Systemwiederherstellung nach Virus

Kurz:
Nein!
Der >Virus oder Trojaner auch der Wurm bleiben in der exe. von xy quasie haften!!!

Da ist nix mit der Systemwiederherstellung, da sich das Teil wieder Aktiviert!

Außerdem ein Tip:

Wenn du Scannen mußt dann beachte!
Neustart und F8 Taste drücken, dort in den Abgesicherten Modus gehen, dann

ME/XP

Wenn ein Computer mit einem Virus, Wurm oder Trojanischen Pferd infiziert ist, wurde die infizierte Datei möglicherweise in die Sicherung mit einbezogen. Nachdem ein Virenscanner den Rechner gesäubert hat, und dieser neu gestartet wurde, kopiert die Systemwiederherstellung von Windows die infizierte Datei wieder zurück in das eben gesäuberte System, da es die Änderung durch den Virenscanner entdeckt und diesen "Fehler" ausgleichen will.
Durch das Deaktivieren der Systemwiederherstellung werden alle gesicherten Systemzustände gelöscht! Ein Wiederherstellen einer infizierten, gesicherten Datei ist damit nicht mehr möglich.
Nach der Entfernung des Virus bzw. Wurms muss die Systemwiederherstellung wieder aktiviert werden.
Beschreibung:
Deaktivierung der Systemwiederherstellung von  Windows XP:
Das geschieht in folgenden Schritten.
1.   rechte Maustaste auf Arbeitsplatz, Eigenschaften wählen.
2.   Systemwiederherstellung wählen und Systemwiederherstellung auf allen Laufwerken deaktivieren wählen.

Dann erst Scannen

Am besten auch mit SpywareTools, vorher Aktualisieren
Spybot oder AdAware
hier unter Downloads

  Ich bedanke mich ganz herzlich für deine Tips

Gruß Carola

Hallo! Das hier ist zwar schon ein alter Thread, aber ich habe eine ähnliche Frage:

Und zwar hab ich mir neulich den koobface Virus eingefangen...ich hab das noch am selben Tag (nach vllt zwei Stunden) gemerkt und sogleich versucht ihn zu beseitigen.
Dieser Virus war in der Anwendung "freddy75.exe" angelegt. Diese Anwendung hab ich über laufende Prozesse entdeckt, und den laufenden Prozess sogleich deaktiviert. Nachdem ich die Anwendung aber nicht manuell oder mit Scanner entfernen konnte hab ich mich natürlich im Internet umgeschaut.
Dann habe ich Avenger benutzt und die Registry Einträge (reg-key) gelöscht.
So, weil der Pfad (wie ich später festgestellt hab) für freddy75.exe falsch angegeben war wurde der natürlich nicht entfernt. Danach hab ich das System im abgesicherten Modus gestartet (weil der Bildschirm Desktop nicht mehr ansprang...).
In dem Modus hatte ich dann die Autorität diese Anwendung zu löschen. Das hab ich erledigt (in den Papierkorb und weg...) und danach hab ich ne Systemwiederherstellung auf drei Tage vor dem Virusdownload/installation gemacht.
Die war erfolgreich und danach dachte ich war alles ok...weil die Scanner liefen ohne Fund und sonst war eigentlich alles wieder normal!
Dann hab ich was bei Windows Defender entdeckt (der Zeitpunkt dieses Fundes war vor der Systemwiederherstellung!):

 

Beschreibung:
Das Verhalten dieses Programms ist potenziell unerwünscht.

Empfehlung:
Lassen Sie dieses entdeckte Element nur zu, wenn Sie dem Programm oder dem Softwareherausgeber vertrauen.

Ressourcen:
regkey:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\sysldtray

runkey:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\sysldtray

file:
c:\windows\ld15.exe

Dasselbe hat er mir auch für die Datei freddy75.exe angezeigt. ld15.exe ist eine weitere Anwendung des Koobface Wurms. Aber im Ordner C:\windows existierte diese Datei nicht mehr. Auch der Defender findet sie nicht mehr!
Ist die nun möglicherweise mit der Systemwiederherstellung verschwunden?? Ist mein PC wieder sicher vor dem Virus?
Der Virus zeigte soweit keine weitere Aktivität...
Hat jemand eine Ahnung ob ich mir keine Sorgen mehr machen muss?

Verwendete Programme (alle erfolglos bei der Virussuche)

Avira Antivir Premium
HijackThis
Malwarebytes' Anti-Malware

System: Windows Vista Home Premium

Avenger_report:

 

Registry value "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|sysldtray" deleted successfully.

Registry value "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|sysfbtray" deleted successfully.

Danke im Voraus für Antworten!

Wie kommt man darauf das man einfach mal so Avenger versucht. Das kann zum Deadlook führen. Avenger löscht, egal was. 


schritt 1

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die OTL.exe.
  Vista-User mit Rechtsklick "als Administrator starten"
  
• Kopiere nun den Inhalt in die Textbox.

netsvcs
%SYSTEMDRIVE%\*.exe
%SYSTEMDRIVE%\eventlog.dll /s /md5
%SYSTEMDRIVE%\scecli.dll /s /md5
%SYSTEMDRIVE%\netlogon.dll /s /md5
%SYSTEMDRIVE%\cngaudit.dll /s /md5
%SYSTEMDRIVE%\sceclt.dll /s /md5
%SYSTEMDRIVE%\ntelogon.dll /s /md5
%SYSTEMDRIVE%\logevent.dll /s /md5
%SYSTEMDRIVE%\iaStor.sys /s /md5
%SYSTEMDRIVE%\nvstor.sys /s /md5
%SYSTEMDRIVE%\atapi.sys /s /md5
%SYSTEMDRIVE%\IdeChnDr.sys /s /md5
%SYSTEMDRIVE%\viasraid.sys /s /md5
%SYSTEMDRIVE%\AGP440.sys /s /md5
%SYSTEMDRIVE%\vaxscsi.sys /s /md5
%SYSTEMDRIVE%\nvatabus.sys /s /md5
CREATERESTOREPOINT


• Schliesse bitte nun alle Programme. (Wichtig)
  
• Klicke nun bitte auf den Quick Scan Button.
  
• Klick auf .
  
• Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Code-Tags[/url] in Deinen Thread

schritt 2

Während dieser Scans soll(en):

• alle anderen Scanner gegen Viren, Spyware, usw. deaktiviert sein,
• keine Verbindung zu einem Netzwerk/Internet bestehen (WLAN nicht vergessen),
• nichts am Rechner getan werden,
  
• nach jedem Scan der Rechner neu gestartet werden.

Rootkitscan mit RootRepeal

• Gehe hierhin, scrolle runter und downloade RootRepeal.zip.
  
• Entpacke die Datei auf Deinen Desktop.
• Doppelklicke die RootRepeal.exe, um den Scanner zu starten.
• Klicke auf den Reiter Report und dann auf den Button Scan.
  
• Mache einen Haken bei den folgenden Elementen und klicke Ok.

.
Drivers
Files
Processes
SSDT
Stealth Objects
Hidden Services
Shadow SSDT
.

• Im Anschluss wirst Du gefragt, welche Laufwerke gescannt werden sollen.
• Wähle C:\ und klicke wieder Ok.
• Der Suchlauf beginnt automatisch, es wird eine Weile dauern, bitte Geduld.
• Wenn der Suchlauf beendet ist, klicke auf Save Report.
  
• Speichere das Logfile als RootRepeal.txt auf dem Desktop.
• Kopiere den Inhalt hier in den Thread.

Also, erstmal danke für die kompetente Antwort
Aber irgendwie funktionieren die Code-Tags bei mir nicht gscheit....der sagt mir das die maximale Zeichenanzahl erreicht ist...also trenn ich die Berichte einfach mal.
Erstmal nur die OTL.txt und Extras.txt, der Root Repeal Scan kommt aus Zeitgründen später nach:

OTL.txt:

OTL logfile created on: 25.11.2009 13:07:46 - Run 1
OTL by OldTimer - Version 3.1.10.0     Folder = C:\Users\Grimm\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18828)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,13 Gb Available Physical Memory | 56,77% Memory free
4,00 Gb Paging File | 3,09 Gb Available in Paging File | 77,24% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 454,10 Gb Total Space | 364,38 Gb Free Space | 80,24% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: GRIMM-PC
Current User Name: Grimm
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2009.11.25 13:04:10 | 00,531,968 | ---- | M] (OldTimer Tools) -- C:\Users\Grimm\Desktop\OTL.exe
PRC - [2009.10.28 20:21:26 | 00,141,600 | ---- | M] (Apple Inc.) -- C:\Programme\iTunes\iTunesHelper.exe
PRC - [2009.10.28 20:21:14 | 00,545,568 | ---- | M] (Apple Inc.) -- C:\Programme\iPod\bin\iPodService.exe
PRC - [2009.08.28 18:42:54 | 00,144,672 | ---- | M] (Apple Inc.) -- C:\Programme\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2009.08.07 10:22:09 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2009.07.26 15:44:14 | 03,883,840 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Messenger\msnmsgr.exe
PRC - [2009.07.25 04:23:12 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Java\jre6\bin\jusched.exe
PRC - [2009.07.01 22:12:46 | 00,623,960 | ---- | M] (Research In Motion Limited) -- C:\Programme\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
PRC - [2009.06.09 10:23:36 | 00,434,945 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe
PRC - [2009.06.09 10:23:36 | 00,194,817 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe
PRC - [2009.06.09 10:23:36 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2009.06.01 21:20:12 | 00,222,968 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe
PRC - [2009.04.21 13:39:16 | 24,264,488 | R--- | M] (Skype Technologies S.A.) -- C:\Programme\Skype\Phone\Skype.exe
PRC - [2009.04.21 13:39:16 | 00,077,360 | R--- | M] (Skype Technologies) -- C:\Programme\Skype\Plugin Manager\skypePM.exe
PRC - [2009.04.11 07:28:15 | 00,247,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbem\WmiPrvSE.exe
PRC - [2009.04.11 07:28:08 | 00,037,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbem\unsecapp.exe
PRC - [2009.04.11 07:28:03 | 01,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 07:27:36 | 02,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.03.20 12:37:17 | 00,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2009.03.01 11:59:42 | 00,172,792 | ---- | M] (ICQ, LLC.) -- C:\Programme\ICQ6.5\ICQ.exe
PRC - [2009.02.06 16:07:48 | 00,027,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Contacts\wlcomm.exe
PRC - [2008.12.20 06:50:34 | 02,656,528 | ---- | M] () -- C:\Programme\Logitech\QuickCam\Quickcam.exe
PRC - [2008.12.20 06:46:58 | 00,558,864 | ---- | M] () -- C:\Programme\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2008.12.16 20:59:50 | 00,150,040 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
PRC - [2008.12.12 10:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Programme\Bonjour\mDNSResponder.exe
PRC - [2008.10.24 08:14:36 | 00,206,112 | ---- | M] (Macrovision Corporation) -- C:\Programme\Common Files\InstallShield\UpdateService\ISUSPM.exe
PRC - [2008.01.19 08:38:38 | 01,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2008.01.19 08:33:40 | 00,142,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WUDFHost.exe
PRC - [2008.01.19 08:33:39 | 00,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.19 08:33:39 | 00,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2008.01.19 08:33:09 | 00,125,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehtray.exe
PRC - [2008.01.19 08:33:09 | 00,037,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehmsas.exe
PRC - [2007.12.05 03:54:55 | 00,626,688 | ---- | M] (ATI Technologies Inc.) -- C:\Windows\System32\Ati2evxx.exe
PRC - [2007.12.05 03:54:55 | 00,626,688 | ---- | M] (ATI Technologies Inc.) -- C:\Windows\System32\Ati2evxx.exe
PRC - [2007.10.15 10:15:08 | 01,410,344 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Lib\NMIndexStoreSvr.exe
PRC - [2007.10.15 10:15:08 | 00,382,248 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Lib\NMIndexingService.exe
PRC - [2007.10.15 10:14:48 | 00,202,024 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Lib\NMBgMonitor.exe
PRC - [2007.10.01 10:53:50 | 04,702,208 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007.09.20 09:51:46 | 01,836,328 | ---- | M] (Nero AG) -- C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
PRC - [2007.09.20 09:51:46 | 00,853,288 | ---- | M] (Nero AG) -- C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe
PRC - [2007.08.23 17:40:48 | 00,079,136 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Common Files\LightScribe\LSSrvc.exe
PRC - [2007.08.23 17:36:30 | 00,455,968 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Common Files\LightScribe\LightScribeControlPanel.exe
PRC - [2007.07.17 11:13:56 | 00,049,152 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
PRC - [2007.07.17 11:13:34 | 00,049,152 | ---- | M] (ATI Technologies Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
PRC - [2007.05.11 03:06:38 | 00,341,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Reader 8.0\Reader\AcroRd32.exe
PRC - [2007.04.12 07:00:00 | 00,182,272 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Windows\System32\spool\drivers\w32x86\3\E_FATICDE.EXE
PRC - [2007.01.04 19:48:52 | 00,112,152 | R--- | M] (InterVideo) -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe
PRC - [2006.11.09 16:15:06 | 00,053,248 | ---- | M] (Chicony) -- C:\Windows\ModLEDKey.exe
PRC - [2006.11.09 16:01:02 | 05,585,408 | ---- | M] (Chicony) -- C:\Windows\CNYHKey.exe
PRC - [2006.11.02 20:40:12 | 00,174,656 | ---- | M] () -- C:\Windows\System32\PSIService.exe
PRC - [2005.09.14 20:44:14 | 00,065,536 | ---- | M] (ali) -- C:\Programme\USB Disk Win98 Driver\Res.exe
 
 
[color=#E56717]========== Modules (SafeList) ==========[/color]
 
MOD - [2009.11.25 13:04:10 | 00,531,968 | ---- | M] (OldTimer Tools) -- C:\Users\Grimm\Desktop\OTL.exe
MOD - [2009.04.11 07:21:38 | 01,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
 
 
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

OTL.txt (2)

SRV - [2009.10.28 20:21:14 | 00,545,568 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009.09.25 02:27:04 | 00,793,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009.08.28 18:42:54 | 00,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009.08.07 10:22:09 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.06.09 10:23:36 | 00,434,945 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2009.06.09 10:23:36 | 00,194,817 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2009.06.09 10:23:36 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009.06.01 21:20:12 | 00,222,968 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2009.04.11 13:17:46 | 00,313,840 | ---- | M] (Sonic Solutions) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe -- (RoxLiveShare9)
SRV - [2009.04.11 13:17:44 | 00,170,480 | ---- | M] (Sonic Solutions) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe -- (RoxWatch9)
SRV - [2009.04.11 13:17:26 | 01,108,464 | ---- | M] (Sonic Solutions) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe -- (RoxMediaDB9)
SRV - [2009.03.30 05:42:14 | 00,066,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.02.18 19:39:20 | 00,043,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0)
SRV - [2009.02.18 19:38:43 | 00,129,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2009.02.18 19:38:42 | 00,879,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc)
SRV - [2008.12.16 20:59:50 | 00,150,040 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2008.12.12 10:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2008.01.19 08:38:24 | 00,272,952 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.19 08:33:39 | 00,896,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.19 08:33:09 | 00,292,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehrecvr.exe -- (ehRecvr)
SRV - [2007.12.06 22:20:56 | 00,088,560 | ---- | M] (Sonic Solutions) -- C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe -- (Roxio UPnP Renderer 9)
SRV - [2007.12.06 22:20:52 | 00,362,992 | ---- | M] (Sonic Solutions) -- C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe -- (Roxio Upnp Server 9)
SRV - [2007.12.05 03:54:55 | 00,626,688 | ---- | M] (ATI Technologies Inc.) -- C:\Windows\System32\Ati2evxx.exe -- (Ati External Event Utility)
SRV - [2007.10.15 10:15:08 | 00,382,248 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2007.09.20 09:51:46 | 00,853,288 | ---- | M] (Nero AG) -- C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe -- (Nero BackItUp Scheduler 3)
SRV - [2007.08.23 17:40:48 | 00,079,136 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2007.01.04 19:48:52 | 00,112,152 | R--- | M] (InterVideo) -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)
SRV - [2006.11.02 20:40:12 | 00,174,656 | ---- | M] () -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing)
SRV - [2006.11.02 13:35:29 | 00,131,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehsched.exe -- (ehSched)
SRV - [2006.11.02 13:35:29 | 00,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehstart.dll -- (ehstart)
SRV - [2004.10.22 02:24:18 | 00,073,728 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =  [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 66 AD CF C1 B8 6B CA 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
[color=#E56717]========== FireFox ==========[/color]

OTL.txt (3)

FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.1
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.5
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009.06.24 21:16:23 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009.11.08 10:37:08 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009.11.08 10:37:08 | 00,000,000 | ---D | M]
 
[2009.11.02 20:14:36 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\mozilla\Extensions
[2009.11.02 20:14:36 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009.11.24 19:13:00 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\mozilla\Firefox\Profiles\rvy5mp9t.default\extensions
[2009.11.02 20:38:41 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\mozilla\Firefox\Profiles\rvy5mp9t.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.11.02 20:13:53 | 00,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2009.11.08 10:37:08 | 00,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009.11.08 10:37:05 | 00,023,512 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browserdirprovider.dll
[2009.11.08 10:37:05 | 00,137,176 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\brwsrcmp.dll
[2009.11.08 10:37:06 | 00,064,984 | ---- | M] (mozilla.org) -- C:\Programme\Mozilla Firefox\plugins\npnul32.dll
[2009.10.16 19:18:02 | 00,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2009.10.16 19:18:02 | 00,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2009.10.16 19:18:02 | 00,002,371 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\google.xml
[2009.10.16 19:18:02 | 00,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2009.10.16 19:18:02 | 00,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2009.10.16 19:18:02 | 00,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: (743 bytes) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AuditVista]  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BlackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [ledpointer] C:\Windows\CNYHKey.exe (Chicony)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
O4 - HKLM..\Run: [MoLed] C:\Windows\ModLEDKey.exe (Chicony)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [USB Storage Toolbox] C:\Programme\USB Disk Win98 Driver\Res.exe (ali)
O4 - HKLM..\Run: [Windows Defender] C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehtray.exe (Microsoft Corporation)
O4 - HKCU..\Run: [EPSON Stylus DX7400 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [ICQ] C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [ISUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
O4 - HKCU..\Run: [msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O8 - Extra context menu item: Download with Xilisoft YouTube Video Converter - C:\Programme\Xilisoft\YouTube Video Converter\upod_link.HTM ()
O8 - Extra context menu item: Öffnen mit WordPerfect - C:\Programme\WordPerfect Office X3\Programs\WPLauncher.hta ()
O8 - Extra context menu item: Save YouTube Video as MP3 - C:\Program Files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll (DVSTeam)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 00,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck) -  File not found
O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) -  File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

OTL.txt (4)

NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias [2008.10.01 14:21:53 | 00,000,000 | ---D | M]
NetSvcs: Irmon - C:\Windows\System32\irmon.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
OTL cannot create restorepoints on Vista OSs!
 
[color=#E56717]========== Files/Folders - Created Within 14 Days ==========[/color]
 
[2009.11.25 13:04:10 | 00,531,968 | ---- | C] (OldTimer Tools) -- C:\Users\Grimm\Desktop\OTL.exe
[2009.11.24 12:44:27 | 00,000,000 | ---D | C] -- C:\Programme\Windows Portable Devices
[2009.11.22 21:56:59 | 00,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
[2009.11.22 21:56:59 | 00,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
[2009.11.22 21:56:56 | 00,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
[2009.11.22 21:37:43 | 00,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2009.11.22 19:03:19 | 00,000,000 | ---D | C] -- C:\Programme\Enigma Software Group
[2009.11.22 18:41:04 | 00,000,000 | ---D | C] -- C:\Users\Grimm\AppData\Roaming\Malwarebytes
[2009.11.22 18:40:59 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2009.11.22 18:40:58 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2009.11.22 18:40:58 | 00,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2009.11.22 18:40:57 | 00,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2009.11.22 17:52:07 | 00,000,000 | ---D | C] -- C:\Avenger
[2009.11.16 19:57:18 | 00,000,000 | ---D | C] -- C:\skin
[2009.11.13 16:29:00 | 00,000,000 | ---D | C] -- C:\Users\Grimm\Desktop\Kryptographie
 
[color=#E56717]========== Files - Modified Within 14 Days ==========[/color]
 
[2009.11.25 13:07:47 | 03,932,160 | -HS- | M] () -- C:\Users\Grimm\ntuser.dat
[2009.11.25 13:04:10 | 00,531,968 | ---- | M] (OldTimer Tools) -- C:\Users\Grimm\Desktop\OTL.exe
[2009.11.25 13:03:39 | 00,069,632 | ---- | M] () -- C:\Users\Grimm\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.11.25 12:41:32 | 01,418,612 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2009.11.25 12:41:32 | 00,618,204 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2009.11.25 12:41:32 | 00,586,980 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2009.11.25 12:41:32 | 00,122,442 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2009.11.25 12:41:32 | 00,101,052 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2009.11.25 12:33:16 | 00,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2009.11.25 12:33:15 | 00,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2009.11.25 12:33:13 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2009.11.25 12:33:07 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2009.11.25 12:32:41 | 21,459,02592 | -HS- | M] () -- C:\hiberfil.sys
[2009.11.25 12:32:40 | 00,000,000 | ---- | M] () -- C:\Windows\System32\drivers\lvuvc.hs
[2009.11.24 22:51:40 | 00,524,288 | -HS- | M] () -- C:\Users\Grimm\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2009.11.24 22:51:40 | 00,065,536 | -HS- | M] () -- C:\Users\Grimm\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2009.11.24 22:51:10 | 03,505,967 | -H-- | M] () -- C:\Users\Grimm\AppData\Local\IconCache.db
[2009.11.24 12:36:06 | 00,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2009.11.24 12:34:58 | 00,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2009.11.22 22:03:26 | 00,293,664 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.11.22 18:10:26 | 00,000,680 | ---- | M] () -- C:\Users\Grimm\AppData\Local\d3d9caps.dat
[2009.11.16 19:57:13 | 00,003,961 | ---- | M] () -- C:\Users\Grimm\Documents\Mädchen_Priester.wpd
[2009.11.16 19:56:50 | 00,000,952 | -HS- | M] () -- C:\Windows\System32\KGyGaAvL.sys
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2009.11.24 12:36:06 | 00,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2009.11.24 12:34:58 | 00,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2009.11.22 21:51:20 | 03,505,967 | -H-- | C] () -- C:\Users\Grimm\AppData\Local\IconCache.db
[2009.11.22 18:14:39 | 21,459,02592 | -HS- | C] () -- C:\hiberfil.sys
[2009.11.22 18:10:26 | 00,000,680 | ---- | C] () -- C:\Users\Grimm\AppData\Local\d3d9caps.dat
[2009.11.16 19:57:13 | 00,003,961 | ---- | C] () -- C:\Users\Grimm\Documents\Mädchen_Priester.wpd
[2009.10.24 15:48:12 | 00,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2009.10.24 15:48:11 | 00,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2009.10.24 14:17:34 | 00,691,696 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
[2009.09.24 16:39:31 | 00,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.09.24 16:38:51 | 00,368,640 | ---- | C] () -- C:\Windows\System32\msjetoledb40.dll
[2009.08.20 21:38:56 | 00,000,006 | -HS- | C] () -- C:\Users\Grimm\AppData\Roaming\desktop.ini
[2009.08.20 21:38:56 | 00,000,006 | -HS- | C] () -- C:\Users\Grimm\AppData\Local\desktop.ini
[2009.04.28 15:02:13 | 00,081,110 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2009.04.22 18:12:48 | 00,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.03.14 19:08:35 | 00,000,158 | ---- | C] () -- C:\Windows\WLP.ini
[2008.12.16 20:58:54 | 00,025,624 | ---- | C] () -- C:\Windows\System32\drivers\LVPr2Mon.sys
[2008.12.16 20:50:56 | 00,013,584 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLgFT.dll
[2008.11.30 14:17:05 | 00,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2008.11.30 14:13:58 | 00,000,025 | ---- | C] () -- C:\Windows\CDE DX7400DEFGIPS.ini
[2008.10.18 13:37:26 | 00,069,632 | R--- | C] () -- C:\Windows\System32\xmltok.dll
[2008.10.18 13:37:26 | 00,036,864 | R--- | C] () -- C:\Windows\System32\xmlparse.dll
[2008.10.07 08:13:30 | 00,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2008.10.07 08:13:22 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 08:13:20 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008.10.07 08:13:20 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008.10.07 08:13:20 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 08:13:20 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008.10.07 08:13:20 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008.10.07 08:13:20 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008.10.07 08:13:20 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008.10.07 08:13:20 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2008.06.23 15:55:34 | 00,164,352 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2008.06.23 15:55:32 | 03,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008.06.23 15:55:32 | 00,755,027 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008.06.23 15:55:32 | 00,159,839 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2008.06.23 15:55:31 | 00,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2008.06.23 15:55:31 | 00,000,547 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll.manifest
[2008.06.14 12:46:57 | 00,060,124 | ---- | C] () -- C:\Windows\System32\tcpmon.ini
[2008.05.30 13:20:18 | 00,000,952 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys
[2008.04.24 17:03:11 | 00,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2008.04.24 17:03:11 | 00,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2008.04.24 17:03:11 | 00,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2008.04.12 15:20:28 | 00,069,632 | ---- | C] () -- C:\Users\Grimm\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.04.12 14:59:09 | 00,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2008.04.12 13:01:40 | 00,076,248 | ---- | C] () -- C:\Users\Grimm\AppData\Local\GDIPFONTCACHEV1.DAT
[2008.02.08 09:50:27 | 00,000,381 | ---- | C] () -- C:\Windows\WISO.INI
[2008.02.08 09:02:12 | 00,000,032 | ---- | C] () -- C:\Windows\CD_Start.INI
[2008.02.08 08:58:43 | 00,006,212 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2008.02.07 10:22:55 | 00,049,152 | ---- | C] () -- C:\Windows\CNYUSB.dll
[2008.02.07 10:22:55 | 00,005,120 | ---- | C] () -- C:\Windows\HKCYDLL.dll
[2008.02.07 10:22:55 | 00,000,360 | ---- | C] () -- C:\Windows\CNYHKey.ini
[2008.02.07 10:17:29 | 00,028,672 | ---- | C] () -- C:\Windows\System32\InsDrvZD.dll
[2008.02.07 10:17:29 | 00,016,384 | ---- | C] () -- C:\Windows\System32\InsDrvZD64.DLL
[2008.02.07 09:56:55 | 00,007,680 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys
[2007.12.05 03:56:40 | 00,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006.11.02 13:50:50 | 00,000,174 | -HS- | C] () -- C:\Programme\desktop.ini
[2006.11.02 13:37:35 | 00,037,665 | ---- | C] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont
[2006.11.02 13:37:35 | 00,029,779 | ---- | C] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006.11.02 13:37:35 | 00,026,489 | ---- | C] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006.11.02 13:37:35 | 00,026,040 | ---- | C] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006.11.02 13:35:32 | 00,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 01,418,612 | ---- | C] () -- C:\Windows\System32\PerfStringBackup.INI
[2006.11.02 11:24:31 | 00,001,405 | ---- | C] () -- C:\Windows\msdfmap.ini
[2006.11.02 11:23:31 | 00,000,247 | ---- | C] () -- C:\Windows\win.ini
[2006.11.02 11:23:31 | 00,000,235 | ---- | C] () -- C:\Windows\system.ini
[2006.11.02 08:40:29 | 00,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:09:45 | 00,027,097 | ---- | C] () -- C:\Windows\System32\country.sys
[2006.11.02 08:09:44 | 00,042,809 | ---- | C] () -- C:\Windows\System32\KEY01.SYS
[2006.11.02 08:09:44 | 00,042,537 | ---- | C] () -- C:\Windows\System32\KEYBOARD.SYS
[2006.11.02 08:09:42 | 00,009,029 | ---- | C] () -- C:\Windows\System32\ANSI.SYS
[2006.11.02 08:09:41 | 00,004,768 | ---- | C] () -- C:\Windows\System32\HIMEM.SYS
[2006.11.02 08:09:40 | 00,029,274 | ---- | C] () -- C:\Windows\System32\NTDOS412.SYS
[2006.11.02 08:09:38 | 00,029,370 | ---- | C] () -- C:\Windows\System32\NTDOS411.SYS
[2006.11.02 08:09:35 | 00,029,146 | ---- | C] () -- C:\Windows\System32\NTDOS404.SYS
[2006.11.02 08:09:31 | 00,029,146 | ---- | C] () -- C:\Windows\System32\NTDOS804.SYS
[2006.11.02 08:09:29 | 00,027,866 | ---- | C] () -- C:\Windows\System32\NTDOS.SYS
[2006.11.02 08:09:26 | 00,035,536 | ---- | C] () -- C:\Windows\System32\NTIO412.SYS
[2006.11.02 08:09:24 | 00,035,776 | ---- | C] () -- C:\Windows\System32\NTIO411.SYS
[2006.11.02 08:09:23 | 00,034,672 | ---- | C] () -- C:\Windows\System32\NTIO404.SYS
[2006.11.02 08:09:22 | 00,034,672 | ---- | C] () -- C:\Windows\System32\NTIO804.SYS
[2006.11.02 08:09:20 | 00,033,952 | ---- | C] () -- C:\Windows\System32\NTIO.SYS
[2006.11.02 07:25:08 | 00,013,312 | ---- | C] () -- C:\Windows\System32\win87em.dll
[2002.03.13 13:15:06 | 00,057,344 | ---- | C] () -- C:\Windows\System32\mupkernps11.dll
 
[color=#E56717]========== LOP Check ==========[/color]

OTL.txt (5) (und letztes)

[2008.04.12 15:02:10 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Adobe
[2009.09.17 13:43:51 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Apple Computer
[2008.04.12 13:01:58 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\ATI
[2009.03.22 20:03:15 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Avira
[2008.09.17 15:59:12 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Corel
[2009.08.17 11:16:34 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\dvdcss
[2008.07.28 13:26:16 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\ICQ
[2008.04.12 13:01:07 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Identities
[2009.08.24 22:05:24 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\InstallShield
[2008.04.12 17:26:55 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\InterVideo
[2009.04.28 15:02:51 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Leadertech
[2008.04.12 15:02:10 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Macromedia
[2009.11.22 18:41:04 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Malwarebytes
[2006.11.02 13:37:34 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Media Center Programs
[2009.05.13 19:36:27 | 00,000,000 | --SD | M] -- C:\Users\Grimm\AppData\Roaming\Microsoft
[2009.10.30 18:19:16 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Move Networks
[2009.11.02 20:14:36 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Mozilla
[2008.04.12 13:01:43 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Nero
[2008.04.12 15:38:12 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Opera
[2008.04.19 19:00:20 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Real
[2009.08.20 21:45:34 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Research In Motion
[2009.08.20 21:46:34 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Roxio
[2008.11.30 11:00:22 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\ScummVM
[2009.11.25 12:37:46 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Skype
[2009.11.25 12:36:15 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\skypePM
[2009.03.23 16:09:44 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\teamspeak2
[2009.02.23 10:17:50 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\vlc
[2008.04.25 20:53:16 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\WinRAR
[2008.06.22 17:42:39 | 00,000,000 | ---D | M] -- C:\Users\Grimm\AppData\Roaming\Xilisoft Corporation
[2009.11.25 12:33:13 | 00,000,006 | -H-- | M] () -- C:\Windows\Tasks\SA.DAT
[2009.11.24 22:51:58 | 00,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
[color=#E56717]========== Purity Check ==========[/color]
 
 
 
[color=#E56717]========== Custom Scans ==========[/color]
 
 
[color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color]
 
[color=#A23BEC]< %SYSTEMDRIVE%\eventlog.dll /s /md5 >[/color]
[2008.01.05 22:23:04 | 00,025,088 | ---- | M] () MD5=5226B5EE3148ECE1A9F1737C78315690 -- C:\Users\Grimm\Desktop\Kryptographie\portable\LyTeX\TeXLive\tlpkg\tlperl\lib\auto\Win32\EventLog\EventLog.dll
 
[color=#A23BEC]< %SYSTEMDRIVE%\scecli.dll /s /md5 >[/color]
[2009.04.11 07:28:24 | 00,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2006.11.02 10:46:12 | 00,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2008.01.19 08:36:19 | 00,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 07:28:24 | 00,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
[color=#A23BEC]< %SYSTEMDRIVE%\netlogon.dll /s /md5 >[/color]
[2009.04.11 07:28:23 | 00,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2006.11.02 10:46:11 | 00,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2008.01.19 08:35:36 | 00,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
[2009.04.11 07:28:23 | 00,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
 
[color=#A23BEC]< %SYSTEMDRIVE%\cngaudit.dll /s /md5 >[/color]
[2006.11.02 10:46:03 | 00,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 00,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
[color=#A23BEC]< %SYSTEMDRIVE%\sceclt.dll /s /md5 >[/color]
 
[color=#A23BEC]< %SYSTEMDRIVE%\ntelogon.dll /s /md5 >[/color]
 
[color=#A23BEC]< %SYSTEMDRIVE%\logevent.dll /s /md5 >[/color]
 
[color=#A23BEC]< %SYSTEMDRIVE%\iaStor.sys /s /md5 >[/color]
 
[color=#A23BEC]< %SYSTEMDRIVE%\nvstor.sys /s /md5 >[/color]
[2006.11.02 10:50:13 | 00,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.19 08:42:09 | 00,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2006.11.02 10:50:13 | 00,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 08:42:09 | 00,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
[color=#A23BEC]< %SYSTEMDRIVE%\atapi.sys /s /md5 >[/color]
[2009.04.11 07:32:26 | 00,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2008.04.13 07:14:45 | 00,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2009.04.11 07:32:26 | 00,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2006.11.02 10:49:36 | 00,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.01.19 08:41:30 | 00,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.04.13 07:14:45 | 00,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.04.13 07:14:45 | 00,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
[2008.01.19 08:41:30 | 00,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2009.04.11 07:32:26 | 00,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
 
[color=#A23BEC]< %SYSTEMDRIVE%\IdeChnDr.sys /s /md5 >[/color]
 
[color=#A23BEC]< %SYSTEMDRIVE%\viasraid.sys /s /md5 >[/color]
 
[color=#A23BEC]< %SYSTEMDRIVE%\AGP440.sys /s /md5 >[/color]
[2006.11.02 10:49:52 | 00,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.19 08:42:25 | 00,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2006.11.02 10:49:52 | 00,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
[2008.01.19 08:42:25 | 00,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 08:42:25 | 00,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 08:42:25 | 00,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
 
[color=#A23BEC]< %SYSTEMDRIVE%\vaxscsi.sys /s /md5 >[/color]
 
[color=#A23BEC]< %SYSTEMDRIVE%\nvatabus.sys /s /md5 >[/color]
 
[color=#E56717]========== Alternate Data Streams ==========[/color]
 
@Alternate Data Stream - 64 bytes -> C:\Users\Grimm\Desktop\Youtube Poop_ DINNER BLASTER lol.AVI:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Grimm\Desktop\Die 12 Geschworenen.DVDRip.divx.avi:TOC.WMV
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:A8ADE5D8
< End of report >


Extras.txt (1)

OTL Extras logfile created on: 25.11.2009 13:07:46 - Run 1
OTL by OldTimer - Version 3.1.10.0     Folder = C:\Users\Grimm\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18828)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,13 Gb Available Physical Memory | 56,77% Memory free
4,00 Gb Paging File | 3,09 Gb Available in Paging File | 77,24% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 454,10 Gb Total Space | 364,38 Gb Free Space | 80,24% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: GRIMM-PC
Current User Name: Grimm
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
 
[color=#E56717]========== Extra Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== File Associations ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.chm [@ = chm.file] -- "%SystemRoot%\hh.exe" %1
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)
 
[color=#E56717]========== Shell Spawning ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
chm.file [open] -- "%SystemRoot%\hh.exe" %1 File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
http [open] -- "C:\Program Files\Opera\opera.exe" (Opera Software)
https [open] -- "C:\Program Files\Opera\opera.exe" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
 
[color=#E56717]========== Security Center Settings ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[color=#E56717]========== Authorized Applications List ==========[/color]
 
 
[color=#E56717]========== Vista Active Open Ports Exception List ==========[/color]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{321156E5-AFEF-4181-B4B4-E0226116BDB7}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D43D52B4-6EF4-48F6-B06D-6449C21FBFA9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
 
[color=#E56717]========== Vista Active Application Exception List ==========[/color]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1BB3D34B-5BE1-44AB-9DD2-7E73585050EE}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{22E5F7A2-E30E-4EC9-81B4-148D50DA7C8D}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{45950BB8-E2E2-4B59-B5FD-BAAF96050963}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{7384E4A1-0C3B-49BD-8231-F0CC6FFC0A44}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{86AEF97F-96B6-42F2-95D1-1299F6950BE3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B13DE733-F6FB-4BFB-AF4D-A69EB43C1D68}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{B863BFAA-AD86-4634-8B48-2D45C2682184}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"TCP Query User{2D9A02C5-EA31-4287-9BFE-47CEE1B7130F}C:\program files\egames\mahjongg master 4\mjm4.exe" = protocol=6 | dir=in | app=c:\program files\egames\mahjongg master 4\mjm4.exe |
"TCP Query User{3FF26BFD-135E-4CDC-9D92-BDF0C0209A50}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"TCP Query User{6C8EF519-B81A-48CB-AAC3-DEF5CABF840B}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"TCP Query User{A56423BD-0049-4E89-94D7-99DB72223891}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"TCP Query User{CFF96207-1C26-4A67-A5B1-BB2ABD3248EF}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{E65C99C9-6202-4E93-BA46-0C47281CA6FD}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{E6E9FC02-3864-480E-BB53-676CFD6471A0}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"TCP Query User{EDA9731F-C897-4A17-8914-EF6D53AE883D}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{01D6F302-709A-4895-9798-7BC3A7677F38}C:\program files\egames\mahjongg master 4\mjm4.exe" = protocol=17 | dir=in | app=c:\program files\egames\mahjongg master 4\mjm4.exe |
"UDP Query User{6688C3CB-1FEE-43B8-98E8-F92FCACF4265}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{70C8D783-6AEC-4FA0-8A77-B7C7E8DF8038}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"UDP Query User{AA489594-8D72-4CA7-94F8-B1D94100C8BC}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{CAD97CE2-ED17-4CE9-90E4-53FF0D055DFC}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"UDP Query User{F09FBFF4-16CC-4115-901D-3CC526C515FB}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{F4B240F4-E0F4-4D1D-9571-B897D82E2F10}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{FAB0E596-823E-4772-A11F-0E6E4588F62A}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
 
[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]

Extras.txt (2) so, tut mir leid für die Unnanehmlichkeiten, aber es geht scheinbar net anders.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{54DB13F1-0CE0-4BAB-BD5F-7DE150C043C8}" = WordPerfect Office X3
"_{ADDBE07D-95B8-4789-9C76-187FFF9624B4}" = CorelDRAW Essential Edition 3
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01339AE5-04D4-43F8-008E-13AD788DC4F7}" = SimCity 4
"{035854E7-7FAA-244F-7358-3E67FA97C7C7}" = Catalyst Control Center Graphics Full New
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{06ABAC7E-FBD2-4C95-85EB-7E8118C61031}" = Nero 8 Essentials
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{09C8B025-F0C5-4EF2-BC4F-399269BDE0C8}" = Asterix - Maximum Gaudium
"{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}" = Risen
"{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX
"{1D3020AE-BDE2-EB67-2233-07619EF816CE}" = ccc-utility
"{20071984-5EB1-4881-8EDB-082532ACEC6D}" = Heroes of Might and Magic V
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = InterVideo WinDVD 8
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{2085F05D-24C5-4E27-B7B4-A51DE890FFC9}" = Opera 10.00
"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 15
"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant
"{2EB81825-E9EE-44F4-8F51-1240C3898DC6}" = EPSON File Manager
"{322F75E0-71A3-4125-8EB3-761834EDC166}" = Eragon
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{395E9AB5-1FEE-9B94-0C0C-BD19B86DFA77}" = Catalyst Control Center Graphics Previews Vista
"{3B128016-3B30-8068-EC8B-1C8FAE74C0AE}" = ccc-core-static
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3D78F2A2-C893-4ABD-B5FE-AD7011837755}" = EPSON Easy Photo Print
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{4D612FB2-1AE7-4E46-9377-35BB2F06A787}" = Roxio Media Manager
"{4E79A62F-7A2D-4058-BCE0-94E6B9E2F162}" = USB Disk Win98 Driver
"{4EE277A2-6D0F-20EC-E465-1771B424B0BD}" = Catalyst Control Center Graphics Previews Common
"{51AFB69C-1C54-4C77-A888-2860F8CD3E7D}" = Paint.NET v3.31
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{531514E4-018A-325C-22C0-D534A90E964A}" = ATI Catalyst Install Manager
"{54DB13F1-0CE0-4BAB-BD5F-7DE150C043C8}" = WordPerfect Office X3
"{5628829F-3318-4DDA-988D-D301832F1611}" = Singles
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{581CE7EA-A30D-0000-A215-088635773309}" = Atheros AR5007 Wireless LAN - USB
"{5F6A846C-1CBA-407F-839C-DC0204547F13}" = EuroRoute 2008
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69F0CEA4-43E2-4CBB-92DF-41860A40A631}" = Formelrechner
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{8C453F13-6877-4D34-8816-009ABDE306DB}" = Prince of Persia The Sands of Time
"{937B232D-9776-471E-92BD-D424E514EF14}" = Logitech QuickCam
"{93EA9C3E-BDFD-4309-A605-9B5BBC0CCEFD}" = Camera RAW Plug-In for EPSON Creativity Suite
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{99A37AC7-E724-4621-B167-500B5A52B69C}" = LastChaosGER
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9F5B2A85-2E88-FDA7-36FB-5C8829E4C9A0}" = Catalyst Control Center Graphics Full Existing
"{A0F18085-4D11-4D94-9EC7-7F6A50568DE3}" = Midnight Nowhere
"{A2AD54BD-BF6C-331E-2004-C1E6619B62BE}" = Skins
"{A334F1BA-0A1D-4ED6-B4F9-4066157CA15D}" = DE
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{A6C2D216-9DAE-43F9-8EFF-F0445E973F52}_is1" = GW-Value
"{A8F1FF33-FFD3-9C63-8263-6C899E1F330C}" = Catalyst Control Center Core Implementation
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.3 - Deutsch
"{ACEA7FC2-8B6F-5CED-BE77-272A25D36972}" = Catalyst Control Center Graphics Light
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{ADDBE07D-95B8-4789-9C76-187FFF9624B4}" = CorelDRAW Essential Edition 3
"{B607C354-CD79-4D22-86D1-92DC94153F42}" = Apple Application Support
"{BBF10B37-4ED3-11D5-A818-00500435FC18}" = Gothic
"{CC4A73BF-938E-4C19-A553-853C035C9BA1}" = LightScribe System Software  1.10.13.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1A74FBB-CA8D-4CCA-9B89-BAAA436DB178}" = iTunes
"{D8D22773-14BF-4178-A683-3DBA515C2A26}" = WISO Mein Geld 2008 Professional
"{DE4CAA86-0EAB-4A84-B1F9-1EC0923F01FC}" = Wildlife Park
"{E0091C29-DEE8-4B24-BF65-8C35B5940D77}" = Letstrade
"{E31A47BF-0613-E1DA-C645-5471DC1102DE}" = Catalyst Control Center Localization German
"{E728E952-DD4F-4BCD-A5C8-40FBFEFF91FE}" = OpenOffice.org Installer 1.0
"{EA966E51-1202-F9E8-27DC-8302748431FB}" = CCC Help German
"{EDC66A92-4603-4D72-B28C-570075B55DF0}" = USB Wireless Keyboard Driver
"{EE59E3BD-6B7D-4BBB-B9CD-20EA7AEF1E10}" = BlackBerry Desktop Software 5.0
"{EE5BC0BB-9EDA-423C-8276-48857B735D68}" = Prince of Persia Warrior Within
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone-Konfigurationsprogramm
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.5
"Avira AntiVir Desktop" = Avira AntiVir Premium
"BlackBerry_{EE59E3BD-6B7D-4BBB-B9CD-20EA7AEF1E10}" = BlackBerry Desktop Software 5.0
"DasTelefonbuch Deutschland" = DasTelefonbuch Deutschland
"Desktop FLV Player_is1" = FLVhosting Desktop FLV Player Ver 2.00
"DivX Codec" = DivX Codec
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"EPSON Scanner" = EPSON Scan
"EPSON Stylus CX7300_CX8300_DX7400_DX8400 Benutzerhandbuch" = EPSON Stylus CX7300_CX8300_DX7400_DX8400 Handbuch
"Free DVD Decrypter_is1" = Free DVD Decrypter version 1.3
"Free Studio_is1" = Free Studio version 4.2
"Free YouTube to Mp3 Converter_is1" = Free YouTube to Mp3 Converter version 3.2
"Game Cam" = Game Cam 2.0
"Guild Wars" = GUILD WARS
"GuildWars Visions_is1" = GuildWars Visions v1.08
"GW Team Builder_is1" = GW Team Builder 1.1.3
"Hauppauge MCE2005 Software Encoder" = Hauppauge MCE XP/Vista Software Encoder (2.0.25102)
"ICQToolbar" = ICQ Toolbar
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = InterVideo WinDVD 8
"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"KLiteCodecPack_is1" = K-Lite Codec Pack 3.9.5 (Full)
"LIDL Fotoservice_is1" = LIDL Fotoservice
"lvdrivers_11.90" = Logitech QuickCam-Treiberpaket
"MahJongg Master 4_is1" = MahJongg Master 4
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.5)" = Mozilla Firefox (3.5.5)
"RealPlayer 6.0" = RealPlayer
"Santa Claus in trouble ... gold!" = Santa Claus in trouble ... gold!
"ScummVM_is1" = ScummVM 0.12.0
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"Uninstall_is1" = Uninstall 1.0.0.1
"vixy converter BETA_is1" = vixy converter uninstall
"VLC media player" = VLC media player 0.9.8a
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"Xilisoft YouTube Video Converter" = Xilisoft YouTube Video Converter
 
[color=#E56717]========== HKEY_CURRENT_USER Uninstall List ==========[/color]
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
 
[color=#E56717]========== Last 10 Event Log Errors ==========[/color]
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >

Hmm, toll, jetzt macht RootRepeal bei mir Zicken 
Ich habe nun folgendes Problem damit: Wenn ich den Suchlauf starte (nachdem ich die oberen Angaben erfüllt habe, also WLAN aus, Antivir Guard/Online Schutz deaktivieren, ausführen, auf Report-Tab, dort "Scan", dann überall die Haken machen) dann kommt bei mir son komisches Fenster wenn er bei Files ist....das blöde ist, dass er das Fenster net anzeigt, sondern bloß den Rahmen des Fensters und nicht was drinsteht.
Also kann ich bloß auf schließen bei dem Pop-up Fenster drücken (denn da kam selbst nach ner Stunde nichts!) und damit das Programm beenden...
Was könnte ich denn vergessen haben? Aja, und ist es ein Problem wenn der Bildschirmschoner kommt?? Weil dann schalt ich den noch aus...

LG, G.

Daten sichern und system neuinstalieren,alles andere dürfte zeitvergeudung sein.
Oder ist Deine freizeit wertlos?

Soll ich neuinstallieren wegen dem Fehler oder einfach nur um sicherzugehen dass alles weg ist?
Weil für den Virus typische Aktivitäten gabs eigentlich keine...also, z.B. kam kein Pop-Up Fenster einfach so, welches mir angedroht hätte den PC runterzufahren und auch sonst nichts...
Naja, allein kann ich des eh net machen, muss ich warten bis mein Onkel wieder da ist und mit mir den PC formatiert...oder ich lass es einfach so und hoffe dass schon nix sein wird^^

LG, G.

 Hoffen und Harren hält manchen zum Narren 

Du kannst natürlich dich weiter mit Exzessiven Prüfdurchläufen beschäftigen, aber am Ende kannst Du trotzdem nicht sicher sein ob dein System jetzt sauber oder gänzlich zerschossen ist.
Das bleibt dein eigenes Risiko.
Wie w2 plädiere ich im Schadbefall immer für eine Imagerücksicherung oder wenn Du kein Image hast für eine Neuinstallation des Systems.

Meine Meinung hierzu drückt dieses Bild aus.

Burgeule

Hehe, das war jetzt wohl "seinen Standpunkt vertreten, Burgeule-style!"

Also, ich hab mal diesen Trend Micro Bericht über den Virus durchgelesen...die haben nämlich diesen Koobface Wurm analysiert und die Arbeitsweisen dargestellt.
Selbst wenn er noch da ist, was ich eigentlich nicht glaube, weil der nichtmal so ausgefeilt dabei ist sich auf Rechnern festzusetzen sonder eher sich weiter zu verbreiten, dann sollte der mir sowieso keine Probleme machen.
Wenn mein Onkel wieder da ist denk ich trotzdem ma über ne C:/ Formatierung nach!

LG, G.

PS: Ähm, btw, ich schätze ma dass diese OTL Berichte nichtmehr gebraucht werden (steht eh nix verdächtiges drin^^), wärs also möglich die wieder rauszunehmen??

Fein gesprochen G.
Aber besorge dir wenigstens dies hier, ist auch umsonst.
Fürs nächste mal bist Du dann User Sorgenfrei. 

Klick mich

Burgeule