfee, Inc.)

DRV:64bit: - (mfefirek) -- C:\Windows\SysNative\drivers\mfefirek.sys (McAfee, Inc.)

DRV:64bit: - (mfewfpk) -- C:\Windows\SysNative\drivers\mfewfpk.sys (McAfee, Inc.)

DRV:64bit: - (mfeavfk) -- C:\Windows\SysNative\drivers\mfeavfk.sys (McAfee, Inc.)

DRV:64bit: - (mfeapfk) -- C:\Windows\SysNative\drivers\mfeapfk.sys (McAfee, Inc.)

DRV:64bit: - (mferkdet) -- C:\Windows\SysNative\drivers\mferkdet.sys (McAfee, Inc.)

DRV:64bit: - (mfenlfk) -- C:\Windows\SysNative\drivers\mfenlfk.sys (McAfee, Inc.)

DRV:64bit: - (cfwids) -- C:\Windows\SysNative\drivers\cfwids.sys (McAfee, Inc.)

DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)

DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)

DRV:64bit: - (L1C) -- C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)

DRV:64bit: - (ApfiltrService) -- C:\Windows\SysNative\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)

DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)

DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)

DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)

DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)

DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)

DRV:64bit: - (RSUSBSTOR) -- C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)

DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)

DRV:64bit: - (CtClsFlt) -- C:\Windows\SysNative\drivers\CtClsFlt.sys (Creative Technology Ltd.)

DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof ()

DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys (Marvell)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/

IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.defaultthis.engineName: "Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/webhp?hl=de"

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9

FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0

FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=sm&tb_ver=1.2.0&q="

FF - prefs.js..network.proxy.type: 0

 

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.04.30 13:44:15 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.04.07 16:47:36 | 000,000,000 | ---D | M]

 

[2010.12.24 22:27:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lisa\AppData\Roaming\mozilla\Extensions

[2011.05.14 00:32:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lisa\AppData\Roaming\mozilla\Firefox\Profiles\yma2uxwn.default\extensions

[2011.03.26 22:21:26 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Lisa\AppData\Roaming\mozilla\Firefox\Profiles\yma2uxwn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2011.01.01 03:19:12 | 000,000,873 | ---- | M] () -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\yma2uxwn.default\searchplugins\conduit.xml

[2011.05.07 21:44:33 | 000,000,950 | ---- | M] () -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\yma2uxwn.default\searchplugins\icqplugin-1.xml

[2011.04.24 23:34:38 | 000,001,056 | ---- | M] () -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\yma2uxwn.default\searchplugins\icqplugin.xml

[2011.03.25 18:34:29 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2010.12.24 23:18:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

File not found (No name found) -- 

() (No name found) -- C:\USERS\LISA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YMA2UXWN.DEFAULT\EXTENSIONS\{A0D7CCB3-214D-498B-B4AA-0E8FDA9A7BF7}.XPI

[2011.04.30 13:44:13 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2010.10.13 23:28:54 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll

[2010.11.12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\Common Files\mcafee\systemcore\ScriptSn.20101224212738.dll (McAfee, Inc.)

O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20101224212738.dll (McAfee, Inc.)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  File not found

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.

O4:64bit: - HKLM..\Run: [Apoint] C:\Programme\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [QuickSet] C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.)

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe ()

O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)

O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)

O4 - HKLM..\Run: [Desktop Disc Tool] C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe ()

O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)

O4 - HKLM..\Run: [PDVD9LanguageShortcut] C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe (CyberLink Corp.)

O4 - HKLM..\Run: [RemoteControl9] C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.)

O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk =  File not found

O4 - Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1

O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: Free YouTube Download - C:\Users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.05.14 01:44:59 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Lisa\Desktop\OTL.exe

[2011.05.13 23:54:01 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Roaming\Malwarebytes

[2011.05.13 23:53:42 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys

[2011.05.13 23:53:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.05.13 23:53:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.05.13 23:53:38 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2011.05.13 23:53:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2011.05.13 23:51:53 | 007,734,208 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Lisa\Desktop\herbert.exe

[2011.05.13 14:36:40 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Desktop\webcaaaam

[2011.05.13 13:57:04 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{E136828D-ED73-4BC9-A48E-4BEE5E95A751}

[2011.05.13 13:55:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee

[2011.05.12 16:10:39 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{434240F1-DB07-4945-8E0A-A7E1E70A7200}

[2011.05.11 17:29:41 | 005,475,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2011.05.11 17:29:41 | 003,967,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe

[2011.05.11 17:29:40 | 003,911,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe

[2011.05.11 17:29:35 | 000,324,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usbport.sys

[2011.05.11 17:29:35 | 000,007,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usbd.sys

[2011.05.11 17:23:51 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{0B332B9D-664A-4D0F-B765-54EDEDAE03BC}

[2011.05.10 16:57:14 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{A0168BF8-FD2D-480C-A8E7-07D59CD7F98C}

[2011.05.09 17:10:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype Extras

[2011.05.09 17:10:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2011.05.09 17:10:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2011.05.09 15:35:06 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{2A9A5505-7705-43C6-9922-9C192959A55B}

[2011.05.08 13:12:30 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{C6B535FD-FEBE-425F-886F-7380D671DD7D}

[2011.05.08 00:19:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audacity

[2011.05.07 21:32:32 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{E241A777-8A61-4199-802B-A4A4F8056428}

[2011.05.06 15:45:51 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{2EE56242-F29D-479B-AEEB-E0EE17A8FAF1}

[2011.05.05 19:25:35 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{F445BEA7-30FE-4C62-8DE9-BC13922BF38A}

[2011.05.04 14:01:07 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{595AEA8F-94FF-41CD-AEFB-25C3E2E8D948}

[2011.05.03 13:53:34 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{4974C675-379A-4803-967A-7BE7CBB28252}

[2011.05.02 14:13:27 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{59BD6C0A-6D4A-4EC1-9033-7786EC72AED0}

[2011.05.02 00:24:15 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{54AF67C3-B797-4346-894F-0F6397C50BED}

[2011.05.01 12:23:39 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{32D27882-1170-4017-A9DC-B1743CE9278F}

[2011.04.30 13:40:05 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{BCB1E4D5-A1E6-4E64-BFE6-BF7895051C47}

[2011.04.29 09:28:41 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{41B7B79C-D0BE-40E6-BBD8-1E0984C14519}

[2011.04.28 18:31:41 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{B6FA83D2-7081-4D79-BB69-30699720E5FE}

[2011.04.27 15:17:12 | 002,870,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe

[2011.04.27 15:17:12 | 002,614,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\explorer.exe

[2011.04.27 15:17:10 | 000,662,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll

[2011.04.27 15:17:10 | 000,442,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll

[2011.04.27 15:16:36 | 002,566,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\esent.dll

[2011.04.27 15:16:35 | 000,107,904 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\amdsata.sys

[2011.04.27 15:16:34 | 001,686,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\esent.dll

[2011.04.27 15:16:34 | 000,187,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\storport.sys

[2011.04.27 15:16:34 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\fsutil.exe

[2011.04.27 15:16:34 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\fsutil.exe

[2011.04.27 15:16:34 | 000,027,008 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\amdxata.sys

[2011.04.27 15:16:10 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\prevhost.exe

[2011.04.27 15:16:10 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\prevhost.exe

[2011.04.27 13:42:10 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{F5F3F5C0-2F23-48BB-8295-F5F61151A168}

[2011.04.27 00:59:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.5

[2011.04.27 00:58:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ7.5

[2011.04.26 17:58:00 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{A4E07DDD-1FC4-4562-A662-CAF342307AA8}

[2011.04.25 11:59:10 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{75BB2CC4-D630-4EC4-89FB-65BFF8925639}

[2011.04.24 17:31:13 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{88A0840F-A7F8-4FB4-BA42-EDEA13B8BF79}

[2011.04.23 15:04:49 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{288436B1-65DF-4683-A83E-0464C9B184CF}

[2011.04.22 11:17:26 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{50BF37B4-DACB-4C30-BAC7-1FE695413717}

[2011.04.21 15:40:16 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{9417C413-5515-45C8-981B-D987F000A48E}

[2011.04.20 12:23:52 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{FA9906BB-BB6D-4DDA-9424-0162AEDDEC85}

[2011.04.19 13:19:13 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{1AA45645-9042-4562-BA7E-4E531CD218CD}

[2011.04.18 14:20:24 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{9A05BF66-D861-43C5-9E6B-835E29BF3444}

[2011.04.17 18:19:01 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{21FBF621-8B06-402E-9520-B7737EE81A54}

[2011.04.16 13:24:05 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{CCB4C19A-0AA1-489A-A6F2-09725F4DA5FF}

[2011.04.15 14:25:17 | 001,395,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfc42.dll

[2011.04.15 14:25:17 | 001,359,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfc42u.dll

[2011.04.15 14:25:16 | 001,164,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc42u.dll

[2011.04.15 14:25:16 | 001,137,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc42.dll

[2011.04.15 14:25:14 | 000,476,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll

[2011.04.15 14:25:14 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll

[2011.04.15 14:25:12 | 000,852,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2011.04.15 14:25:11 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2011.04.15 14:25:11 | 000,612,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2011.04.15 14:25:05 | 000,367,104 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll

[2011.04.15 14:25:05 | 000,294,912 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll

[2011.04.15 14:25:04 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll

[2011.04.15 14:25:04 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll

[2011.04.15 14:24:45 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2011.04.15 14:24:45 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll

[2011.04.15 14:24:44 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll

[2011.04.15 14:24:44 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2011.04.15 14:24:44 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll

[2011.04.15 14:24:44 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

[2011.04.15 14:24:44 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2011.04.15 14:24:44 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll

[2011.04.15 14:24:44 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll

[2011.04.15 14:24:43 | 000,482,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec

[2011.04.15 14:24:43 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec

[2011.04.15 14:24:43 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll

[2011.04.15 14:24:43 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe

[2011.04.15 14:24:43 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe

[2011.04.15 14:24:01 | 000,356,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dnsapi.dll

[2011.04.15 14:24:01 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dnscacheugc.exe

[2011.04.15 14:24:01 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dnscacheugc.exe

[2011.04.15 14:23:54 | 000,640,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.efi

[2011.04.15 14:23:54 | 000,603,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.exe

[2011.04.15 14:23:54 | 000,556,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.efi

[2011.04.15 14:23:54 | 000,518,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.exe

[2011.04.15 14:23:54 | 000,020,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kdusb.dll

[2011.04.15 14:23:54 | 000,019,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kd1394.dll

[2011.04.15 14:23:54 | 000,017,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kdcom.dll

[2011.04.15 14:23:51 | 000,267,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\FXSCOVER.exe

[2011.04.15 14:05:28 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{2487BBAA-D798-46BD-ACBB-021ECED5301D}

[2011.04.14 18:13:36 | 000,000,000 | ---D | C] -- C:\Windows\Minidump

[2011.04.14 17:03:04 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{C804AA10-5B35-4632-B52E-773AC04E7390}

[2011.04.14 17:03:04 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{6D31EFD8-35CC-45B4-BF02-36E624C8B20C}

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.05.14 01:44:35 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Lisa\Desktop\OTL.exe

[2011.05.14 01:04:02 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2011.05.13 23:53:42 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.05.13 23:50:46 | 007,734,208 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Lisa\Desktop\herbert.exe

[2011.05.13 23:35:17 | 000,013,676 | -HS- | M] () -- C:\Users\Lisa\AppData\Local\v78wmgbt877o6a8hsf684i2w

[2011.05.13 23:35:17 | 000,013,676 | -HS- | M] () -- C:\ProgramData\v78wmgbt877o6a8hsf684i2w

[2011.05.13 23:25:36 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.05.13 21:04:00 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2011.05.13 17:39:10 | 001,529,016 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2011.05.13 17:39:10 | 000,665,078 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2011.05.13 17:39:10 | 000,625,220 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2011.05.13 17:39:10 | 000,134,956 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2011.05.13 17:39:10 | 000,110,600 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2011.05.13 17:21:52 | 000,465,297 | ---- | M] () -- C:\Users\Lisa\Desktop\Unbenannt.png

[2011.05.13 15:40:26 | 000,527,342 | ---- | M] () -- C:\Users\Lisa\Desktop\ly61z.jpg

[2011.05.13 14:37:45 | 000,014,336 | -H-- | M] () -- C:\Users\Lisa\Desktop\photothumb.db

[2011.05.13 14:04:55 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.05.13 14:04:55 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.05.13 13:54:53 | 3191,623,680 | -HS- | M] () -- C:\hiberfil.sys

[2011.05.08 13:12:59 | 000,010,752 | ---- | M] () -- C:\Users\Lisa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.04.27 00:59:55 | 000,001,826 | ---- | M] () -- C:\Users\Public\Desktop\ICQ7.5.lnk

[2011.04.17 20:48:56 | 000,001,089 | ---- | M] () -- C:\Users\Lisa\Dokumente.lnk

[2011.04.16 13:20:52 | 000,289,296 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2011.04.14 18:13:09 | 457,469,474 | ---- | M] () -- C:\Windows\MEMORY.DMP

 
 ========== Files Created - No Company Name ==========

 

[2011.05.13 23:53:42 | 000,001,111 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.05.13 17:21:51 | 000,465,297 | ---- | C] () -- C:\Users\Lisa\Desktop\Unbenannt.png

[2011.05.13 16:34:42 | 000,013,676 | -HS- | C] () -- C:\Users\Lisa\AppData\Local\v78wmgbt877o6a8hsf684i2w

[2011.05.13 16:34:42 | 000,013,676 | -HS- | C] () -- C:\ProgramData\v78wmgbt877o6a8hsf684i2w

[2011.05.13 15:39:17 | 000,527,342 | ---- | C] () -- C:\Users\Lisa\Desktop\ly61z.jpg

[2011.05.08 00:19:11 | 000,000,957 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk

[2011.04.29 18:56:07 | 000,014,336 | -H-- | C] () -- C:\Users\Lisa\Desktop\photothumb.db

[2011.04.27 00:59:55 | 000,001,826 | ---- | C] () -- C:\Users\Public\Desktop\ICQ7.5.lnk

[2011.04.17 20:48:56 | 000,001,089 | ---- | C] () -- C:\Users\Lisa\Dokumente.lnk

[2011.04.14 18:13:09 | 457,469,474 | ---- | C] () -- C:\Windows\MEMORY.DMP

[2010.12.25 03:23:40 | 000,010,752 | ---- | C] () -- C:\Users\Lisa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.12.25 02:08:11 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2010.12.24 23:38:35 | 001,529,442 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2010.10.25 08:41:04 | 000,134,592 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin

[2010.10.25 08:39:18 | 000,000,035 | ---- | C] () -- C:\Windows\DELL_LANGCODE.ini

[2010.10.25 08:39:18 | 000,000,033 | ---- | C] () -- C:\Windows\DELL_OSTYPE.ini

[2010.10.25 08:39:18 | 000,000,023 | ---- | C] () -- C:\Windows\WisSysInfo.ini

[2010.10.25 08:39:17 | 000,000,324 | ---- | C] () -- C:\Windows\Prelaunch.ini

[2010.10.25 08:39:17 | 000,000,271 | ---- | C] () -- C:\Windows\WisPriority.ini

[2010.10.25 08:39:17 | 000,000,032 | ---- | C] () -- C:\Windows\WisHWDest.ini

[2010.10.25 08:39:17 | 000,000,028 | ---- | C] () -- C:\Windows\WisLangCode.ini

[2010.10.25 07:01:55 | 000,000,075 | RHS- | C] () -- C:\Windows\CT4CET.bin

[2010.08.25 20:34:30 | 000,982,240 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin

[2010.08.25 20:34:30 | 000,439,308 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin

[2010.08.25 20:34:30 | 000,092,356 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin

[2010.08.25 19:52:00 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll

[2010.08.25 19:52:00 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll

[2009.07.14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT

[2009.07.14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat

[2009.07.14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll

[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

 
 ========== LOP Check ==========

 

[2011.03.12 21:54:49 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\.purple

[2011.03.26 22:21:05 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\DVDVideoSoft

[2010.12.24 22:58:00 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.03.14 21:49:48 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\gtk-2.0

[2011.05.13 13:58:19 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\ICQ

[2011.01.07 13:50:18 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\MusE

[2011.03.21 15:55:36 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\ooVoo Details

[2010.12.24 23:36:35 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\OpenOffice.org

[2010.12.26 22:57:51 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\PhotoScape

[2011.05.12 20:26:59 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\SoftGrid Client

[2011.03.26 23:12:27 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\TeamViewer

[2010.12.24 23:39:33 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\TP

[2011.04.23 20:04:17 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 
 

< End of report >

Extras:

Code:

OTL Extras logfile created on: 14.05.2011 01:47:26 - Run 1

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\Lisa\Desktop

64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 45,00% Memory free

8,00 Gb Paging File | 5,00 Gb Available in Paging File | 58,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 451,01 Gb Total Space | 388,16 Gb Free Space | 86,06% Space Free | Partition Type: NTFS

Drive E: | 7,51 Gb Total Space | 2,13 Gb Free Space | 28,39% Space Free | Partition Type: FAT32

Drive F: | 3,80 Gb Total Space | 2,31 Gb Free Space | 60,87% Space Free | Partition Type: FAT32

 

Computer Name: DELLA | User Name: Lisa | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %* File not found

cmdfile [open] -- "%1" %* File not found

comfile [open] -- "%1" %* File not found

exefile [open] -- "%1" %* File not found

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- Reg Error: Key error.

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %* File not found

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1" File not found

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found

scrfile [open] -- "%1" /S File not found

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- Reg Error: Key error.

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant

"{26A24AE4-039D-4CA4-87B4-2F86416020FF}" = Java(TM) 6 Update 20 (64-bit)

"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022

"{77B8B4A5-EE79-4907-A318-2DA86325B8D7}" = iTunes

"{87CF757E-C1F1-4D22-865C-00C6950B5258}" = Quickset64

"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad

"{C73A3942-84C8-4597-9F9B-EE227DCBA758}" = Dell Dock

"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector

"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter

"{E4F5E48E-7155-4CF9-88CD-7F377EC9AC54}" = Bonjour

"{E5C95CA5-4565-4B9D-97ED-05088D775614}" = Apple Mobile Device Support

"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"CCleaner" = CCleaner

"HDMI" = Intel(R) Graphics Media Accelerator Driver

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"WinGimp-2.0_is1" = GIMP 2.6.8

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion

"{052bac4a-6f79-46d4-a024-1ce1b4f73cd4}" = Microsoft Visual C++ 2005 Redistributable

"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer

"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell DataSafe Local Backup

"{13766F76-6C8C-4E57-A9F3-3212D1C6E0D1}" = Dell DataSafe Online

"{13B792AA-C078-43A4-8A3A-8B12D629940D}" = Counter-Strike 1.6

"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources

"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update

"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions

"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery

"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack

"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology

"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3

"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime

"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator

"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE

"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5

"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{77F8A71E-3515-4832-B8B2-2F1EDBD2E0F1}" = Bing Bar

"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core

"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide

"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform

"{8570AE7F-183B-44A6-AC03-416C0B8B1000}" = SA31xx Device Manager & Media Converter

"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer

"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT

"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch

"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker

"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail

"{A33E7B0C-B99C-4EC9-B702-8A328B161AF9}" = Roxio Burn

"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer

"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9.5

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell DataSafe Local Backup - Support Software

"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common

"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer

"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.3 - Deutsch

"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie

"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail

"{B2E47DE7-800B-40BB-BD1F-9F221C3AEE87}" = Roxio Burn

"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common

"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform

"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64

"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform

"{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}" = OpenOffice.org 3.2

"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10

"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)

"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker

"{E572B060-C98B-4984-A48E-E4FA56265903}" = SA31xx Device Manager & Media Converter

"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack

"{E7D93321-D301-46D1-A56A-2AD87A281CD8}" = Audials

"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger

"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center

"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Advanced Audio FX Engine" = Advanced Audio FX Engine

"Audacity_is1" = Audacity 1.2.6

"Counter-Strike: Source v17" = Counter-Strike: Source v17

"Dell Dock" = Dell Dock

"Dell Webcam Central" = Dell Webcam Central

"Free Studio_is1" = Free Studio version 5.0.8

"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9.5

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)

"MSC" = McAfee Security Center

"MuseScore" = MuseScore 0.9.6.3 MuseScore score typesetter

"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010

"PhotoScape" = PhotoScape

"Picasa 3" = Picasa 3

"TeamViewer 6" = TeamViewer 6

"Uninstall_is1" = Uninstall 1.0.0.1

"WildTangent dell Master Uninstall" = WildTangent-Spiele

"WinGimp-2.0_is1" = GIMP 2.6.11

"WinLiveSuite" = Windows Live Essentials

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 02.05.2011 10:50:25 | Computer Name = Della | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 02.05.2011 10:50:25 | Computer Name = Della | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 6489

 

Error - 02.05.2011 10:50:25 | Computer Name = Della | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 6489

 

Error - 02.05.2011 11:19:38 | Computer Name = Della | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 02.05.2011 11:19:38 | Computer Name = Della | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 1760221

 

Error - 02.05.2011 11:19:38 | Computer Name = Della | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 1760221

 

Error - 02.05.2011 11:20:05 | Computer Name = Della | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 02.05.2011 11:20:05 | Computer Name = Della | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 2356

 

Error - 02.05.2011 11:20:05 | Computer Name = Della | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 2356

 

Error - 02.05.2011 13:03:37 | Computer Name = Della | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: ICQ.exe, Version: 7.5.0.5238, Zeitstempel:

 0x4daad859  Name des fehlerhaften Moduls: xprt6.dll, Version: 6.8.9.6479, Zeitstempel:

 0x4d998fdf  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0000cd4c  ID des fehlerhaften Prozesses:

 0x10c0  Startzeit der fehlerhaften Anwendung: 0x01cc08e0ce09a744  Pfad der fehlerhaften

 Anwendung: C:\Program Files (x86)\ICQ7.5\ICQ.exe  Pfad des fehlerhaften Moduls: C:\Program

 Files (x86)\ICQ7.5\xprt6.dll  Berichtskennung: 1e625e5c-74de-11e0-ad7a-f04da2a48db4

 

[ Dell Events ]

Error - 30.01.2011 07:15:28 | Computer Name = Della | Source = DataSafe | ID = 17

Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.

 

Error - 22.02.2011 12:46:46 | Computer Name = Della | Source = DataSafe | ID = 17

Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.

 

Error - 22.02.2011 12:46:46 | Computer Name = Della | Source = DataSafe | ID = 17

Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.

 

Error - 30.03.2011 09:54:24 | Computer Name = Della | Source = DataSafe | ID = 17

Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.

 

Error - 30.03.2011 09:54:24 | Computer Name = Della | Source = DataSafe | ID = 17

Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.

 

Error - 01.04.2011 09:29:37 | Computer Name = Della | Source = DataSafe | ID = 17

Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.

 

Error - 01.04.2011 09:29:37 | Computer Name = Della | Source = DataSafe | ID = 17

Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.

 

Error - 25.04.2011 14:31:17 | Computer Name = Della | Source = DataSafe | ID = 17

Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.

 

Error - 25.04.2011 14:31:17 | Computer Name = Della | Source = DataSafe | ID = 17

Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.

 

Error - 02.05.2011 14:32:26 | Computer Name = Della | Source = DataSafe | ID = 17

Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.

 

[ System Events ]

Error - 24.04.2011 11:45:55 | Computer Name = Della | Source = BROWSER | ID = 8032

Description = 

 

Error - 24.04.2011 17:30:34 | Computer Name = Della | Source = BROWSER | ID = 8032

Description = 

 

Error - 25.04.2011 11:42:17 | Computer Name = Della | Source = BROWSER | ID = 8032

Description = 

 

Error - 25.04.2011 14:41:55 | Computer Name = Della | Source = BROWSER | ID = 8032

Description = 

 

Error - 25.04.2011 17:23:56 | Computer Name = Della | Source = Service Control Manager | ID = 7034

Description = Dienst "Dienst "Bonjour"" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

Error - 26.04.2011 17:27:48 | Computer Name = Della | Source = DCOM | ID = 10010

Description = 

 

Error - 26.04.2011 17:28:12 | Computer Name = Della | Source = DCOM | ID = 10010

Description = 

 

Error - 26.04.2011 18:14:42 | Computer Name = Della | Source = Service Control Manager | ID = 7034

Description = Dienst "Dienst "Bonjour"" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

Error - 27.04.2011 08:16:16 | Computer Name = Della | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.

 

Error - 27.04.2011 11:55:25 | Computer Name = Della | Source = EventLog | ID = 6008

Description = Das System wurde zuvor am ?27.?04.?2011 um 17:53:45 unerwartet heruntergefahren.

 

 

< End of report >

schon mal im Voraus danke :)

Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.

Code:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org
 

Datenbank Version: 6576
 

Windows 6.1.7600

Internet Explorer 8.0.7600.16385
 

14.05.2011 17:38:50

mbam-log-2011-05-14 (17-38-50).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|Q:\|)

Durchsuchte Objekte: 355658

Laufzeit: 1 Stunde(n), 17 Minute(n), 21 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

und

Code:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org
 

Datenbank Version: 6576
 

Windows 6.1.7600

Internet Explorer 8.0.7600.16385
 

14.05.2011 18:30:55

mbam-log-2011-05-14 (18-30-55).txt
 

Art des Suchlaufs: Quick-Scan

Durchsuchte Objekte: 154623

Laufzeit: 4 Minute(n), 23 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

[2011.05.09 15:35:06 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{2A9A5505-7705-43C6-9922-9C192959A55B}

[2011.05.08 13:12:30 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{C6B535FD-FEBE-425F-886F-7380D671DD7D}

[2011.05.07 21:32:32 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{E241A777-8A61-4199-802B-A4A4F8056428}

[2011.05.06 15:45:51 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{2EE56242-F29D-479B-AEEB-E0EE17A8FAF1}

[2011.05.05 19:25:35 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{F445BEA7-30FE-4C62-8DE9-BC13922BF38A}

[2011.05.04 14:01:07 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{595AEA8F-94FF-41CD-AEFB-25C3E2E8D948}

[2011.05.03 13:53:34 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{4974C675-379A-4803-967A-7BE7CBB28252}

[2011.05.02 14:13:27 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{59BD6C0A-6D4A-4EC1-9033-7786EC72AED0}

[2011.05.02 00:24:15 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{54AF67C3-B797-4346-894F-0F6397C50BED}

[2011.05.01 12:23:39 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{32D27882-1170-4017-A9DC-B1743CE9278F}

[2011.04.30 13:40:05 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{BCB1E4D5-A1E6-4E64-BFE6-BF7895051C47}

[2011.04.29 09:28:41 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{41B7B79C-D0BE-40E6-BBD8-1E0984C14519}

[2011.04.28 18:31:41 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{B6FA83D2-7081-4D79-BB69-30699720E5FE}

[2011.04.26 17:58:00 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{A4E07DDD-1FC4-4562-A662-CAF342307AA8}

[2011.04.25 11:59:10 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{75BB2CC4-D630-4EC4-89FB-65BFF8925639}

[2011.04.24 17:31:13 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{88A0840F-A7F8-4FB4-BA42-EDEA13B8BF79}

[2011.04.23 15:04:49 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{288436B1-65DF-4683-A83E-0464C9B184CF}

[2011.04.22 11:17:26 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{50BF37B4-DACB-4C30-BAC7-1FE695413717}

[2011.04.21 15:40:16 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{9417C413-5515-45C8-981B-D987F000A48E}

[2011.04.20 12:23:52 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{FA9906BB-BB6D-4DDA-9424-0162AEDDEC85}

[2011.04.19 13:19:13 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{1AA45645-9042-4562-BA7E-4E531CD218CD}

[2011.04.18 14:20:24 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{9A05BF66-D861-43C5-9E6B-835E29BF3444}

[2011.04.17 18:19:01 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{21FBF621-8B06-402E-9520-B7737EE81A54}

[2011.04.16 13:24:05 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{CCB4C19A-0AA1-489A-A6F2-09725F4DA5FF}

[2011.04.15 14:05:28 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{2487BBAA-D798-46BD-ACBB-021ECED5301D}

[2011.04.14 17:03:04 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{C804AA10-5B35-4632-B52E-773AC04E7390}

[2011.04.14 17:03:04 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{6D31EFD8-35CC-45B4-BF02-36E624C8B20C}

[2011.05.13 23:35:17 | 000,013,676 | -HS- | M] () -- C:\Users\Lisa\AppData\Local\v78wmgbt877o6a8hsf684i2w

[2011.05.13 23:35:17 | 000,013,676 | -HS- | M] () -- C:\ProgramData\v78wmgbt877o6a8hsf684i2w

:Commands

[purity]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Code:

========== OTL ==========

C:\Users\Lisa\AppData\Local\{2A9A5505-7705-43C6-9922-9C192959A55B} folder moved successfully.

C:\Users\Lisa\AppData\Local\{C6B535FD-FEBE-425F-886F-7380D671DD7D} folder moved successfully.

C:\Users\Lisa\AppData\Local\{E241A777-8A61-4199-802B-A4A4F8056428} folder moved successfully.

C:\Users\Lisa\AppData\Local\{2EE56242-F29D-479B-AEEB-E0EE17A8FAF1} folder moved successfully.

C:\Users\Lisa\AppData\Local\{F445BEA7-30FE-4C62-8DE9-BC13922BF38A} folder moved successfully.

C:\Users\Lisa\AppData\Local\{595AEA8F-94FF-41CD-AEFB-25C3E2E8D948} folder moved successfully.

C:\Users\Lisa\AppData\Local\{4974C675-379A-4803-967A-7BE7CBB28252} folder moved successfully.

C:\Users\Lisa\AppData\Local\{59BD6C0A-6D4A-4EC1-9033-7786EC72AED0} folder moved successfully.

C:\Users\Lisa\AppData\Local\{54AF67C3-B797-4346-894F-0F6397C50BED} folder moved successfully.

C:\Users\Lisa\AppData\Local\{32D27882-1170-4017-A9DC-B1743CE9278F} folder moved successfully.

C:\Users\Lisa\AppData\Local\{BCB1E4D5-A1E6-4E64-BFE6-BF7895051C47} folder moved successfully.

C:\Users\Lisa\AppData\Local\{41B7B79C-D0BE-40E6-BBD8-1E0984C14519} folder moved successfully.

C:\Users\Lisa\AppData\Local\{B6FA83D2-7081-4D79-BB69-30699720E5FE} folder moved successfully.

C:\Users\Lisa\AppData\Local\{A4E07DDD-1FC4-4562-A662-CAF342307AA8} folder moved successfully.

C:\Users\Lisa\AppData\Local\{75BB2CC4-D630-4EC4-89FB-65BFF8925639} folder moved successfully.

C:\Users\Lisa\AppData\Local\{88A0840F-A7F8-4FB4-BA42-EDEA13B8BF79} folder moved successfully.

C:\Users\Lisa\AppData\Local\{288436B1-65DF-4683-A83E-0464C9B184CF} folder moved successfully.

C:\Users\Lisa\AppData\Local\{50BF37B4-DACB-4C30-BAC7-1FE695413717} folder moved successfully.

C:\Users\Lisa\AppData\Local\{9417C413-5515-45C8-981B-D987F000A48E} folder moved successfully.

C:\Users\Lisa\AppData\Local\{FA9906BB-BB6D-4DDA-9424-0162AEDDEC85} folder moved successfully.

C:\Users\Lisa\AppData\Local\{1AA45645-9042-4562-BA7E-4E531CD218CD} folder moved successfully.

C:\Users\Lisa\AppData\Local\{9A05BF66-D861-43C5-9E6B-835E29BF3444} folder moved successfully.

C:\Users\Lisa\AppData\Local\{21FBF621-8B06-402E-9520-B7737EE81A54} folder moved successfully.

C:\Users\Lisa\AppData\Local\{CCB4C19A-0AA1-489A-A6F2-09725F4DA5FF} folder moved successfully.

C:\Users\Lisa\AppData\Local\{2487BBAA-D798-46BD-ACBB-021ECED5301D} folder moved successfully.

C:\Users\Lisa\AppData\Local\{C804AA10-5B35-4632-B52E-773AC04E7390} folder moved successfully.

C:\Users\Lisa\AppData\Local\{6D31EFD8-35CC-45B4-BF02-36E624C8B20C} folder moved successfully.

C:\Users\Lisa\AppData\Local\v78wmgbt877o6a8hsf684i2w moved successfully.

C:\ProgramData\v78wmgbt877o6a8hsf684i2w moved successfully.

========== COMMANDS ==========

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.22.3 log created on 05152011_134443

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Wurde nichts gefunden.

Code:

2011/05/15 13:53:20.0072 4456        TDSS rootkit removing tool 2.5.1.0 May 13 2011 13:20:29

2011/05/15 13:53:22.0085 4456        ================================================================================

2011/05/15 13:53:22.0085 4456        SystemInfo:

2011/05/15 13:53:22.0085 4456        

2011/05/15 13:53:22.0085 4456        OS Version: 6.1.7600 ServicePack: 0.0

2011/05/15 13:53:22.0085 4456        Product type: Workstation

2011/05/15 13:53:22.0085 4456        ComputerName: DELLA

2011/05/15 13:53:22.0085 4456        UserName: Lisa

2011/05/15 13:53:22.0085 4456        Windows directory: C:\Windows

2011/05/15 13:53:22.0085 4456        System windows directory: C:\Windows

2011/05/15 13:53:22.0085 4456        Running under WOW64

2011/05/15 13:53:22.0085 4456        Processor architecture: Intel x64

2011/05/15 13:53:22.0085 4456        Number of processors: 2

2011/05/15 13:53:22.0085 4456        Page size: 0x1000

2011/05/15 13:53:22.0085 4456        Boot type: Normal boot

2011/05/15 13:53:22.0085 4456        ================================================================================

2011/05/15 13:53:22.0412 4456        Initialize success

2011/05/15 13:53:25.0673 3616        ================================================================================

2011/05/15 13:53:25.0673 3616        Scan started

2011/05/15 13:53:25.0673 3616        Mode: Manual; 

2011/05/15 13:53:25.0673 3616        ================================================================================

2011/05/15 13:53:26.0531 3616        1394ohci        (969c91060cbb5d17cb8440b5f78b4c51) C:\Windows\system32\DRIVERS\1394ohci.sys

2011/05/15 13:53:27.0498 3616        ACPI            (794ff35015209b9d44f1360c42c9776d) C:\Windows\system32\DRIVERS\ACPI.sys

2011/05/15 13:53:27.0794 3616        AcpiPmi         (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys

2011/05/15 13:53:28.0137 3616        adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys

2011/05/15 13:53:28.0465 3616        adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys

2011/05/15 13:53:28.0746 3616        adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys

2011/05/15 13:53:29.0151 3616        AFD             (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys

2011/05/15 13:53:29.0463 3616        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys

2011/05/15 13:53:29.0900 3616        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys

2011/05/15 13:53:30.0259 3616        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys

2011/05/15 13:53:30.0665 3616        AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys

2011/05/15 13:53:31.0008 3616        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

2011/05/15 13:53:31.0413 3616        amdsata         (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys

2011/05/15 13:53:31.0772 3616        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys

2011/05/15 13:53:32.0131 3616        amdxata         (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys

2011/05/15 13:53:32.0537 3616        ApfiltrService  (8655a2983a86d6675135b1ff6892055d) C:\Windows\system32\DRIVERS\Apfiltr.sys

2011/05/15 13:53:32.0880 3616        AppID           (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys

2011/05/15 13:53:33.0254 3616        arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys

2011/05/15 13:53:33.0582 3616        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys

2011/05/15 13:53:34.0081 3616        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

2011/05/15 13:53:34.0455 3616        atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys

2011/05/15 13:53:34.0939 3616        athr            (f8633cdd09647a64ee8db550630427ff) C:\Windows\system32\DRIVERS\athrx.sys

2011/05/15 13:53:35.0438 3616        avgntflt        (39c2e2870fc0c2ae0595b883cbe716b4) C:\Windows\system32\DRIVERS\avgntflt.sys

2011/05/15 13:53:35.0781 3616        avipbb          (c98fa6e5ad0e857d22716bd2b8b1f399) C:\Windows\system32\DRIVERS\avipbb.sys

2011/05/15 13:53:36.0203 3616        b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys

2011/05/15 13:53:36.0561 3616        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

2011/05/15 13:53:36.0905 3616        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

2011/05/15 13:53:37.0295 3616        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

2011/05/15 13:53:37.0669 3616        bowser          (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys

2011/05/15 13:53:37.0981 3616        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys

2011/05/15 13:53:38.0387 3616        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys

2011/05/15 13:53:38.0777 3616        Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

2011/05/15 13:53:39.0151 3616        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

2011/05/15 13:53:39.0510 3616        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

2011/05/15 13:53:39.0853 3616        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

2011/05/15 13:53:40.0243 3616        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

2011/05/15 13:53:40.0649 3616        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

2011/05/15 13:53:41.0023 3616        cdrom           (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys

2011/05/15 13:53:41.0398 3616        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys

2011/05/15 13:53:41.0632 3616        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

2011/05/15 13:53:42.0068 3616        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

2011/05/15 13:53:42.0380 3616        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys

2011/05/15 13:53:42.0770 3616        CNG             (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys

2011/05/15 13:53:43.0129 3616        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys

2011/05/15 13:53:43.0457 3616        CompositeBus    (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys

2011/05/15 13:53:43.0800 3616        crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys

2011/05/15 13:53:44.0143 3616        CtClsFlt        (ed5cf92396a62f4c15110dcdb5e854d9) C:\Windows\system32\DRIVERS\CtClsFlt.sys

2011/05/15 13:53:44.0502 3616        DfsC            (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys

2011/05/15 13:53:44.0970 3616        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

2011/05/15 13:53:45.0282 3616        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys

2011/05/15 13:53:45.0656 3616        drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

2011/05/15 13:53:46.0078 3616        DXGKrnl         (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys

2011/05/15 13:53:46.0514 3616        ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys

2011/05/15 13:53:46.0920 3616        elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys

2011/05/15 13:53:47.0232 3616        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys

2011/05/15 13:53:47.0606 3616        exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

2011/05/15 13:53:47.0918 3616        fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

2011/05/15 13:53:48.0293 3616        fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys

2011/05/15 13:53:48.0730 3616        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

2011/05/15 13:53:49.0088 3616        Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

2011/05/15 13:53:49.0572 3616        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys

2011/05/15 13:53:49.0931 3616        FltMgr          (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys

2011/05/15 13:53:50.0274 3616        FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

2011/05/15 13:53:50.0586 3616        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys

2011/05/15 13:53:50.0945 3616        fvevol          (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys

2011/05/15 13:53:51.0304 3616        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys

2011/05/15 13:53:51.0725 3616        GEARAspiWDM     (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

2011/05/15 13:53:52.0193 3616        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

2011/05/15 13:53:52.0505 3616        HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys

2011/05/15 13:53:52.0848 3616        HDAudBus        (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys

2011/05/15 13:53:53.0176 3616        HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys

2011/05/15 13:53:53.0503 3616        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys

2011/05/15 13:53:53.0878 3616        HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys

2011/05/15 13:53:54.0236 3616        HidUsb          (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys

2011/05/15 13:53:54.0626 3616        HpSAMD          (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys

2011/05/15 13:53:55.0048 3616        HTTP            (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys

2011/05/15 13:53:55.0391 3616        hwpolicy        (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys

2011/05/15 13:53:55.0750 3616        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys

2011/05/15 13:53:56.0155 3616        iaStor          (2064090c9faad92c090d77e50e735b2e) C:\Windows\system32\DRIVERS\iaStor.sys

2011/05/15 13:53:56.0576 3616        iaStorV         (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys

2011/05/15 13:53:57.0169 3616        igfx            (677aa5991026a65ada128c4b59cf2bad) C:\Windows\system32\DRIVERS\igdkmd64.sys

2011/05/15 13:53:57.0731 3616        iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

2011/05/15 13:53:58.0136 3616        IntcAzAudAddService (2faaea2dc2719e67fd7c0d51f9e743f7) C:\Windows\system32\drivers\RTKVHD64.sys

2011/05/15 13:53:58.0495 3616        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys

2011/05/15 13:53:58.0854 3616        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

2011/05/15 13:53:59.0197 3616        IpFilterDriver  (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys

2011/05/15 13:53:59.0509 3616        IPMIDRV         (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys

2011/05/15 13:53:59.0806 3616        IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

2011/05/15 13:54:00.0149 3616        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

2011/05/15 13:54:00.0445 3616        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys

2011/05/15 13:54:00.0851 3616        iScsiPrt        (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys

2011/05/15 13:54:01.0241 3616        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys

2011/05/15 13:54:01.0600 3616        kbdhid          (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys

2011/05/15 13:54:01.0958 3616        KSecDD          (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys

2011/05/15 13:54:02.0348 3616        KSecPkg         (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys

2011/05/15 13:54:02.0707 3616        ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

2011/05/15 13:54:03.0097 3616        L1C             (32980b4e711d2ef7128c44dc2cf85706) C:\Windows\system32\DRIVERS\L1C62x64.sys

2011/05/15 13:54:03.0487 3616        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

2011/05/15 13:54:03.0893 3616        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys

2011/05/15 13:54:04.0252 3616        LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys

2011/05/15 13:54:04.0595 3616        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys

2011/05/15 13:54:04.0938 3616        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys

2011/05/15 13:54:05.0297 3616        luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

2011/05/15 13:54:05.0702 3616        megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys

2011/05/15 13:54:06.0077 3616        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys

2011/05/15 13:54:06.0420 3616        Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

2011/05/15 13:54:06.0779 3616        monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

2011/05/15 13:54:07.0138 3616        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys

2011/05/15 13:54:07.0481 3616        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

2011/05/15 13:54:07.0793 3616        mountmgr        (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys

2011/05/15 13:54:08.0167 3616        mpio            (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys

2011/05/15 13:54:08.0526 3616        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

2011/05/15 13:54:09.0010 3616        MRxDAV          (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys

2011/05/15 13:54:09.0415 3616        mrxsmb          (b7f3d2c40bdf8ffb73ebfb19c77734e2) C:\Windows\system32\DRIVERS\mrxsmb.sys

2011/05/15 13:54:09.0774 3616        mrxsmb10        (86c6f88b5168ce21cf8d69d0b3ff5d19) C:\Windows\system32\DRIVERS\mrxsmb10.sys

2011/05/15 13:54:10.0180 3616        mrxsmb20        (b081069251c8e9f42cb8769d07148f9c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

2011/05/15 13:54:10.0523 3616        msahci          (bccf16d5fb1109162380e3e28dc9e4e5) C:\Windows\system32\DRIVERS\msahci.sys

2011/05/15 13:54:10.0928 3616        msdsm           (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys

2011/05/15 13:54:11.0303 3616        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

2011/05/15 13:54:11.0646 3616        mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

2011/05/15 13:54:11.0974 3616        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys

2011/05/15 13:54:12.0426 3616        MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

2011/05/15 13:54:12.0816 3616        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

2011/05/15 13:54:13.0128 3616        MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

2011/05/15 13:54:13.0471 3616        MsRPC           (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys

2011/05/15 13:54:13.0846 3616        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys

2011/05/15 13:54:14.0220 3616        MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

2011/05/15 13:54:14.0563 3616        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys

2011/05/15 13:54:14.0922 3616        Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

2011/05/15 13:54:15.0328 3616        NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

2011/05/15 13:54:15.0749 3616        NDIS            (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys

2011/05/15 13:54:16.0092 3616        NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

2011/05/15 13:54:16.0466 3616        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

2011/05/15 13:54:16.0841 3616        Ndisuio         (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys

2011/05/15 13:54:17.0231 3616        NdisWan         (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys

2011/05/15 13:54:17.0621 3616        NDProxy         (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys

2011/05/15 13:54:17.0980 3616        NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

2011/05/15 13:54:18.0370 3616        NetBT           (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys

2011/05/15 13:54:18.0760 3616        nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys

2011/05/15 13:54:19.0103 3616        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

2011/05/15 13:54:19.0477 3616        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

2011/05/15 13:54:19.0992 3616        Ntfs            (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys

2011/05/15 13:54:20.0335 3616        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

2011/05/15 13:54:20.0663 3616        nvraid          (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys

2011/05/15 13:54:21.0006 3616        nvstor          (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys

2011/05/15 13:54:21.0365 3616        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys

2011/05/15 13:54:21.0677 3616        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys

2011/05/15 13:54:22.0051 3616        Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys

2011/05/15 13:54:22.0410 3616        partmgr         (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys

2011/05/15 13:54:22.0769 3616        pci             (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys

2011/05/15 13:54:23.0112 3616        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys

2011/05/15 13:54:23.0549 3616        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys

2011/05/15 13:54:23.0892 3616        pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

2011/05/15 13:54:24.0298 3616        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

2011/05/15 13:54:24.0719 3616        PptpMiniport    (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys

2011/05/15 13:54:25.0015 3616        Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys

2011/05/15 13:54:25.0390 3616        Psched          (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys

2011/05/15 13:54:25.0764 3616        PxHlpa64        (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys

2011/05/15 13:54:26.0279 3616        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

2011/05/15 13:54:26.0606 3616        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys

2011/05/15 13:54:26.0903 3616        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

2011/05/15 13:54:27.0262 3616        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

2011/05/15 13:54:27.0667 3616        RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

2011/05/15 13:54:28.0010 3616        Rasl2tp         (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys

2011/05/15 13:54:28.0338 3616        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

2011/05/15 13:54:28.0744 3616        RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

2011/05/15 13:54:29.0102 3616        rdbss           (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys

2011/05/15 13:54:29.0461 3616        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

2011/05/15 13:54:29.0851 3616        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

2011/05/15 13:54:30.0257 3616        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

2011/05/15 13:54:30.0600 3616        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

2011/05/15 13:54:30.0974 3616        RDPWD           (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys

2011/05/15 13:54:31.0411 3616        rdyboost        (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys

2011/05/15 13:54:31.0817 3616        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

2011/05/15 13:54:32.0191 3616        RSUSBSTOR       (30f463768d5143bfd7b2df822b53cf4d) C:\Windows\system32\Drivers\RtsUStor.sys

2011/05/15 13:54:32.0316 3616        SASDIFSV        (99df79c258b3342b6c8a5f802998de56) C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS

2011/05/15 13:54:32.0347 3616        SASKUTIL        (2859c35c0651e8eb0d86d48e740388f2) C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS

2011/05/15 13:54:32.0659 3616        sbp2port        (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys

2011/05/15 13:54:32.0971 3616        scfilter        (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys

2011/05/15 13:54:33.0314 3616        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

2011/05/15 13:54:33.0704 3616        Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

2011/05/15 13:54:34.0063 3616        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

2011/05/15 13:54:34.0438 3616        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys

2011/05/15 13:54:34.0812 3616        sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys

2011/05/15 13:54:35.0155 3616        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys

2011/05/15 13:54:35.0545 3616        sffp_sd         (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\DRIVERS\sffp_sd.sys

2011/05/15 13:54:35.0904 3616        sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys

2011/05/15 13:54:36.0294 3616        Sftfs           (72cd52403efc137290cb5a328510ebca) C:\Windows\system32\DRIVERS\Sftfslh.sys

2011/05/15 13:54:36.0700 3616        Sftplay         (31a36ef71af36eabcc4b4f8ab8f76465) C:\Windows\system32\DRIVERS\Sftplaylh.sys

2011/05/15 13:54:37.0043 3616        Sftredir        (2d969194fcc8eb41ed1d52863bfe7f52) C:\Windows\system32\DRIVERS\Sftredirlh.sys

2011/05/15 13:54:37.0370 3616        Sftvol          (08b36d2f63af3ca2248458a4280c0c50) C:\Windows\system32\DRIVERS\Sftvollh.sys

2011/05/15 13:54:37.0698 3616        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys

2011/05/15 13:54:38.0026 3616        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys

2011/05/15 13:54:38.0353 3616        Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

2011/05/15 13:54:38.0774 3616        spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

2011/05/15 13:54:39.0211 3616        srv             (148d50904d2a0df29a19778715eb35bb) C:\Windows\system32\DRIVERS\srv.sys

2011/05/15 13:54:39.0554 3616        srv2            (ce2189fe31d36678ac9eb7ddee08ec96) C:\Windows\system32\DRIVERS\srv2.sys

2011/05/15 13:54:39.0866 3616        srvnet          (cb69edeb069a49577592835659cd0e46) C:\Windows\system32\DRIVERS\srvnet.sys

2011/05/15 13:54:40.0241 3616        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys

2011/05/15 13:54:40.0537 3616        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys

2011/05/15 13:54:41.0130 3616        Tcpip           (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\drivers\tcpip.sys

2011/05/15 13:54:41.0520 3616        TCPIP6          (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\DRIVERS\tcpip.sys

2011/05/15 13:54:41.0910 3616        tcpipreg        (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys

2011/05/15 13:54:42.0238 3616        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

2011/05/15 13:54:42.0659 3616        TDTCP           (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys

2011/05/15 13:54:42.0971 3616        tdx             (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys

2011/05/15 13:54:43.0330 3616        TermDD          (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys

2011/05/15 13:54:43.0704 3616        tssecsrv        (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys

2011/05/15 13:54:44.0016 3616        tunnel          (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys

2011/05/15 13:54:44.0437 3616        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys

2011/05/15 13:54:44.0843 3616        udfs            (31ba4a33afab6a69ea092b18017f737f) C:\Windows\system32\DRIVERS\udfs.sys

2011/05/15 13:54:45.0264 3616        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys

2011/05/15 13:54:45.0638 3616        umbus           (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys

2011/05/15 13:54:46.0013 3616        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys

2011/05/15 13:54:46.0387 3616        USBAAPL64       (f724b03c3dfaacf08d17d38bf3333583) C:\Windows\system32\Drivers\usbaapl64.sys

2011/05/15 13:54:46.0793 3616        usbccgp         (537a4e03d7103c12d42dfd8ffdb5bdc9) C:\Windows\system32\DRIVERS\usbccgp.sys

2011/05/15 13:54:47.0183 3616        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys

2011/05/15 13:54:47.0588 3616        usbehci         (fbb21ebe49f6d560db37ac25fbc68e66) C:\Windows\system32\DRIVERS\usbehci.sys

2011/05/15 13:54:47.0932 3616        usbhub          (6b7a8a99c4a459e73c286a6763ea24cc) C:\Windows\system32\DRIVERS\usbhub.sys

2011/05/15 13:54:48.0322 3616        usbohci         (8c88aa7617b4cbc2e4bed61d26b33a27) C:\Windows\system32\drivers\usbohci.sys

2011/05/15 13:54:48.0665 3616        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

2011/05/15 13:54:49.0008 3616        USBSTOR         (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\DRIVERS\USBSTOR.SYS

2011/05/15 13:54:49.0382 3616        usbuhci         (0b5b3b2df3fd1709618acfa50b8392b0) C:\Windows\system32\DRIVERS\usbuhci.sys

2011/05/15 13:54:49.0804 3616        usbvideo        (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\System32\Drivers\usbvideo.sys

2011/05/15 13:54:50.0178 3616        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys

2011/05/15 13:54:50.0552 3616        vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

2011/05/15 13:54:50.0896 3616        VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

2011/05/15 13:54:51.0254 3616        vhdmp           (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys

2011/05/15 13:54:51.0644 3616        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys

2011/05/15 13:54:52.0019 3616        volmgr          (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys

2011/05/15 13:54:52.0502 3616        volmgrx         (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys

2011/05/15 13:54:52.0846 3616        volsnap         (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys

2011/05/15 13:54:53.0158 3616        vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys

2011/05/15 13:54:53.0470 3616        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys

2011/05/15 13:54:53.0938 3616        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys

2011/05/15 13:54:54.0250 3616        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys

2011/05/15 13:54:54.0608 3616        WANARP          (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys

2011/05/15 13:54:54.0655 3616        Wanarpv6        (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys

2011/05/15 13:54:55.0076 3616        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys

2011/05/15 13:54:55.0498 3616        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

2011/05/15 13:54:55.0903 3616        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

2011/05/15 13:54:56.0246 3616        WimFltr         (b14ef15bd757fa488f9c970eee9c0d35) C:\Windows\system32\DRIVERS\wimfltr.sys

2011/05/15 13:54:56.0558 3616        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

2011/05/15 13:54:57.0011 3616        WinUsb          (4d52c872018af7e18d078978dcc3f6f2) C:\Windows\system32\DRIVERS\WinUsb.sys

2011/05/15 13:54:57.0354 3616        WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys

2011/05/15 13:54:57.0775 3616        ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

2011/05/15 13:54:58.0150 3616        WudfPf          (c63907207b837a5c05cf6d1606aa0008) C:\Windows\system32\drivers\WudfPf.sys

2011/05/15 13:54:58.0477 3616        WUDFRd          (d885a873d733020f8b9b9ff4b1666158) C:\Windows\system32\DRIVERS\WUDFRd.sys

2011/05/15 13:54:58.0852 3616        yukonw7         (b3eeacf62445e24fbb2cd4b0fb4db026) C:\Windows\system32\DRIVERS\yk62x64.sys

2011/05/15 13:54:58.0930 3616        ================================================================================

2011/05/15 13:54:58.0930 3616        Scan finished

2011/05/15 13:54:58.0930 3616        ================================================================================

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Code:

ComboFix 11-05-14.01 - Lisa 15.05.2011  14:04:42.1.2 - x64

Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.4058.2837 [GMT 2:00]

ausgeführt von:: c:\users\Lisa\Desktop\cofi.exe

AV: McAfee Anti-Virus und Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

SP: McAfee Anti-Virus und Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\Install.exe

c:\users\Lisa\AppData\Roaming\Microsoft\Windows\Recent\httpwww.google.deimgresimgurl=httpi94.photobucket.comalbumsl109mp2zonebritinkerbell05.jpg&imgrefurl=httpwww.uns.demitgliedso.URL

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-04-15 bis 2011-05-15  ))))))))))))))))))))))))))))))

.

.

2011-05-15 12:10 . 2011-05-15 12:10        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-05-15 11:44 . 2011-05-15 11:44        --------        d-----w-        C:\_OTL

2011-05-14 11:58 . 2011-05-14 11:58        --------        d-----w-        c:\users\Lisa\AppData\Roaming\Avira

2011-05-14 11:54 . 2011-04-01 15:07        83120        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2011-05-14 11:54 . 2011-04-01 15:07        116568        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2011-05-14 11:54 . 2011-05-14 11:54        --------        d-----w-        c:\programdata\Avira

2011-05-14 11:54 . 2011-05-14 11:54        --------        d-----w-        c:\program files (x86)\Avira

2011-05-14 11:34 . 2011-05-14 11:34        388096        ----a-r-        c:\users\Lisa\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-05-14 11:34 . 2011-05-14 11:34        --------        d-----w-        C:\Hijackthis

2011-05-14 08:46 . 2011-05-14 08:46        --------        d-----w-        c:\users\Lisa\AppData\Roaming\SUPERAntiSpyware.com

2011-05-14 08:46 . 2011-05-14 08:46        --------        d-----w-        c:\programdata\SUPERAntiSpyware.com

2011-05-14 08:45 . 2011-05-14 08:45        --------        d-----w-        c:\programdata\!SASCORE

2011-05-14 08:45 . 2011-05-14 08:46        --------        d-----w-        c:\program files\SUPERAntiSpyware

2011-05-13 21:54 . 2011-05-13 21:54        --------        d-----w-        c:\users\Lisa\AppData\Roaming\Malwarebytes

2011-05-13 21:53 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\SysWow64\drivers\mbamswissarmy.sys

2011-05-13 21:53 . 2011-05-13 21:53        --------        d-----w-        c:\programdata\Malwarebytes

2011-05-13 21:53 . 2011-05-13 21:53        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2011-05-13 21:53 . 2010-12-20 16:08        24152        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-05-13 11:57 . 2011-05-13 11:57        --------        d-----w-        c:\users\Lisa\AppData\Local\{E136828D-ED73-4BC9-A48E-4BEE5E95A751}

2011-05-12 14:10 . 2011-05-12 14:10        --------        d-----w-        c:\users\Lisa\AppData\Local\{434240F1-DB07-4945-8E0A-A7E1E70A7200}

2011-05-11 15:29 . 2011-04-09 06:54        5475712        ----a-w-        c:\windows\system32\ntoskrnl.exe

2011-05-11 15:29 . 2011-04-09 06:21        3967360        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2011-05-11 15:29 . 2011-04-09 06:21        3911552        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2011-05-11 15:29 . 2011-03-29 03:32        343040        ----a-w-        c:\windows\system32\drivers\usbhub.sys

2011-05-11 15:29 . 2011-03-29 03:32        99328        ----a-w-        c:\windows\system32\drivers\usbccgp.sys

2011-05-11 15:29 . 2011-03-29 03:32        324608        ----a-w-        c:\windows\system32\drivers\usbport.sys

2011-05-11 15:29 . 2011-03-29 03:32        52224        ----a-w-        c:\windows\system32\drivers\usbehci.sys

2011-05-11 15:29 . 2011-03-29 03:32        25600        ----a-w-        c:\windows\system32\drivers\usbohci.sys

2011-05-11 15:29 . 2011-03-29 03:32        30720        ----a-w-        c:\windows\system32\drivers\usbuhci.sys

2011-05-11 15:29 . 2011-03-29 03:32        7936        ----a-w-        c:\windows\system32\drivers\usbd.sys

2011-05-11 15:23 . 2011-05-11 15:24        --------        d-----w-        c:\users\Lisa\AppData\Local\{0B332B9D-664A-4D0F-B765-54EDEDAE03BC}

2011-05-10 14:57 . 2011-05-10 14:57        --------        d-----w-        c:\users\Lisa\AppData\Local\{A0168BF8-FD2D-480C-A8E7-07D59CD7F98C}

2011-05-09 15:10 . 2011-05-13 12:37        --------        d-----w-        c:\programdata\Skype Extras

2011-05-09 15:10 . 2011-05-09 15:10        --------        d-----w-        c:\program files (x86)\Common Files\Skype

2011-05-07 22:19 . 2011-05-07 22:19        --------        d-----w-        c:\program files (x86)\Audacity

2011-04-27 13:17 . 2011-02-26 06:23        2870272        ----a-w-        c:\windows\explorer.exe

2011-04-27 13:17 . 2011-02-26 05:33        2614784        ----a-w-        c:\windows\SysWow64\explorer.exe

2011-04-27 13:17 . 2011-03-12 12:03        662528        ----a-w-        c:\windows\system32\XpsPrint.dll

2011-04-27 13:17 . 2011-03-12 11:31        442880        ----a-w-        c:\windows\SysWow64\XpsPrint.dll

2011-04-27 11:42 . 2011-04-27 11:42        --------        d-----w-        c:\users\Lisa\AppData\Local\{F5F3F5C0-2F23-48BB-8295-F5F61151A168}

2011-04-26 22:58 . 2011-05-04 12:00        --------        d-----w-        c:\program files (x86)\ICQ7.5

2011-04-15 12:23 . 2011-03-08 06:14        976896        ----a-w-        c:\windows\system32\inetcomm.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-04-13 22:40 . 2011-04-13 22:40        4284416        ----a-w-        c:\windows\SysWow64\GPhotos.scr

2011-04-06 20:01 . 2010-06-24 09:33        18328        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-03-04 06:17 . 2011-04-27 13:16        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2011-03-04 06:17 . 2011-04-27 13:17        347648        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-06-08 284696]

"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]

"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160]

"Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2010-02-09 1807680]

"RemoteControl9"="c:\program files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe" [2009-07-06 87336]

"PDVD9LanguageShortcut"="c:\program files (x86)\CyberLink\PowerDVD9\Language\Language.exe" [2010-04-14 50472]

"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-03-28 281768]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-16 1324384]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-24 135664]

R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-24 135664]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-05-04 128384]

S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2010-05-21 98208]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-03-28 136360]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]

S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-06-08 13336]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-04-23 483688]

S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-01-13 705856]

S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-03-18 2271608]

S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]

S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-04-23 209768]

S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*Deregistered* - klmd25

.

Inhalt des "geplante Tasks" Ordners

.

2011-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-24 21:49]

.

2011-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-24 21:49]

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-06-15 10918504]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-06-04 392048]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://start.icq.com/

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Free YouTube Download - c:\users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Free YouTube to MP3 Converter - c:\users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe

FF - ProfilePath - c:\users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\yma2uxwn.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/webhp?hl=de

FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=sm&tb_ver=1.2.0&q=

FF - prefs.js: network.proxy.type - 0

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-3496867429-835713656-1144113118-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\S-1-5-21-3496867429-835713656-1144113118-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2011-05-15  14:12:10

ComboFix-quarantined-files.txt  2011-05-15 12:12

.

Vor Suchlauf: 12 Verzeichnis(se), 419.342.430.208 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 419.039.182.848 Bytes frei

.

- - End Of File - - 3679A38CDB78A356EB22E5D4FFF2EA48

Zitat:

AV: McAfee Anti-Virus und Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: McAfee Anti-Virus und Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

Würde ich von abraten, nimm lieber einen reinen Virenscanner wie AntiVir, Avast oder Microsoft Security Essentials.

McAfee hab ich ja gestern schon deinstalliert. Aber anscheinend ist's noch da. :nono:

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

Seccenter::

AV: McAfee Anti-Virus und Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

SP: McAfee Anti-Virus und Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
 

Dirlook::

c:\users\Lisa\AppData\Local\{E136828D-ED73-4BC9-A48E-4BEE5E95A751}

c:\users\Lisa\AppData\Local\{434240F1-DB07-4945-8E0A-A7E1E70A7200}

c:\users\Lisa\AppData\Local\{0B332B9D-664A-4D0F-B765-54EDEDAE03BC}

c:\users\Lisa\AppData\Local\{A0168BF8-FD2D-480C-A8E7-07D59CD7F98C}

c:\users\Lisa\AppData\Local\{F5F3F5C0-2F23-48BB-8295-F5F61151A168}

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Code:

ComboFix 11-05-14.01 - Lisa 15.05.2011  16:00:21.2.2 - x64

Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.4058.2747 [GMT 2:00]

ausgeführt von:: c:\users\Lisa\Desktop\cofi.exe

Benutzte Befehlsschalter :: c:\users\Lisa\Desktop\CFScript.txt

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-04-15 bis 2011-05-15  ))))))))))))))))))))))))))))))

.

.

2011-05-15 14:05 . 2011-05-15 14:05        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-05-15 11:44 . 2011-05-15 11:44        --------        d-----w-        C:\_OTL

2011-05-14 11:58 . 2011-05-14 11:58        --------        d-----w-        c:\users\Lisa\AppData\Roaming\Avira

2011-05-14 11:54 . 2011-04-01 15:07        83120        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2011-05-14 11:54 . 2011-04-01 15:07        116568        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2011-05-14 11:54 . 2011-05-14 11:54        --------        d-----w-        c:\programdata\Avira

2011-05-14 11:54 . 2011-05-14 11:54        --------        d-----w-        c:\program files (x86)\Avira

2011-05-14 11:34 . 2011-05-14 11:34        388096        ----a-r-        c:\users\Lisa\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-05-14 11:34 . 2011-05-14 11:34        --------        d-----w-        C:\Hijackthis

2011-05-14 08:46 . 2011-05-14 08:46        --------        d-----w-        c:\users\Lisa\AppData\Roaming\SUPERAntiSpyware.com

2011-05-14 08:46 . 2011-05-14 08:46        --------        d-----w-        c:\programdata\SUPERAntiSpyware.com

2011-05-14 08:45 . 2011-05-14 08:45        --------        d-----w-        c:\programdata\!SASCORE

2011-05-14 08:45 . 2011-05-14 08:46        --------        d-----w-        c:\program files\SUPERAntiSpyware

2011-05-13 21:54 . 2011-05-13 21:54        --------        d-----w-        c:\users\Lisa\AppData\Roaming\Malwarebytes

2011-05-13 21:53 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\SysWow64\drivers\mbamswissarmy.sys

2011-05-13 21:53 . 2011-05-13 21:53        --------        d-----w-        c:\programdata\Malwarebytes

2011-05-13 21:53 . 2011-05-13 21:53        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2011-05-13 21:53 . 2010-12-20 16:08        24152        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-05-13 11:57 . 2011-05-13 11:57        --------        d-----w-        c:\users\Lisa\AppData\Local\{E136828D-ED73-4BC9-A48E-4BEE5E95A751}

2011-05-12 14:10 . 2011-05-12 14:10        --------        d-----w-        c:\users\Lisa\AppData\Local\{434240F1-DB07-4945-8E0A-A7E1E70A7200}

2011-05-11 15:29 . 2011-04-09 06:54        5475712        ----a-w-        c:\windows\system32\ntoskrnl.exe

2011-05-11 15:29 . 2011-04-09 06:21        3967360        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2011-05-11 15:29 . 2011-04-09 06:21        3911552        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2011-05-11 15:29 . 2011-03-29 03:32        343040        ----a-w-        c:\windows\system32\drivers\usbhub.sys

2011-05-11 15:29 . 2011-03-29 03:32        99328        ----a-w-        c:\windows\system32\drivers\usbccgp.sys

2011-05-11 15:29 . 2011-03-29 03:32        324608        ----a-w-        c:\windows\system32\drivers\usbport.sys

2011-05-11 15:29 . 2011-03-29 03:32        52224        ----a-w-        c:\windows\system32\drivers\usbehci.sys

2011-05-11 15:29 . 2011-03-29 03:32        25600        ----a-w-        c:\windows\system32\drivers\usbohci.sys

2011-05-11 15:29 . 2011-03-29 03:32        30720        ----a-w-        c:\windows\system32\drivers\usbuhci.sys

2011-05-11 15:29 . 2011-03-29 03:32        7936        ----a-w-        c:\windows\system32\drivers\usbd.sys

2011-05-11 15:23 . 2011-05-11 15:24        --------        d-----w-        c:\users\Lisa\AppData\Local\{0B332B9D-664A-4D0F-B765-54EDEDAE03BC}

2011-05-10 14:57 . 2011-05-10 14:57        --------        d-----w-        c:\users\Lisa\AppData\Local\{A0168BF8-FD2D-480C-A8E7-07D59CD7F98C}

2011-05-09 15:10 . 2011-05-13 12:37        --------        d-----w-        c:\programdata\Skype Extras

2011-05-09 15:10 . 2011-05-09 15:10        --------        d-----w-        c:\program files (x86)\Common Files\Skype

2011-05-07 22:19 . 2011-05-07 22:19        --------        d-----w-        c:\program files (x86)\Audacity

2011-04-27 13:17 . 2011-02-26 06:23        2870272        ----a-w-        c:\windows\explorer.exe

2011-04-27 13:17 . 2011-02-26 05:33        2614784        ----a-w-        c:\windows\SysWow64\explorer.exe

2011-04-27 13:17 . 2011-03-12 12:03        662528        ----a-w-        c:\windows\system32\XpsPrint.dll

2011-04-27 13:17 . 2011-03-12 11:31        442880        ----a-w-        c:\windows\SysWow64\XpsPrint.dll

2011-04-27 11:42 . 2011-04-27 11:42        --------        d-----w-        c:\users\Lisa\AppData\Local\{F5F3F5C0-2F23-48BB-8295-F5F61151A168}

2011-04-26 22:58 . 2011-05-04 12:00        --------        d-----w-        c:\program files (x86)\ICQ7.5

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-04-13 22:40 . 2011-04-13 22:40        4284416        ----a-w-        c:\windows\SysWow64\GPhotos.scr

2011-04-06 20:01 . 2010-06-24 09:33        18328        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-03-11 06:19 . 2011-04-15 12:25        1395712        ----a-w-        c:\windows\system32\mfc42.dll

2011-03-11 06:19 . 2011-04-15 12:25        1359872        ----a-w-        c:\windows\system32\mfc42u.dll

2011-03-11 05:40 . 2011-04-15 12:25        1164288        ----a-w-        c:\windows\SysWow64\mfc42u.dll

2011-03-11 05:40 . 2011-04-15 12:25        1137664        ----a-w-        c:\windows\SysWow64\mfc42.dll

2011-03-08 06:14 . 2011-04-15 12:23        976896        ----a-w-        c:\windows\system32\inetcomm.dll

2011-03-08 05:38 . 2011-04-15 12:23        740864        ----a-w-        c:\windows\SysWow64\inetcomm.dll

2011-03-04 06:17 . 2011-04-27 13:16        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2011-03-04 06:17 . 2011-04-27 13:17        347648        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll

2011-03-03 06:17 . 2011-04-15 12:24        182272        ----a-w-        c:\windows\system32\dnsrslvr.dll

2011-03-03 06:14 . 2011-04-15 12:24        30208        ----a-w-        c:\windows\system32\dnscacheugc.exe

2011-03-03 05:27 . 2011-04-15 12:24        28672        ----a-w-        c:\windows\SysWow64\dnscacheugc.exe

2011-03-03 03:58 . 2011-04-15 12:25        3133440        ----a-w-        c:\windows\system32\win32k.sys

2011-02-24 06:30 . 2011-04-15 12:25        476160        ----a-w-        c:\windows\system32\XpsGdiConverter.dll

2011-02-24 06:29 . 2011-04-15 12:24        1197056        ----a-w-        c:\windows\system32\wininet.dll

2011-02-24 06:24 . 2011-04-15 12:24        57856        ----a-w-        c:\windows\system32\licmgr10.dll

2011-02-24 05:32 . 2011-04-15 12:25        288256        ----a-w-        c:\windows\SysWow64\XpsGdiConverter.dll

2011-02-24 05:32 . 2011-04-15 12:24        981504        ----a-w-        c:\windows\SysWow64\wininet.dll

2011-02-24 05:30 . 2011-04-15 12:24        44544        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2011-02-24 05:05 . 2011-04-15 12:24        482816        ----a-w-        c:\windows\system32\html.iec

2011-02-24 04:24 . 2011-04-15 12:24        1638912        ----a-w-        c:\windows\system32\mshtml.tlb

2011-02-24 04:23 . 2011-04-15 12:24        386048        ----a-w-        c:\windows\SysWow64\html.iec

2011-02-24 03:50 . 2011-04-15 12:24        1638912        ----a-w-        c:\windows\SysWow64\mshtml.tlb

2011-02-23 05:16 . 2011-04-15 12:25        461312        ----a-w-        c:\windows\system32\drivers\srv.sys

2011-02-23 05:16 . 2011-04-15 12:25        401920        ----a-w-        c:\windows\system32\drivers\srv2.sys

2011-02-23 05:15 . 2011-04-15 12:25        161792        ----a-w-        c:\windows\system32\drivers\srvnet.sys

2011-02-23 05:15 . 2011-04-15 12:23        157696        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys

2011-02-23 05:15 . 2011-04-15 12:23        286720        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys

2011-02-23 05:15 . 2011-04-15 12:23        126464        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys

2011-02-23 05:15 . 2011-04-15 12:23        90624        ----a-w-        c:\windows\system32\drivers\bowser.sys

2011-02-19 06:36 . 2011-04-15 12:25        46080        ----a-w-        c:\windows\system32\atmlib.dll

2011-02-19 05:32 . 2011-04-15 12:25        34304        ----a-w-        c:\windows\SysWow64\atmlib.dll

2011-02-19 04:13 . 2011-04-15 12:25        367104        ----a-w-        c:\windows\system32\atmfd.dll

2011-02-19 03:37 . 2011-04-15 12:25        294912        ----a-w-        c:\windows\SysWow64\atmfd.dll

2011-02-18 06:37 . 2011-04-15 12:25        612352        ----a-w-        c:\windows\system32\vbscript.dll

2011-02-18 05:36 . 2011-04-15 12:25        428032        ----a-w-        c:\windows\SysWow64\vbscript.dll

.

.

((((((((((((((((((((((((((((((((((((((((((((   Look   )))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Directory of c:\users\Lisa\AppData\Local\{0B332B9D-664A-4D0F-B765-54EDEDAE03BC} ----

.

.

---- Directory of c:\users\Lisa\AppData\Local\{434240F1-DB07-4945-8E0A-A7E1E70A7200} ----

.

.

---- Directory of c:\users\Lisa\AppData\Local\{A0168BF8-FD2D-480C-A8E7-07D59CD7F98C} ----

.

.

---- Directory of c:\users\Lisa\AppData\Local\{E136828D-ED73-4BC9-A48E-4BEE5E95A751} ----

.

.

---- Directory of c:\users\Lisa\AppData\Local\{F5F3F5C0-2F23-48BB-8295-F5F61151A168} ----

.

.

.

(((((((((((((((((((((((((((((   SnapShot@2011-05-15_12.10.24   )))))))))))))))))))))))))))))))))))))))))

.

- 2010-10-27 17:15 . 2011-05-15 12:04        16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2010-10-27 17:15 . 2011-05-15 13:39        16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2010-10-27 17:15 . 2011-05-15 13:39        16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2010-10-27 17:15 . 2011-05-15 12:04        16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2010-12-24 22:49 . 2011-05-15 13:36        265070              c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-06-08 284696]

"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]

"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160]

"Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2010-02-09 1807680]

"RemoteControl9"="c:\program files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe" [2009-07-06 87336]

"PDVD9LanguageShortcut"="c:\program files (x86)\CyberLink\PowerDVD9\Language\Language.exe" [2010-04-14 50472]

"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-03-28 281768]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-16 1324384]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-24 135664]

R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-24 135664]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-05-04 128384]

S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2010-05-21 98208]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-03-28 136360]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]

S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-06-08 13336]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-04-23 483688]

S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-01-13 705856]

S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-03-18 2271608]

S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]

S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-04-23 209768]

S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*Deregistered* - klmd25

.

Inhalt des "geplante Tasks" Ordners

.

2011-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-24 21:49]

.

2011-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-24 21:49]

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-06-15 10918504]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-06-04 392048]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://start.icq.com/

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Free YouTube Download - c:\users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Free YouTube to MP3 Converter - c:\users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe

FF - ProfilePath - c:\users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\yma2uxwn.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/webhp?hl=de

FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=sm&tb_ver=1.2.0&q=

FF - prefs.js: network.proxy.type - 0

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-3496867429-835713656-1144113118-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\S-1-5-21-3496867429-835713656-1144113118-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2011-05-15  16:06:49

ComboFix-quarantined-files.txt  2011-05-15 14:06

ComboFix2.txt  2011-05-15 12:12

.

Vor Suchlauf: 15 Verzeichnis(se), 419.071.315.968 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 419.020.505.088 Bytes frei

.

- - End Of File - - FB8943C36A1A58B3AAECD7E193530491

Bitte nun Logs mit GMER und mbrcheck erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg

Anleitung zu mbrcheck:
Downloade Dir MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Gmer hat nichts gefunden, das Log ist leer gewesen.

MBR:

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows 7 Home Premium Edition

Windows Information:                 (build 7600), 64-bit

Base Board Manufacturer:        Dell Inc.

BIOS Manufacturer:                Dell Inc.

System Manufacturer:                Dell Inc.

System Product Name:                Inspiron N5030

Logical Drives Mask:                0x0001000c
 

Kernel Drivers (total 197):

  0x03213000 \SystemRoot\system32\ntoskrnl.exe

  0x037E7000 \SystemRoot\system32\hal.dll

  0x00B9F000 \SystemRoot\system32\kdcom.dll

  0x00CE0000 \SystemRoot\system32\mcupdate_GenuineIntel.dll

  0x00D24000 \SystemRoot\system32\PSHED.dll

  0x00D38000 \SystemRoot\system32\CLFS.SYS

  0x00C00000 \SystemRoot\system32\CI.dll

  0x00E01000 \SystemRoot\system32\drivers\Wdf01000.sys

  0x00EA5000 \SystemRoot\system32\drivers\WDFLDR.SYS

  0x00EB4000 \SystemRoot\system32\DRIVERS\ACPI.sys

  0x00F0B000 \SystemRoot\system32\DRIVERS\WMILIB.SYS

  0x00F14000 \SystemRoot\system32\DRIVERS\msisadrv.sys

  0x00F1E000 \SystemRoot\system32\DRIVERS\pci.sys

  0x00F51000 \SystemRoot\system32\DRIVERS\vdrvroot.sys

  0x00F5E000 \SystemRoot\System32\drivers\partmgr.sys

  0x00F73000 \SystemRoot\system32\DRIVERS\compbatt.sys

  0x00F7C000 \SystemRoot\system32\DRIVERS\BATTC.SYS

  0x00F88000 \SystemRoot\system32\DRIVERS\volmgr.sys

  0x00F9D000 \SystemRoot\System32\drivers\volmgrx.sys

  0x00CC0000 \SystemRoot\System32\drivers\mountmgr.sys

  0x010FD000 \SystemRoot\system32\DRIVERS\iaStor.sys

  0x01307000 \SystemRoot\system32\DRIVERS\atapi.sys

  0x01310000 \SystemRoot\system32\DRIVERS\ataport.SYS

  0x0133A000 \SystemRoot\system32\DRIVERS\msahci.sys

  0x01345000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS

  0x01355000 \SystemRoot\system32\drivers\amdxata.sys

  0x01360000 \SystemRoot\system32\drivers\fltmgr.sys

  0x013AC000 \SystemRoot\system32\drivers\fileinfo.sys

  0x013C0000 \SystemRoot\System32\Drivers\PxHlpa64.sys

  0x01403000 \SystemRoot\System32\Drivers\Ntfs.sys

  0x01000000 \SystemRoot\System32\Drivers\msrpc.sys

  0x015A5000 \SystemRoot\System32\Drivers\ksecdd.sys

  0x0105E000 \SystemRoot\System32\Drivers\cng.sys

  0x015BF000 \SystemRoot\System32\drivers\pcw.sys

  0x015D0000 \SystemRoot\System32\Drivers\Fs_Rec.sys

  0x016E3000 \SystemRoot\system32\drivers\ndis.sys

  0x01600000 \SystemRoot\system32\drivers\NETIO.SYS

  0x01660000 \SystemRoot\System32\Drivers\ksecpkg.sys

  0x01803000 \SystemRoot\System32\drivers\tcpip.sys

  0x0168B000 \SystemRoot\System32\drivers\fwpkclnt.sys

  0x00D96000 \SystemRoot\system32\DRIVERS\volsnap.sys

  0x016D5000 \SystemRoot\System32\Drivers\spldr.sys

  0x01AF5000 \SystemRoot\System32\drivers\rdyboost.sys

  0x01B2F000 \SystemRoot\System32\Drivers\mup.sys

  0x01B41000 \SystemRoot\System32\drivers\hwpolicy.sys

  0x01B4A000 \SystemRoot\System32\DRIVERS\fvevol.sys

  0x01B84000 \SystemRoot\system32\DRIVERS\disk.sys

  0x01B9A000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS

  0x03EA9000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0x03ED3000 \SystemRoot\System32\Drivers\Null.SYS

  0x03EDC000 \SystemRoot\System32\Drivers\Beep.SYS

  0x03EE3000 \SystemRoot\System32\drivers\vga.sys

  0x03EF1000 \SystemRoot\System32\drivers\VIDEOPRT.SYS

  0x03F16000 \SystemRoot\System32\drivers\watchdog.sys

  0x03F26000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0x03F2F000 \SystemRoot\system32\drivers\rdpencdd.sys

  0x03F38000 \SystemRoot\system32\drivers\rdprefmp.sys

  0x03F41000 \SystemRoot\System32\Drivers\Msfs.SYS

  0x03F4C000 \SystemRoot\System32\Drivers\Npfs.SYS

  0x03F5D000 \SystemRoot\system32\DRIVERS\tdx.sys

  0x03F7B000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0x03F88000 \SystemRoot\System32\DRIVERS\netbt.sys

  0x03C00000 \SystemRoot\system32\drivers\afd.sys

  0x03FCD000 \SystemRoot\system32\DRIVERS\wfplwf.sys

  0x03FD6000 \SystemRoot\system32\DRIVERS\pacer.sys

  0x01BD8000 \SystemRoot\system32\DRIVERS\vwififlt.sys

  0x01BEE000 \SystemRoot\system32\DRIVERS\netbios.sys

  0x01A00000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0x01A1B000 \SystemRoot\system32\DRIVERS\termdd.sys

  0x01A2F000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS

  0x01A39000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS

  0x01A43000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0x01A94000 \SystemRoot\system32\drivers\nsiproxy.sys

  0x01AA0000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0x01AAB000 \SystemRoot\System32\drivers\discache.sys

  0x01ABA000 \SystemRoot\System32\Drivers\dfsc.sys

  0x01AD8000 \SystemRoot\system32\DRIVERS\blbdrive.sys

  0x017D5000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0x015DA000 \SystemRoot\system32\DRIVERS\tunnel.sys

  0x04A20000 \SystemRoot\system32\DRIVERS\igdkmd64.sys

  0x0543F000 \SystemRoot\System32\drivers\dxgkrnl.sys

  0x05533000 \SystemRoot\System32\drivers\dxgmms1.sys

  0x05579000 \SystemRoot\system32\DRIVERS\usbuhci.sys

  0x05586000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0x055DC000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0x010D1000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

  0x02E2D000 \SystemRoot\system32\DRIVERS\athrx.sys

  0x02FB6000 \SystemRoot\system32\DRIVERS\vwifibus.sys

  0x02FC3000 \SystemRoot\system32\DRIVERS\L1C62x64.sys

  0x02FD8000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0x0405B000 \SystemRoot\system32\DRIVERS\Apfiltr.sys

  0x040AB000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0x040BA000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0x040C9000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys

  0x040D6000 \SystemRoot\system32\DRIVERS\CmBatt.sys

  0x040DB000 \SystemRoot\system32\DRIVERS\wmiacpi.sys

  0x040E4000 \SystemRoot\system32\DRIVERS\intelppm.sys

  0x040FA000 \SystemRoot\system32\DRIVERS\CompositeBus.sys

  0x0410A000 \SystemRoot\system32\DRIVERS\AgileVpn.sys

  0x04120000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0x04144000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0x04150000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0x0417F000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0x0419A000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0x041BB000 \SystemRoot\system32\DRIVERS\rassstp.sys

  0x041D5000 \SystemRoot\system32\DRIVERS\swenum.sys

  0x04000000 \SystemRoot\system32\DRIVERS\ks.sys

  0x04043000 \SystemRoot\system32\DRIVERS\umbus.sys

  0x04444000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0x0449E000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0x060C3000 \SystemRoot\system32\drivers\RTKVHD64.sys

  0x0630B000 \SystemRoot\system32\drivers\portcls.sys

  0x06348000 \SystemRoot\system32\drivers\drmk.sys

  0x0636A000 \SystemRoot\system32\drivers\ksthunk.sys

  0x06370000 \SystemRoot\System32\Drivers\crashdmp.sys

  0x03C8A000 \SystemRoot\System32\Drivers\dump_iaStor.sys

  0x0637E000 \SystemRoot\System32\Drivers\dump_dumpfve.sys

  0x00010000 \SystemRoot\System32\win32k.sys

  0x06391000 \SystemRoot\System32\drivers\Dxapi.sys

  0x063DB000 \SystemRoot\system32\DRIVERS\usbccgp.sys

  0x063F8000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0x06000000 \SystemRoot\System32\Drivers\usbvideo.sys

  0x0602E000 \SystemRoot\system32\DRIVERS\CtClsFlt.sys

  0x005F0000 \SystemRoot\System32\TSDDD.dll

  0x00710000 \SystemRoot\System32\cdd.dll

  0x06067000 \SystemRoot\system32\drivers\luafv.sys

  0x0608A000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0x060A7000 \SystemRoot\system32\DRIVERS\Sftvollh.sys

  0x0639D000 \SystemRoot\system32\drivers\WudfPf.sys

  0x063BE000 \SystemRoot\system32\DRIVERS\lltdio.sys

  0x044B3000 \SystemRoot\system32\DRIVERS\nwifi.sys

  0x04506000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0x04519000 \SystemRoot\system32\DRIVERS\rspndr.sys

  0x04531000 \SystemRoot\system32\drivers\HTTP.sys

  0x04400000 \SystemRoot\system32\DRIVERS\bowser.sys

  0x0441E000 \SystemRoot\System32\drivers\mpsdrv.sys

  0x02E00000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0x04828000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys

  0x04876000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys

  0x04899000 \SystemRoot\system32\drivers\peauth.sys

  0x0493F000 \SystemRoot\System32\Drivers\secdrv.SYS

  0x0721B000 \SystemRoot\system32\DRIVERS\Sftfslh.sys

  0x072D2000 \SystemRoot\system32\DRIVERS\Sftplaylh.sys

  0x0731F000 \SystemRoot\System32\DRIVERS\srvnet.sys

  0x0734C000 \SystemRoot\System32\drivers\tcpipreg.sys

  0x0735E000 \SystemRoot\System32\DRIVERS\srv2.sys

  0x0494A000 \SystemRoot\System32\DRIVERS\srv.sys

  0x073C5000 \SystemRoot\system32\DRIVERS\Sftredirlh.sys

  0x07CE7000 \SystemRoot\System32\Drivers\fastfat.SYS

  0x07D8E000 \SystemRoot\system32\DRIVERS\hidusb.sys

  0x07D9C000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

  0x07DB5000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

  0x07DBE000 \SystemRoot\system32\DRIVERS\mouhid.sys

  0x07C57000 \SystemRoot\system32\DRIVERS\WUDFRd.sys

  0x07C88000 \SystemRoot\System32\Drivers\usbaapl64.sys

  0x07C99000 \SystemRoot\system32\DRIVERS\WinUsb.sys

  0x07D1D000 \??\C:\Windows\system32\Drivers\PROCEXP113.SYS

  0x07D25000 \SystemRoot\system32\DRIVERS\monitor.sys

  0x77020000 \Windows\System32\ntdll.dll

  0x48330000 \Windows\System32\smss.exe

  0xFF340000 \Windows\System32\apisetschema.dll

  0xFFE50000 \Windows\System32\autochk.exe

  0xFF200000 \Windows\System32\rpcrt4.dll

  0xFF1B0000 \Windows\System32\Wldap32.dll

  0xFF0D0000 \Windows\System32\advapi32.dll

  0x76F00000 \Windows\System32\kernel32.dll

  0x76E00000 \Windows\System32\user32.dll

  0xFEF50000 \Windows\System32\urlmon.dll

  0xFEED0000 \Windows\System32\difxapi.dll

  0xFEE80000 \Windows\System32\ws2_32.dll

  0xFEDB0000 \Windows\System32\usp10.dll

  0xFEB50000 \Windows\System32\iertutil.dll

  0xFEAD0000 \Windows\System32\shlwapi.dll

  0xFEAB0000 \Windows\System32\sechost.dll

  0xFDD20000 \Windows\System32\shell32.dll

  0xFDCB0000 \Windows\System32\gdi32.dll

  0xFDCA0000 \Windows\System32\lpk.dll

  0xFDC00000 \Windows\System32\msvcrt.dll

  0xFDAD0000 \Windows\System32\wininet.dll

  0xFDAB0000 \Windows\System32\imagehlp.dll

  0xFDA10000 \Windows\System32\clbcatq.dll

  0x771F0000 \Windows\System32\psapi.dll

  0xFDA00000 \Windows\System32\nsi.dll

  0xFD8F0000 \Windows\System32\msctf.dll

  0xFD710000 \Windows\System32\setupapi.dll

  0xFD630000 \Windows\System32\oleaut32.dll

  0xFD420000 \Windows\System32\ole32.dll

  0x771E0000 \Windows\System32\normaliz.dll

  0xFD3F0000 \Windows\System32\imm32.dll

  0xFD350000 \Windows\System32\comdlg32.dll

  0xFD1E0000 \Windows\System32\crypt32.dll

  0xFD140000 \Windows\System32\comctl32.dll

  0xFD0D0000 \Windows\System32\KernelBase.dll

  0xFD090000 \Windows\System32\wintrust.dll

  0xFD050000 \Windows\System32\cfgmgr32.dll

  0xFD030000 \Windows\System32\devobj.dll

  0xFD020000 \Windows\System32\msasn1.dll
 

Processes (total 77):

       0 System Idle Process

       4 System

     296 C:\Windows\System32\smss.exe

     412 csrss.exe

     488 C:\Windows\System32\wininit.exe

     508 csrss.exe

     552 C:\Windows\System32\services.exe

     576 C:\Windows\System32\winlogon.exe

     588 C:\Windows\System32\lsass.exe

     596 C:\Windows\System32\lsm.exe

     708 C:\Windows\System32\svchost.exe

     808 C:\Windows\System32\svchost.exe

     908 C:\Windows\System32\svchost.exe

     940 C:\Windows\System32\svchost.exe

     972 C:\Windows\System32\svchost.exe

     428 C:\Windows\System32\svchost.exe

     664 C:\Program Files\Dell\DellDock\DockLogin.exe

     312 C:\Windows\System32\svchost.exe

    1156 C:\Windows\System32\spoolsv.exe

    1244 C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

    1324 C:\Windows\System32\taskhost.exe

    1412 C:\Windows\System32\dwm.exe

    1440 C:\Windows\explorer.exe

    1588 C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

    1676 C:\Windows\System32\igfxtray.exe

    1684 C:\Windows\System32\hkcmd.exe

    1692 C:\Windows\System32\igfxpers.exe

    1240 C:\Windows\System32\svchost.exe

    1988 C:\Program Files\SUPERAntiSpyware\SASCore64.exe

    2024 C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

     592 C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

    2156 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    2180 C:\Program Files (x86)\Bonjour\mDNSResponder.exe

    2236 C:\Windows\System32\svchost.exe

    2292 C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

    2560 C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe

    2616 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

    2648 C:\Windows\System32\svchost.exe

    2684 C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe

    2776 C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe

    2788 C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe

    2816 C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

    2928 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

    2984 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

    1496 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

    1912 C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

    2612 C:\Windows\System32\conhost.exe

    3352 C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

    4068 C:\Windows\System32\SearchIndexer.exe

    3980 C:\Program Files\DellTPad\hidfind.exe

    3392 C:\Windows\System32\svchost.exe

    3532 C:\Program Files\Windows Media Player\wmpnetwk.exe

    4660 C:\Windows\System32\svchost.exe

    5064 dllhost.exe

     900 C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

    4448 C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe

    3700 C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe

    5100 C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe

    3696 C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe

    3428 C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

    2860 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

    4944 C:\Windows\System32\svchost.exe

    1832 C:\Program Files\iPod\bin\iPodService.exe

    1644 WUDFHost.exe

    1004 C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe

    3932 C:\Program Files (x86)\Mozilla Firefox\firefox.exe

    2956 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

    3528 C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Desktop.exe

    4092 C:\Program Files (x86)\TeamViewer\Version6\tv_w32.exe

    1948 C:\Program Files (x86)\TeamViewer\Version6\tv_x64.exe

    4792 C:\Windows\System32\SearchProtocolHost.exe

    3616 C:\Windows\System32\SearchFilterHost.exe

    2908 C:\Windows\System32\audiodg.exe

    2668 dllhost.exe

    3140 dllhost.exe

    4940 C:\Users\Lisa\Downloads\MBRCheck.exe

    3492 C:\Windows\System32\conhost.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000003`afd00000  (NTFS)

\\.\Q: -->  error 5
 

PhysicalDrive0 Model Number: WDCWD5000BEVT-75A0RT0, Rev: 01.01A01
 

      Size  Device Name          MBR Status

  --------------------------------------------

    465 GB  \\.\PhysicalDrive0   Windows 7 MBR code detected

            SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79
 
 

Done!