Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun?

mia82 · 16.06.2011, 18:50

Hallo zusammen,

nachdem ich auf meinem einen Rechern "Malware Protection" entdeckt habe und mit Hilfe von cosinus und dem Trojaner-Board versuche den Rechner wieder sicher zu bekommen, habe ich auch auf meinem zwieten Rechner Malwarebytes' Anti-Malware installiert und durchlaufen lassen.

Wieder gab es Treffer :-(

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6863

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

16.06.2011 18:47:26
mbam-log-2011-06-16 (18-47-13).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 433397
Laufzeit: 3 Stunde(n), 16 Minute(n), 16 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{E01962F9-FA3A-CF68-AB42-661F4DB5FF54} (Trojan.ZbotR.Gen) -> Value: {E01962F9-FA3A-CF68-AB42-661F4DB5FF54} -> No action taken.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
c:\Users\Mia\AppData\Roaming\systemproc (Trojan.Agent) -> No action taken.

Infizierte Dateien:
c:\confin.sys (Malware.Trace) -> No action taken.

Habe sie von Malwarebytes' Anti-Malware entfernen lassen und gerade startet der nächste Suchlauf.
Was sind denn die nächsten Schritte?

Dankeschön!
Mia

mia82 · 17.06.2011, 08:48

so, ist hier noch die Logdatei, nachdem ich die Malware mit Malwarebytes' Anti-Malware entfernt habe.

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6872

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

16.06.2011 22:44:33
mbam-log-2011-06-16 (22-44-32).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 433118
Laufzeit: 3 Stunde(n), 12 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Würde jetzt gerne sicher stellen, dass alle Reste weg sind und nichts "böses" mehr im System ist.

cosinus · 17.06.2011, 10:48

Edit: Achso, ist der Zweitrechner, hätte ich fast überlesen

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die Textbox.

Code:

ATTFilter

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf .
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

mia82 · 17.06.2011, 14:10

Hallo cosinus,

hier ist die OTL-Logdatei

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 17.06.2011 14:20:54 - Run 1
OTL by OldTimer - Version 3.2.24.0     Folder = C:\Users\Mia\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 0,95 Gb Available Physical Memory | 47,95% Memory free
4,21 Gb Paging File | 2,75 Gb Available in Paging File | 65,26% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 119,00 Gb Total Space | 7,68 Gb Free Space | 6,45% Space Free | Partition Type: NTFS
Drive D: | 30,04 Gb Total Space | 7,56 Gb Free Space | 25,18% Space Free | Partition Type: FAT32
 
Computer Name: Mia-LAPTOP | User Name: Mia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.06.17 14:16:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Mia\Desktop\OTL.exe
PRC - [2011.05.08 20:20:48 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.05.05 20:56:04 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2011.03.18 20:08:23 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.11.05 10:48:38 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.02.18 11:43:20 | 000,490,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Common Files\Java\Java Update\jucheck.exe
PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.11.28 16:50:22 | 002,195,720 | ---- | M] () -- c:\Programme\radio\Tobit ClipInc\Server\ClipInc-Server.exe
PRC - [2008.10.28 23:01:22 | 000,326,192 | ---- | M] (VMware, Inc.) -- C:\Windows\System32\vmnetdhcp.exe
PRC - [2008.10.28 23:00:50 | 000,064,048 | ---- | M] (VMware, Inc.) -- C:\Programme\VMware\VMware Player\hqtray.exe
PRC - [2008.10.28 23:00:40 | 000,113,200 | ---- | M] (VMware, Inc.) -- C:\Programme\VMware\VMware Player\vmware-authd.exe
PRC - [2008.10.28 23:00:08 | 000,399,920 | ---- | M] (VMware, Inc.) -- C:\Windows\System32\vmnat.exe
PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2008.01.19 09:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.19 09:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2007.12.05 17:14:34 | 000,126,976 | ---- | M] (phonostar) -- C:\Programme\Internetradio phonostar\phonostar\ps_timer.exe
PRC - [2007.12.05 17:10:52 | 000,098,304 | ---- | M] (phonostar) -- C:\Programme\Internetradio phonostar\phonostar\ps_agent.exe
PRC - [2007.06.27 20:04:00 | 001,213,736 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007.06.27 20:03:40 | 000,152,872 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2007.05.04 17:08:24 | 001,600,512 | ---- | M] (Buhl Data Service GmbH) -- C:\Programme\Sceneo\Bonavista\Services\PVR\pvrservice.exe
PRC - [2007.04.13 18:14:28 | 000,016,384 | ---- | M] (Empolis GmbH) -- C:\Programme\Medion\MEDIONbox\Program\GCS.exe
PRC - [2007.04.13 18:14:26 | 000,036,864 | ---- | M] (Empolis GmbH) -- c:\Programme\Common Files\Gnab\Service\ServiceController.exe
PRC - [2007.03.30 11:10:00 | 000,061,440 | ---- | M] () -- C:\Programme\Fujitsu Siemens\WinManager\WinManager.exe
PRC - [2007.03.02 17:48:00 | 000,098,304 | ---- | M] (Brother Industries, Ltd.) -- C:\Programme\Brother\Brmfcmon\BrMfcMon.exe
PRC - [2007.02.15 17:07:16 | 004,390,912 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007.01.19 12:55:00 | 005,674,352 | ---- | M] (Microsoft Corporation) -- C:\Programme\MSN Messenger\msnmsgr.exe
PRC - [2007.01.04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe
PRC - [2006.12.26 11:23:34 | 000,180,224 | ---- | M] (Wistron Corp.) -- C:\Programme\Launch Manager\OSD.exe
PRC - [2006.12.14 16:53:28 | 000,192,512 | ---- | M] (Wistron) -- C:\Programme\Launch Manager\HotkeyApp.exe
PRC - [2006.11.22 17:31:26 | 000,630,784 | ---- | M] (Motorola Inc.) -- C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe
PRC - [2006.11.17 20:45:26 | 000,118,784 | ---- | M] (Wistron Corp.) -- C:\Programme\Launch Manager\WisLMSvc.exe
PRC - [2006.11.15 16:58:26 | 000,151,552 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2006.11.15 16:57:58 | 000,081,920 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2006.11.09 14:37:52 | 000,086,016 | ---- | M] () -- C:\Programme\Launch Manager\WButton.exe
PRC - [2006.09.28 23:20:00 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
PRC - [2005.07.25 13:36:40 | 000,032,768 | ---- | M] () -- C:\Programme\Launch Manager\LaunchAp.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.06.17 14:16:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Mia\Desktop\OTL.exe
MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] --  -- (OpenVPNService)
SRV - File not found [On_Demand | Stopped] --  -- (Emdepa)
SRV - [2011.05.08 20:20:48 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.03.18 20:08:23 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2008.11.28 16:50:22 | 002,195,720 | ---- | M] () [Auto | Running] -- c:\Program Files\Radio\Tobit ClipInc\Server\ClipInc-Server.exe -- (ClipInc001)
SRV - [2008.10.28 23:01:22 | 000,326,192 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\System32\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2008.10.28 23:00:40 | 000,113,200 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService)
SRV - [2008.10.28 23:00:08 | 000,399,920 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\System32\vmnat.exe -- (VMware NAT Service)
SRV - [2008.10.02 18:25:42 | 000,191,024 | ---- | M] (VMware, Inc.) [On_Demand | Stopped] -- C:\Program Files\VMware\VMware Player\vmware-ufad.exe -- (ufad-ws60)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.07.16 20:35:37 | 000,069,120 | ---- | M] (Google) [Disabled | Stopped] -- C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe -- (GoogleDesktopManager)
SRV - [2007.05.04 17:08:24 | 001,600,512 | ---- | M] (Buhl Data Service GmbH) [Auto | Running] -- C:\Programme\Sceneo\Bonavista\Services\PVR\pvrservice.exe -- (srvcPVR)
SRV - [2007.04.23 11:39:00 | 000,718,416 | ---- | M] (BullGuard Software) [Disabled | Stopped] -- C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe -- (BGLiveSvc)
SRV - [2007.04.23 11:38:56 | 000,075,344 | ---- | M] (BullGuard, Ltd.) [Disabled | Stopped] -- C:\Programme\BullGuard Software\BullGuard\BsMain.dll -- (BgMainSvc)
SRV - [2007.04.23 11:38:56 | 000,044,112 | ---- | M] (BullGuard Ltd.) [Disabled | Stopped] -- C:\Programme\BullGuard Software\BullGuard\BsMailProxy.dll -- (BsMailProxy)
SRV - [2007.04.23 11:38:54 | 000,099,920 | ---- | M] (BullGuard Ltd.) [Disabled | Stopped] -- C:\Programme\BullGuard Software\BullGuard\BsFileScan.dll -- (BsFileScan)
SRV - [2007.04.13 18:14:26 | 000,036,864 | ---- | M] (Empolis GmbH) [Auto | Running] -- c:\Programme\Common Files\Gnab\Service\ServiceController.exe -- (GnabService)
SRV - [2007.01.04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)
SRV - [2006.11.17 20:45:26 | 000,118,784 | ---- | M] (Wistron Corp.) [On_Demand | Running] -- C:\Program Files\Launch Manager\WisLMSvc.exe -- (WisLMSvc)
SRV - [2006.11.15 16:57:58 | 000,081,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2006.09.28 23:20:00 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
SRV - [2005.11.17 14:18:52 | 001,527,900 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Programme\ALDI Sued Foto Service\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.03.18 20:08:23 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.11.25 22:24:13 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.10.28 23:01:34 | 000,054,960 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmci.sys -- (vmci)
DRV - [2008.10.28 23:01:32 | 000,026,288 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV - [2008.10.28 23:01:32 | 000,023,216 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMkbd.sys -- (vmkbd)
DRV - [2008.10.28 23:01:30 | 000,857,392 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmx86.sys -- (vmx86)
DRV - [2008.10.28 23:01:28 | 000,032,304 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\hcmon.sys -- (hcmon)
DRV - [2008.10.28 17:03:28 | 000,031,280 | R--- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV - [2008.10.28 17:03:28 | 000,016,560 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV - [2008.10.02 18:24:48 | 000,022,448 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Programme\VMware\VMware Player\vstor2-ws60.sys -- (vstor2-ws60)
DRV - [2007.07.05 19:23:42 | 000,277,504 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8187B.sys -- (RTL8187B)
DRV - [2007.06.21 13:00:53 | 000,320,384 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UDXTTM6000.sys -- (UDXTTM6000)
DRV - [2007.04.30 13:42:14 | 000,081,408 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2007.04.18 08:44:02 | 000,016,984 | ---- | M] (BullGuard Ltd.) [Kernel | On_Demand | Stopped] -- C:\Programme\BullGuard Software\BullGuard\Reconn.sys -- (Reconn)
DRV - [2007.04.18 08:40:18 | 000,050,904 | ---- | M] (BullGuard Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\BdFileSpy.sys -- (BdFileSpy)
DRV - [2007.02.07 18:35:10 | 001,729,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2006.11.28 22:46:24 | 000,028,224 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PDNMp50.sys -- (PDNMp50)
DRV - [2006.11.28 22:46:22 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PDNSp50.sys -- (PDNSp50)
DRV - [2006.11.22 17:35:00 | 000,982,272 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
DRV - [2006.11.15 17:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2006.11.15 12:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006.11.15 10:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2006.11.02 09:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006.10.01 14:37:02 | 000,026,624 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tap0801.sys -- (tap0801)
DRV - [2006.06.29 04:11:48 | 000,017,408 | ---- | M] (DTV-DVB) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UDXTTM6000HID.sys -- (UDXTTM6000HID)
DRV - [2003.04.28 11:27:06 | 000,009,867 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\HOTKEY.sys -- (Hotkey)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.web.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "Google.de"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.web.de/"
FF - prefs.js..extensions.enabledItems: {152455DE-7B40-4bcf-B5B4-C68A1BE85A91}:2.6.7
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4
FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.85
FF - prefs.js..extensions.enabledItems: {75CEEE46-9B64-46f8-94BF-54012DE155F0}:0.4.6
FF - prefs.js..extensions.enabledItems: {29c4afe1-db19-4298-8785-fcc94d1d6c1d}:0.6.2009110501
FF - prefs.js..extensions.enabledItems: {89736E8E-4B14-4042-8C75-AD00B6BD3900}:1.0.5
FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.3
FF - prefs.js..extensions.enabledItems: janetka@pinger:1.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {fc2b8f80-d9a5-4f51-8076-7c7ce3c67ee3}:5.1.0.8
FF - prefs.js..extensions.enabledItems: zotero@chnm.gmu.edu:2.0.9
FF - prefs.js..network.proxy.autoconfig_url: "https://vw-online.hdm-stuttgart.de/eBooks/proxy.pac"
FF - prefs.js..network.proxy.type: 2
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009.01.22 00:15:10 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0\extensions\\Components: C:\Program Files\Mozilla Firefox 3\components [2009.01.22 00:15:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox 3\plugins [2010.03.11 21:59:00 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.05 20:56:09 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.05 20:56:09 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\sunbird\components [2010.05.09 15:34:08 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files\sunbird\plugins
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Components: C:\Program Files\thunderbird\components [2011.06.15 18:57:24 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Plugins: C:\Program Files\thunderbird\plugins
FF - HKLM\software\mozilla\SeaMonkey 1.1.8\Extensions\\Components: C:\Program Files\mozilla.org\SeaMonkey\Components [2009.03.16 21:40:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\SeaMonkey 1.1.8\Extensions\\Plugins: C:\Program Files\mozilla.org\SeaMonkey\Plugins [2009.01.22 00:15:15 | 000,000,000 | ---D | M]
 
[2011.06.15 18:57:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Extensions
[2011.06.15 18:57:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.05.09 15:34:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
[2008.07.09 00:05:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\extensions
[2011.06.16 19:32:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions
[2010.10.10 20:02:24 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2010.10.10 20:02:45 | 000,000,000 | ---D | M] (Domain Details) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{152455DE-7B40-4bcf-B5B4-C68A1BE85A91}
[2010.10.10 20:02:21 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.03.30 22:55:04 | 000,000,000 | ---D | M] ("Split Browser") -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{29c4afe1-db19-4298-8785-fcc94d1d6c1d}
[2008.01.09 22:24:01 | 000,000,000 | ---D | M] (del.icio.us) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{5a2b4e34-ce62-42e9-a658-06ba4490adf8}
[2010.11.01 21:32:46 | 000,000,000 | ---D | M] (MeasureIt) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{75CEEE46-9B64-46f8-94BF-54012DE155F0}
[2009.08.30 09:20:25 | 000,000,000 | ---D | M] ("TinyUrl Creator") -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{89736E8E-4B14-4042-8C75-AD00B6BD3900}
[2010.04.04 15:42:15 | 000,000,000 | ---D | M] (FoxTab) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2010.10.10 20:02:21 | 000,000,000 | ---D | M] (Diigo Bookmarks and Web Annotations) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{fc2b8f80-d9a5-4f51-8076-7c7ce3c67ee3}
[2010.08.24 21:57:08 | 000,000,000 | ---D | M] (Firebug) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\firebug@software.joehewitt.com
[2010.05.28 23:14:19 | 000,000,000 | ---D | M] (Pinger) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\janetka@pinger
[2009.01.25 18:36:50 | 000,000,000 | ---D | M] (Smart Middle Click) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\SmartMiddleClick@spiers
[2010.11.01 21:32:49 | 000,000,000 | ---D | M] (Zotero) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\zotero@chnm.gmu.edu
[2010.05.09 15:34:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Sunbird\Profiles\77qk2mf3.default\extensions
[2008.07.08 22:32:38 | 000,002,295 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\blinde-kuh.xml
[2011.06.05 22:46:45 | 000,002,533 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\diigo--google.xml
[2010.12.30 12:17:08 | 000,002,101 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\googlede.xml
[2008.01.09 20:33:40 | 000,001,907 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\leo-eng-ger.xml
[2008.02.25 23:56:25 | 000,001,067 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\wikipedia-deutsch.xml
[2011.06.16 19:32:09 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.07.11 19:35:28 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2009.02.18 18:20:03 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
[2010.07.11 19:35:28 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2002.05.02 12:22:30 | 000,991,232 | ---- | M] (MindAvenue) -- C:\Programme\Mozilla Firefox\plugins\NPAXELPlayer.dll
[2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.08.04 20:57:43 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.08.04 20:57:43 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.08.04 20:57:43 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.08.04 20:57:43 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.08.04 20:57:43 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (FireShot) - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} -  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [CtrlVol]  File not found
O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe ()
O4 - HKLM..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSD.exe (Wistron Corp.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [openvpn-gui]  File not found
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\Quicktime Apple\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SMSERIAL] C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [toolbar_eula_launcher] C:\Programme\GoogleEULA\EULALauncher.exe ( )
O4 - HKLM..\Run: [TVBroadcast] C:\Programme\Sceneo\Bonavista\Services\ODSBC\ODSBCApp.exe (ODSoft multimedia)
O4 - HKLM..\Run: [UVS10 Preload] C:\Programme\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe (Ulead Systems, Inc.)
O4 - HKLM..\Run: [VMware hqtray] C:\Program Files\VMware\VMware Player\hqtray.exe (VMware, Inc.)
O4 - HKLM..\Run: [Wbutton] C:\Program Files\Launch Manager\Wbutton.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [msnmsgr] C:\Programme\MSN Messenger\msnmsgr.exe (Microsoft Corporation)
O4 - HKCU..\Run: [PhonostarAgent] C:\Programme\Internetradio phonostar\phonostar\ps_agent.exe (phonostar)
O4 - HKCU..\Run: [PhonostarTimer] C:\Programme\Internetradio phonostar\phonostar\ps_timer.exe (phonostar)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ\version 7\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ\version 7\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -  File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: GD ([http] in Lokales Intranet)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} hxxp://picasaweb.google.com/s/v/57.11/uploader2.cab (UploadListView Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1183949065925 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Mia\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Mia\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{a70cab19-bb6b-11df-abda-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{a70cab19-bb6b-11df-abda-005056c00008}\Shell\AutoRun\command - "" = J:\LGAutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: BGNewsAgent - hkey= - key= - C:\Program Files\BullGuard Software\BullGuard\BgNewsUI.exe (BullGuard Software)
MsConfig - StartUpReg: BullGuard - hkey= - key= - C:\Program Files\BullGuard Software\BullGuard\bullguard.exe (BullGuard Software)
MsConfig - StartUpReg: Google Desktop Search - hkey= - key= - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
MsConfig - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files\MSN Messenger\msnmsgr.exe (Microsoft Corporation)
MsConfig - State: "startup" - 2
MsConfig - State: "services" - 2
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {1FE515CC-7927-4012-63E9-B692A3E39431} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.2
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.2
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.dvacm - C:\Programme\Common Files\Ulead Systems\VIO\DVACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codec - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.MPEGacm - C:\Programme\Common Files\Ulead Systems\MPEG\MPEGACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.ulmp3acm - C:\Programme\Common Files\Ulead Systems\MPEG\ulmp3acm.acm (Ulead systems)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: VIDC.VMnc - C:\Windows\System32\vmnc.dll (VMware, Inc.)
Drivers32: vidc.yv12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.06.17 14:14:33 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Mia\Desktop\OTL.exe
[2011.06.15 20:15:29 | 000,000,000 | ---D | C] -- C:\Users\Mia\AppData\Roaming\Malwarebytes
[2011.06.15 20:14:22 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.06.15 20:14:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.06.15 20:14:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.06.15 20:14:16 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.06.15 20:12:24 | 000,000,000 | ---D | C] -- C:\Programme\anti-malware
[2011.05.29 20:23:20 | 000,000,000 | ---D | C] -- C:\Users\Mia\.mediathek
[2011.05.29 20:18:00 | 000,000,000 | ---D | C] -- C:\Programme\mediathek
[2007.07.12 04:57:45 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll
[3 C:\Users\Mia\Documents\*.tmp files -> C:\Users\Mia\Documents\*.tmp -> ]
[1 C:\Users\Mia\Desktop\*.tmp files -> C:\Users\Mia\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.06.17 14:25:11 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{8E21E027-9A81-475C-B74E-F815515A4C7B}.job
[2011.06.17 14:16:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Mia\Desktop\OTL.exe
[2011.06.17 14:05:01 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-967124566-3105974339-2490099070-1003UA.job
[2011.06.17 13:38:02 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.06.17 13:36:03 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.06.17 13:36:03 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.06.17 10:04:07 | 000,000,600 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\winscp.rnd
[2011.06.17 09:54:21 | 000,000,076 | ---- | M] () -- C:\Users\Mia\pfad-fuer-logs
[2011.06.17 09:34:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.06.16 23:05:01 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-967124566-3105974339-2490099070-1003Core.job
[2011.06.16 20:38:03 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.06.16 19:21:52 | 000,641,432 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.06.16 19:21:52 | 000,607,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.06.16 19:21:52 | 000,131,878 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.06.16 19:21:52 | 000,108,970 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.06.16 19:13:43 | 2137,186,304 | -HS- | M] () -- C:\hiberfil.sys
[2011.06.16 19:02:33 | 000,000,268 | -H-- | M] () -- C:\sqmdata07.sqm
[2011.06.16 19:02:33 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm
[2011.06.15 20:14:23 | 000,001,065 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.06.15 18:44:40 | 000,002,094 | ---- | M] () -- C:\Users\Mia\Desktop\Google Chrome.lnk
[2011.06.07 21:32:43 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.05.22 23:40:46 | 000,112,640 | ---- | M] () -- C:\Users\Mia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[3 C:\Users\Mia\Documents\*.tmp files -> C:\Users\Mia\Documents\*.tmp -> ]
[1 C:\Users\Mia\Desktop\*.tmp files -> C:\Users\Mia\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.06.17 09:54:21 | 000,000,076 | ---- | C] () -- C:\Users\Mia\pfad-fuer-logs
[2011.06.15 20:14:23 | 000,001,065 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.12.18 15:35:49 | 000,000,506 | ---- | C] () -- C:\Windows\infothek.INI
[2010.08.16 20:12:22 | 001,205,818 | ---- | C] () -- C:\Windows\System32\fendt_comic.exe
[2010.08.16 20:01:52 | 000,000,051 | ---- | C] () -- C:\Windows\Fendt Comic.ini
[2009.10.23 22:09:24 | 000,000,109 | ---- | C] () -- C:\Windows\jascreg.ini
[2009.10.15 00:08:06 | 000,055,856 | ---- | C] () -- C:\Windows\System32\vnetinst.dll
[2009.09.24 21:29:29 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.09.24 21:29:28 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.04.29 20:49:08 | 000,554,496 | ---- | C] () -- C:\Windows\System32\dvmsg.dll
[2009.04.05 04:57:06 | 001,301,502 | ---- | C] () -- C:\Windows\System32\libswish-e-2.dll
[2009.03.02 23:17:37 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2009.01.25 16:22:40 | 000,019,968 | ---- | C] () -- C:\Windows\System32\cpuinf32.dll
[2009.01.11 21:54:32 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2009.01.11 21:54:32 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2009.01.11 21:47:27 | 000,000,050 | ---- | C] () -- C:\Windows\System32\bridf07a.dat
[2009.01.04 04:01:40 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.12.09 23:34:35 | 000,047,104 | ---- | C] () -- C:\Windows\System32\Wh2Robo.dll
[2008.05.27 19:00:19 | 000,000,600 | ---- | C] () -- C:\Users\Mia\AppData\Roaming\winscp.rnd
[2008.05.27 18:42:14 | 000,000,403 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.05.03 20:05:33 | 000,320,384 | ---- | C] () -- C:\Windows\System32\drivers\UDXTTM6000.sys
[2008.04.09 19:24:51 | 000,000,009 | ---- | C] () -- C:\Users\Mia\AppData\Roaming\mdb.bin
[2008.02.16 16:50:45 | 000,219,473 | ---- | C] () -- C:\Windows\SeaMonkeyUninstall.exe
[2008.02.16 16:50:39 | 000,118,784 | ---- | C] () -- C:\Windows\GREUninstall.exe
[2008.02.14 14:40:53 | 000,000,151 | ---- | C] () -- C:\Windows\PhotoSnapViewer.INI
[2008.01.23 11:09:13 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2008.01.13 12:34:25 | 000,000,600 | ---- | C] () -- C:\Users\Mia\AppData\Local\PUTTY.RND
[2008.01.02 16:51:15 | 000,000,030 | ---- | C] () -- C:\Windows\Iedit_.INI
[2008.01.02 12:37:22 | 000,210,944 | ---- | C] () -- C:\Windows\System32\MSVCRT10.DLL
[2007.12.28 21:24:12 | 000,394,240 | ---- | C] () -- C:\Windows\System32\Smab.dll
[2007.12.28 21:24:11 | 000,066,560 | ---- | C] () -- C:\Windows\MOTA113.exe
[2007.12.28 21:24:11 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2007.12.28 21:24:10 | 000,240,128 | ---- | C] () -- C:\Windows\System32\x.264.exe
[2007.12.28 21:24:09 | 000,502,784 | ---- | C] () -- C:\Windows\x2.64.exe
[2007.12.28 21:24:09 | 000,217,073 | ---- | C] () -- C:\Windows\meta4.exe
[2007.10.03 18:30:16 | 000,000,025 | ---- | C] () -- C:\Windows\cdplayer.ini
[2007.09.27 11:50:15 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2007.09.23 11:57:44 | 000,004,294 | ---- | C] () -- C:\Windows\mozver.dat
[2007.09.22 22:39:29 | 000,000,335 | ---- | C] () -- C:\Windows\nsreg.dat
[2007.09.06 11:13:07 | 000,112,640 | ---- | C] () -- C:\Users\Mia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.09.06 10:38:41 | 000,023,182 | ---- | C] () -- C:\Users\Mia\AppData\Roaming\UserTile.png
[2007.09.06 09:02:42 | 000,004,536 | ---- | C] () -- C:\Users\Mia\AppData\Roaming\wklnhst.dat
[2007.09.06 08:45:29 | 000,000,094 | ---- | C] () -- C:\Users\Mia\AppData\Local\fusioncache.dat
[2007.08.24 20:46:48 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1322.dll
[2007.07.12 04:57:45 | 001,729,152 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2007.07.09 17:32:04 | 000,087,312 | ---- | C] () -- C:\Windows\mws.exe
[2007.07.06 07:39:12 | 000,001,208 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2007.07.06 07:39:06 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2007.07.06 07:12:57 | 000,009,867 | ---- | C] () -- C:\Windows\System32\drivers\HOTKEY.sys
[2007.07.06 06:41:51 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2007.07.06 06:41:51 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1283.dll
[2007.06.20 13:44:37 | 000,000,199 | ---- | C] () -- C:\Windows\WISO.INI
[2007.06.20 13:39:38 | 000,299,008 | ---- | C] () -- C:\Windows\System32\midas.dll
[2007.06.20 13:39:38 | 000,120,320 | ---- | C] () -- C:\Windows\System32\UnzDll.dll
[2007.06.11 14:43:56 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007.06.11 14:43:51 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2007.03.05 13:34:28 | 000,676,224 | ---- | C] () -- C:\Windows\System32\OGACheckControl.DLL
[2006.12.11 06:06:31 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2006.11.02 17:33:31 | 000,641,432 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,131,878 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,379,240 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,607,008 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,108,970 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.09.20 07:34:10 | 000,000,000 | ---- | C] () -- C:\Windows\Buhl.ini
[2006.08.28 04:29:02 | 000,115,001 | ---- | C] () -- C:\Windows\System32\pcre.dll
[2006.08.28 04:29:02 | 000,061,447 | ---- | C] () -- C:\Windows\System32\pcreposix.dll
[2006.08.27 22:48:58 | 004,484,537 | ---- | C] () -- C:\Windows\System32\libxml2-2.dll
[2006.08.27 19:55:50 | 000,074,240 | ---- | C] () -- C:\Windows\System32\zlib1.dll
 
========== LOP Check ==========
 
[2007.10.29 12:13:31 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\BullGuard
[2010.05.30 14:48:22 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\elsterformular
[2008.01.13 15:29:35 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\FileZilla
[2008.03.16 10:51:39 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\FireShot
[2010.09.24 16:39:13 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Houbg
[2011.05.16 20:18:40 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\ICQ
[2007.10.09 13:37:44 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\ICQLite
[2010.09.19 15:06:41 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Idvu
[2007.09.14 20:53:34 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\InterVideo
[2007.09.06 08:57:37 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\MAGIX
[2009.03.22 12:24:44 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Nvu
[2008.02.03 20:27:52 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Opera
[2007.12.10 11:22:36 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\PeerNetworking
[2008.03.07 15:01:15 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\phonostar-Player
[2007.12.28 16:30:08 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Screenshot Studio Files
[2008.12.23 19:56:58 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\T-Online
[2007.09.06 09:02:51 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Template
[2011.06.15 18:57:33 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Thunderbird
[2009.04.29 20:49:59 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Tobit
[2008.02.12 09:00:15 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\TVcentral-Core
[2007.09.06 11:06:00 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Ulead Systems
[2011.06.16 19:11:54 | 000,032,608 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.06.17 14:25:11 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{8E21E027-9A81-475C-B74E-F815515A4C7B}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.05.28 20:24:10 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Adobe
[2008.05.11 22:30:22 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\AdobeUM
[2008.02.01 00:38:46 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Ahead
[2010.04.22 22:35:42 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Avira
[2009.03.08 23:49:39 | 000,000,000 | R--D | M] -- C:\Users\Mia\AppData\Roaming\Brother
[2007.10.29 12:13:31 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\BullGuard
[2010.05.30 14:48:22 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\elsterformular
[2008.01.13 15:29:35 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\FileZilla
[2008.03.16 10:51:39 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\FireShot
[2007.09.22 15:23:18 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Google
[2010.09.24 16:39:13 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Houbg
[2011.05.16 20:18:40 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\ICQ
[2007.10.09 13:37:44 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\ICQLite
[2007.09.06 08:45:09 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Identities
[2008.06.01 20:41:28 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\IDMComp
[2010.09.19 15:06:41 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Idvu
[2007.09.23 17:19:33 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\InstallShield
[2007.09.14 20:53:34 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\InterVideo
[2007.09.15 20:13:45 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Macromedia
[2007.09.06 08:57:37 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\MAGIX
[2011.06.15 20:15:29 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Malwarebytes
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Media Center Programs
[2008.07.27 20:26:46 | 000,000,000 | --SD | M] -- C:\Users\Mia\AppData\Roaming\Microsoft
[2008.05.27 18:40:19 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Microsoft Web Folders
[2010.05.09 15:34:08 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Mozilla
[2009.03.22 12:24:44 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Nvu
[2008.02.03 20:27:52 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Opera
[2007.12.10 11:22:36 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\PeerNetworking
[2008.03.07 15:01:15 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\phonostar-Player
[2008.02.28 13:18:23 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Real
[2009.09.25 22:00:18 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Reallusion
[2007.12.28 16:30:08 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Screenshot Studio Files
[2011.06.17 14:19:53 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Skype
[2011.06.17 09:34:43 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\skypePM
[2008.12.23 19:56:58 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\T-Online
[2008.09.14 18:47:10 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Talkback
[2007.09.06 09:02:51 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Template
[2011.06.15 18:57:33 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Thunderbird
[2009.04.29 20:49:59 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Tobit
[2008.02.12 09:00:15 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\TVcentral-Core
[2007.09.06 11:06:00 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Ulead Systems
[2011.01.03 22:13:08 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\vlc
[2010.03.10 23:33:56 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\VMware
 
< %APPDATA%\*.exe /s >
[2010.07.11 19:40:14 | 002,568,656 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Mia\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
[2008.02.03 20:27:47 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Mia\AppData\Roaming\Microsoft\Installer\{C619B312-19F3-460A-9F7B-443248379F18}\ARPPRODUCTICON.exe
[2010.02.04 22:16:22 | 000,040,960 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fireshot-install.exe
[2008.02.28 13:18:28 | 000,329,264 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Mia\AppData\Roaming\Real\RealPlayer\Update\RealPlayer11GOLD.exe
 
< %SYSTEMDRIVE%\*.exe >
[2008.03.17 23:45:22 | 007,755,399 | ---- | M] () -- C:\Install_Wise_Guys_Screensaver.exe
 
 
< MD5 for: AGP440.SYS  >
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2007.04.17 10:30:38 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c2a1b5ae\atapi.sys
[2007.04.17 10:30:38 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20518_none_dbd8b4d73d81c9d0\atapi.sys
[2008.02.14 09:01:19 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008.02.14 09:01:19 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.02.14 09:01:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_64dfd8ea\atapi.sys
[2008.02.14 09:01:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2007.07.31 20:06:30 | 000,028,791 | R--- | M] () MD5=39EE40F7A5081995CF3A44FE46CCF02F -- C:\Perl\lib\auto\Win32\EventLog\EventLog.dll
 
< MD5 for: IASTOR.SYS  >
[2006.10.31 14:13:46 | 000,495,896 | ---- | M] (Intel Corporation) MD5=81EC16AFD70E3432B8C573782CCFEE6D -- C:\Programme\Intel\Intel Matrix Storage Manager\Driver64\IaStor.sys
[2006.10.31 13:46:36 | 000,250,368 | ---- | M] (Intel Corporation) MD5=DE01BF14FFB150C779FD561BD0E3C5C5 -- C:\Programme\Intel\Intel Matrix Storage Manager\Driver\iaStor.sys
[2006.10.31 13:46:36 | 000,250,368 | ---- | M] (Intel Corporation) MD5=DE01BF14FFB150C779FD561BD0E3C5C5 -- C:\Windows\System32\drivers\iaStor.sys
[2006.10.31 13:46:36 | 000,250,368 | ---- | M] (Intel Corporation) MD5=DE01BF14FFB150C779FD561BD0E3C5C5 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_3bb7bc45\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.06.19 15:33:29 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2007.06.19 15:33:29 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2008.01.19 09:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2008.01.19 09:34:08 | 000,347,136 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtmsft.dll
[2008.01.19 09:34:08 | 000,214,528 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtrans.dll
 
<           >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 709 bytes -> C:\Users\Mia\Desktop\Foto.eml:OECustomProperty
@Alternate Data Stream - 64 bytes -> C:\P1160392.MOV.MPG:TOC.WMV

< End of report >

--- --- ---

cosinus · 17.06.2011, 14:14

Kannst du mit die auffallend vielen Ähnlichkeiten erklären, die dieses OTL-Log mit dem in diesem Strang hat? => http://www.trojaner-board.de/100260-...f-rechner.html

Laufwerke/Partition, Hostname und Speicherausbau sind da ja identisch!!

mia82 · 17.06.2011, 14:22

Ja, das ist ganz einfach - ich habe mir zeitgleich zwei identische Rechner gekauft, d.h. gleiches Betriebssystem und auch mehr oder weniger die gleiche Software installiert.
Nur der Standort unterscheidet sich;-)
Und als der eine das Problem mit der Malware Protection hatte, habe ich den anderen auch getestet auf Malware und Viren...

cosinus · 17.06.2011, 14:23

Ok. Wollte nur sichergehen, dass wir auch das richtige Log zum Rechner durchgehen und nicht die Logs verwechseln.

cosinus · 17.06.2011, 14:26

Zitat:

Avira GmbH) -- C:\Programme\Avira\AntiVir

Überleg dir gut, ob du in Zukunft weiterhin bei AntiVir bleiben willst. Die haben eine sehr fragwürdige Entscheidung getroffen, was nicht gerade seriös wirkt => http://www.trojaner-board.de/100374-...e-und-ask.html

Zitat:

MsConfig - StartUpReg: BGNewsAgent - hkey= - key= - C:\Program Files\BullGuard Software\BullGuard\BgNewsUI.exe (BullGuard Software)
MsConfig - StartUpReg: BullGuard - hkey= - key= - C:\Program Files\BullGuard Software\BullGuard\bullguard.exe (BullGuard Software)

Läuft bei dir Bullguard UND AntiVir gleichzeitig? Sowas sollte man unbedingt sein lassen.

mia82 · 17.06.2011, 14:40

Bullguard war am Anfang auf dem Rechner drauf.
Ich habe es dann deaktiviert - dachte ich zumindest, weil ich AntiVir als Virenschutz haben wollte.

Die Probelizenz von Bullguard ist auch schon längst abgelaufen.
Soll ich es zur Sicherheit deinstallieren?

Werde mir gleich mal durchlesen, was du über AntiVir gepostet hast und dann mir ggf. ne was Neues suchen.
Vielen Dank für deine Hilfe bis jetzt

cosinus · 17.06.2011, 14:46

Zitat:

Die Probelizenz von Bullguard ist auch schon längst abgelaufen.
Soll ich es zur Sicherheit deinstallieren?

Ja unbedingt deinstallieren! Was soll ein Programm auf dem Rechner laufen, wenn es deaktiviert ist? Ist doch reine Verschwendung! Obendrei eh abgelaufen.

mia82 · 17.06.2011, 15:01

Bullgard ist nun deinstalliert.

Was nun? - ohne Drängeln und quengeln zu wollen ;-)

mia82 · 17.06.2011, 21:34

Nach einem Neustart des Rechners waren die Systemdateien alle sichtbar.
Ich weiß, dass man die ganz einfach wieder unsichtbar bekommt.
Mich würde aber interessieren ob das mit den Trojanern/Malware oder dem odl zu tun hat, oder ob ich noch ein anderes Problem habe.

cosinus · 19.06.2011, 21:55

Mach bitte ein neues OTL-Custom-Log.

mia82 · 22.06.2011, 06:32

Guten morgen,

ich habe Avira temporär deaktiviert.
OTL als Admin ausgeführt.
und einen "normalen" Scan gemacht.

Hier die Logdatei:
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 21.06.2011 21:18:31 - Run 2
OTL by OldTimer - Version 3.2.24.0     Folder = C:\Users\Mia\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 0,92 Gb Available Physical Memory | 46,33% Memory free
4,21 Gb Paging File | 2,99 Gb Available in Paging File | 71,05% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 119,00 Gb Total Space | 9,23 Gb Free Space | 7,76% Space Free | Partition Type: NTFS
Drive D: | 30,04 Gb Total Space | 7,56 Gb Free Space | 25,18% Space Free | Partition Type: FAT32
Drive E: | 4,38 Gb Total Space | 0,21 Gb Free Space | 4,85% Space Free | Partition Type: UDF
Drive F: | 51,39 Gb Total Space | 4,23 Gb Free Space | 8,23% Space Free | Partition Type: NTFS
Drive J: | 44,48 Gb Total Space | 10,65 Gb Free Space | 23,94% Space Free | Partition Type: NTFS
Drive K: | 53,17 Gb Total Space | 19,05 Gb Free Space | 35,84% Space Free | Partition Type: NTFS
 
Computer Name: Mia-LAPTOP | User Name: Mia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.06.17 14:16:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Mia\Desktop\OTL.exe
PRC - [2011.05.08 20:20:48 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.03.18 20:08:23 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.11.05 10:48:38 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.11.28 16:50:22 | 002,195,720 | ---- | M] () -- c:\Programme\radio\Tobit ClipInc\Server\ClipInc-Server.exe
PRC - [2008.10.28 23:01:22 | 000,326,192 | ---- | M] (VMware, Inc.) -- C:\Windows\System32\vmnetdhcp.exe
PRC - [2008.10.28 23:00:50 | 000,064,048 | ---- | M] (VMware, Inc.) -- C:\Programme\VMware\VMware Player\hqtray.exe
PRC - [2008.10.28 23:00:40 | 000,113,200 | ---- | M] (VMware, Inc.) -- C:\Programme\VMware\VMware Player\vmware-authd.exe
PRC - [2008.10.28 23:00:08 | 000,399,920 | ---- | M] (VMware, Inc.) -- C:\Windows\System32\vmnat.exe
PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2008.01.19 09:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.19 09:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2007.12.05 17:14:34 | 000,126,976 | ---- | M] (phonostar) -- C:\Programme\Internetradio phonostar\phonostar\ps_timer.exe
PRC - [2007.12.05 17:10:52 | 000,098,304 | ---- | M] (phonostar) -- C:\Programme\Internetradio phonostar\phonostar\ps_agent.exe
PRC - [2007.06.27 20:04:00 | 001,213,736 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007.06.27 20:03:40 | 000,152,872 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2007.05.08 09:06:36 | 000,790,016 | ---- | M] (ODSoft multimedia) -- C:\Programme\Sceneo\Bonavista\Services\ODSBC\ODSBCApp.exe
PRC - [2007.05.04 17:08:24 | 001,600,512 | ---- | M] (Buhl Data Service GmbH) -- C:\Programme\Sceneo\Bonavista\Services\PVR\pvrservice.exe
PRC - [2007.04.13 18:14:28 | 000,016,384 | ---- | M] (Empolis GmbH) -- C:\Programme\Medion\MEDIONbox\Program\GCS.exe
PRC - [2007.04.13 18:14:26 | 000,036,864 | ---- | M] (Empolis GmbH) -- c:\Programme\Common Files\Gnab\Service\ServiceController.exe
PRC - [2007.03.30 11:10:00 | 000,061,440 | ---- | M] () -- C:\Programme\Fujitsu Siemens\WinManager\WinManager.exe
PRC - [2007.03.02 17:48:00 | 000,098,304 | ---- | M] (Brother Industries, Ltd.) -- C:\Programme\Brother\Brmfcmon\BrMfcMon.exe
PRC - [2007.02.15 17:07:16 | 004,390,912 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007.01.19 12:55:00 | 005,674,352 | ---- | M] (Microsoft Corporation) -- C:\Programme\MSN Messenger\msnmsgr.exe
PRC - [2007.01.04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe
PRC - [2006.12.26 11:23:34 | 000,180,224 | ---- | M] (Wistron Corp.) -- C:\Programme\Launch Manager\OSD.exe
PRC - [2006.12.14 16:53:28 | 000,192,512 | ---- | M] (Wistron) -- C:\Programme\Launch Manager\HotkeyApp.exe
PRC - [2006.11.22 17:31:26 | 000,630,784 | ---- | M] (Motorola Inc.) -- C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe
PRC - [2006.11.17 20:45:26 | 000,118,784 | ---- | M] (Wistron Corp.) -- C:\Programme\Launch Manager\WisLMSvc.exe
PRC - [2006.11.15 16:58:26 | 000,151,552 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2006.11.15 16:57:58 | 000,081,920 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2006.11.09 14:37:52 | 000,086,016 | ---- | M] () -- C:\Programme\Launch Manager\WButton.exe
PRC - [2006.09.28 23:20:00 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
PRC - [2005.07.25 13:36:40 | 000,032,768 | ---- | M] () -- C:\Programme\Launch Manager\LaunchAp.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.06.17 14:16:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Mia\Desktop\OTL.exe
MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] --  -- (OpenVPNService)
SRV - File not found [On_Demand | Stopped] --  -- (Emdepa)
SRV - [2011.05.08 20:20:48 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.03.18 20:08:23 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2008.11.28 16:50:22 | 002,195,720 | ---- | M] () [Auto | Running] -- c:\Program Files\Radio\Tobit ClipInc\Server\ClipInc-Server.exe -- (ClipInc001)
SRV - [2008.10.28 23:01:22 | 000,326,192 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\System32\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2008.10.28 23:00:40 | 000,113,200 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService)
SRV - [2008.10.28 23:00:08 | 000,399,920 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\System32\vmnat.exe -- (VMware NAT Service)
SRV - [2008.10.02 18:25:42 | 000,191,024 | ---- | M] (VMware, Inc.) [On_Demand | Stopped] -- C:\Program Files\VMware\VMware Player\vmware-ufad.exe -- (ufad-ws60)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.07.16 20:35:37 | 000,069,120 | ---- | M] (Google) [Disabled | Stopped] -- C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe -- (GoogleDesktopManager)
SRV - [2007.05.04 17:08:24 | 001,600,512 | ---- | M] (Buhl Data Service GmbH) [Auto | Running] -- C:\Programme\Sceneo\Bonavista\Services\PVR\pvrservice.exe -- (srvcPVR)
SRV - [2007.04.13 18:14:26 | 000,036,864 | ---- | M] (Empolis GmbH) [Auto | Running] -- c:\Programme\Common Files\Gnab\Service\ServiceController.exe -- (GnabService)
SRV - [2007.01.04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)
SRV - [2006.11.17 20:45:26 | 000,118,784 | ---- | M] (Wistron Corp.) [On_Demand | Running] -- C:\Program Files\Launch Manager\WisLMSvc.exe -- (WisLMSvc)
SRV - [2006.11.15 16:57:58 | 000,081,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2006.09.28 23:20:00 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
SRV - [2005.11.17 14:18:52 | 001,527,900 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Programme\ALDI Sued Foto Service\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.03.18 20:08:23 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.11.25 22:24:13 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.10.28 23:01:34 | 000,054,960 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmci.sys -- (vmci)
DRV - [2008.10.28 23:01:32 | 000,026,288 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV - [2008.10.28 23:01:32 | 000,023,216 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMkbd.sys -- (vmkbd)
DRV - [2008.10.28 23:01:30 | 000,857,392 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmx86.sys -- (vmx86)
DRV - [2008.10.28 23:01:28 | 000,032,304 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\hcmon.sys -- (hcmon)
DRV - [2008.10.28 17:03:28 | 000,031,280 | R--- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV - [2008.10.28 17:03:28 | 000,016,560 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV - [2008.10.02 18:24:48 | 000,022,448 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Programme\VMware\VMware Player\vstor2-ws60.sys -- (vstor2-ws60)
DRV - [2007.07.05 19:23:42 | 000,277,504 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8187B.sys -- (RTL8187B)
DRV - [2007.06.21 13:00:53 | 000,320,384 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UDXTTM6000.sys -- (UDXTTM6000)
DRV - [2007.04.30 13:42:14 | 000,081,408 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2007.02.07 18:35:10 | 001,729,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2006.11.28 22:46:24 | 000,028,224 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PDNMp50.sys -- (PDNMp50)
DRV - [2006.11.28 22:46:22 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PDNSp50.sys -- (PDNSp50)
DRV - [2006.11.22 17:35:00 | 000,982,272 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
DRV - [2006.11.15 17:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2006.11.15 12:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006.11.15 10:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2006.11.02 09:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006.10.01 14:37:02 | 000,026,624 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tap0801.sys -- (tap0801)
DRV - [2006.06.29 04:11:48 | 000,017,408 | ---- | M] (DTV-DVB) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UDXTTM6000HID.sys -- (UDXTTM6000HID)
DRV - [2003.04.28 11:27:06 | 000,009,867 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\HOTKEY.sys -- (Hotkey)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.web.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "Google.de"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.web.de/"
FF - prefs.js..extensions.enabledItems: {152455DE-7B40-4bcf-B5B4-C68A1BE85A91}:2.6.7
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4
FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.85
FF - prefs.js..extensions.enabledItems: {75CEEE46-9B64-46f8-94BF-54012DE155F0}:0.4.6
FF - prefs.js..extensions.enabledItems: {29c4afe1-db19-4298-8785-fcc94d1d6c1d}:0.6.2009110501
FF - prefs.js..extensions.enabledItems: {89736E8E-4B14-4042-8C75-AD00B6BD3900}:1.0.5
FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.3
FF - prefs.js..extensions.enabledItems: janetka@pinger:1.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {fc2b8f80-d9a5-4f51-8076-7c7ce3c67ee3}:5.1.0.8
FF - prefs.js..extensions.enabledItems: zotero@chnm.gmu.edu:2.0.9
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20110323
FF - prefs.js..network.proxy.autoconfig_url: "https://vw-online.hdm-stuttgart.de/eBooks/proxy.pac"
FF - prefs.js..network.proxy.type: 2
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009.01.22 00:15:10 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0\extensions\\Components: C:\Program Files\Mozilla Firefox 3\components [2009.01.22 00:15:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox 3\plugins [2010.03.11 21:59:00 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.06.17 15:02:34 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.05 20:56:09 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\sunbird\components [2010.05.09 15:34:08 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files\sunbird\plugins
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Components: C:\Program Files\thunderbird\components [2011.06.15 18:57:24 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Plugins: C:\Program Files\thunderbird\plugins
FF - HKLM\software\mozilla\SeaMonkey 1.1.8\Extensions\\Components: C:\Program Files\mozilla.org\SeaMonkey\Components [2009.03.16 21:40:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\SeaMonkey 1.1.8\Extensions\\Plugins: C:\Program Files\mozilla.org\SeaMonkey\Plugins [2009.01.22 00:15:15 | 000,000,000 | ---D | M]
 
[2011.06.15 18:57:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Extensions
[2011.06.15 18:57:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.05.09 15:34:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
[2008.07.09 00:05:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\extensions
[2011.06.17 22:28:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions
[2010.10.10 20:02:24 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2010.10.10 20:02:45 | 000,000,000 | ---D | M] (Domain Details) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{152455DE-7B40-4bcf-B5B4-C68A1BE85A91}
[2010.10.10 20:02:21 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.03.30 22:55:04 | 000,000,000 | ---D | M] ("Split Browser") -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{29c4afe1-db19-4298-8785-fcc94d1d6c1d}
[2008.01.09 22:24:01 | 000,000,000 | ---D | M] (del.icio.us) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{5a2b4e34-ce62-42e9-a658-06ba4490adf8}
[2010.11.01 21:32:46 | 000,000,000 | ---D | M] (MeasureIt) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{75CEEE46-9B64-46f8-94BF-54012DE155F0}
[2009.08.30 09:20:25 | 000,000,000 | ---D | M] ("TinyUrl Creator") -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{89736E8E-4B14-4042-8C75-AD00B6BD3900}
[2011.06.17 22:28:37 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010.04.04 15:42:15 | 000,000,000 | ---D | M] (FoxTab) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2010.10.10 20:02:21 | 000,000,000 | ---D | M] (Diigo Bookmarks and Web Annotations) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{fc2b8f80-d9a5-4f51-8076-7c7ce3c67ee3}
[2010.08.24 21:57:08 | 000,000,000 | ---D | M] (Firebug) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\firebug@software.joehewitt.com
[2010.05.28 23:14:19 | 000,000,000 | ---D | M] (Pinger) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\janetka@pinger
[2009.01.25 18:36:50 | 000,000,000 | ---D | M] (Smart Middle Click) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\SmartMiddleClick@spiers
[2010.11.01 21:32:49 | 000,000,000 | ---D | M] (Zotero) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\zotero@chnm.gmu.edu
[2010.05.09 15:34:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Sunbird\Profiles\77qk2mf3.default\extensions
[2008.07.08 22:32:38 | 000,002,295 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\blinde-kuh.xml
[2011.06.05 22:46:45 | 000,002,533 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\diigo--google.xml
[2010.12.30 12:17:08 | 000,002,101 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\googlede.xml
[2008.01.09 20:33:40 | 000,001,907 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\leo-eng-ger.xml
[2008.02.25 23:56:25 | 000,001,067 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\wikipedia-deutsch.xml
[2011.06.17 22:28:55 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.07.11 19:35:28 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2009.02.18 18:20:03 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
[2010.07.11 19:35:28 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2002.05.02 12:22:30 | 000,991,232 | ---- | M] (MindAvenue) -- C:\Programme\Mozilla Firefox\plugins\NPAXELPlayer.dll
[2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.08.04 20:57:43 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.08.04 20:57:43 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.08.04 20:57:43 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.08.04 20:57:43 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.08.04 20:57:43 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (FireShot) - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} -  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [CtrlVol]  File not found
O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe ()
O4 - HKLM..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSD.exe (Wistron Corp.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [openvpn-gui]  File not found
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\Quicktime Apple\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SMSERIAL] C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [toolbar_eula_launcher] C:\Programme\GoogleEULA\EULALauncher.exe ( )
O4 - HKLM..\Run: [TVBroadcast] C:\Programme\Sceneo\Bonavista\Services\ODSBC\ODSBCApp.exe (ODSoft multimedia)
O4 - HKLM..\Run: [UVS10 Preload] C:\Programme\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe (Ulead Systems, Inc.)
O4 - HKLM..\Run: [VMware hqtray] C:\Program Files\VMware\VMware Player\hqtray.exe (VMware, Inc.)
O4 - HKLM..\Run: [Wbutton] C:\Program Files\Launch Manager\Wbutton.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [msnmsgr] C:\Programme\MSN Messenger\msnmsgr.exe (Microsoft Corporation)
O4 - HKCU..\Run: [PhonostarAgent] C:\Programme\Internetradio phonostar\phonostar\ps_agent.exe (phonostar)
O4 - HKCU..\Run: [PhonostarTimer] C:\Programme\Internetradio phonostar\phonostar\ps_timer.exe (phonostar)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ\version 7\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ\version 7\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -  File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: GD ([http] in Lokales Intranet)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} hxxp://picasaweb.google.com/s/v/57.11/uploader2.cab (UploadListView Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1183949065925 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Mia\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Mia\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{a70cab19-bb6b-11df-abda-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{a70cab19-bb6b-11df-abda-005056c00008}\Shell\AutoRun\command - "" = J:\LGAutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.06.17 22:24:38 | 000,000,000 | ---D | C] -- C:\Users\Mia\Desktop\mix
[2011.06.17 14:14:33 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Mia\Desktop\OTL.exe
[2011.06.15 20:15:29 | 000,000,000 | ---D | C] -- C:\Users\Mia\AppData\Roaming\Malwarebytes
[2011.06.15 20:14:22 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.06.15 20:14:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.06.15 20:14:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.06.15 20:14:16 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.06.15 20:12:24 | 000,000,000 | ---D | C] -- C:\Programme\anti-malware
[2011.06.15 19:09:38 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.06.15 19:09:36 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011.06.15 19:09:36 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011.06.15 19:09:36 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011.06.15 19:09:34 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2011.06.15 19:09:34 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll
[2011.05.29 20:23:20 | 000,000,000 | ---D | C] -- C:\Users\Mia\.mediathek
[2011.05.29 20:18:00 | 000,000,000 | ---D | C] -- C:\Programme\mediathek
[2007.07.12 04:57:45 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll
[3 C:\Users\Mia\Documents\*.tmp files -> C:\Users\Mia\Documents\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.06.21 21:20:09 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{8E21E027-9A81-475C-B74E-F815515A4C7B}.job
[2011.06.21 21:13:54 | 000,641,432 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.06.21 21:13:54 | 000,607,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.06.21 21:13:54 | 000,131,878 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.06.21 21:13:54 | 000,108,970 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.06.21 21:08:19 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.06.21 21:08:10 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.06.21 21:08:10 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.06.21 21:08:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.06.21 21:08:01 | 2137,186,304 | -HS- | M] () -- C:\hiberfil.sys
[2011.06.20 23:50:34 | 000,000,268 | -H-- | M] () -- C:\sqmdata09.sqm
[2011.06.20 23:50:34 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm
[2011.06.20 23:38:42 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.06.20 23:05:43 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-967124566-3105974339-2490099070-1003UA.job
[2011.06.20 23:05:00 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-967124566-3105974339-2490099070-1003Core.job
[2011.06.19 21:16:42 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2011.06.19 21:11:20 | 000,114,176 | ---- | M] () -- C:\Users\Mia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.06.18 23:01:29 | 000,000,268 | -H-- | M] () -- C:\sqmdata08.sqm
[2011.06.18 23:01:29 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt08.sqm
[2011.06.17 14:16:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Mia\Desktop\OTL.exe
[2011.06.17 10:04:07 | 000,000,600 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\winscp.rnd
[2011.06.17 09:54:21 | 000,000,076 | ---- | M] () -- C:\Users\Mia\pfad-fuer-logs
[2011.06.16 19:02:33 | 000,000,268 | -H-- | M] () -- C:\sqmdata07.sqm
[2011.06.16 19:02:33 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm
[2011.06.15 20:14:23 | 000,001,065 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.06.15 18:44:40 | 000,002,094 | ---- | M] () -- C:\Users\Mia\Desktop\Google Chrome.lnk
[2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.05.24 19:14:10 | 000,222,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[3 C:\Users\Mia\Documents\*.tmp files -> C:\Users\Mia\Documents\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.06.17 09:54:21 | 000,000,076 | ---- | C] () -- C:\Users\Mia\pfad-fuer-logs
[2011.06.15 20:14:23 | 000,001,065 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.12.18 15:35:49 | 000,000,506 | ---- | C] () -- C:\Windows\infothek.INI
[2010.08.16 20:12:22 | 001,205,818 | ---- | C] () -- C:\Windows\System32\fendt_comic.exe
[2010.08.16 20:01:52 | 000,000,051 | ---- | C] () -- C:\Windows\Fendt Comic.ini
[2009.10.23 22:09:24 | 000,000,109 | ---- | C] () -- C:\Windows\jascreg.ini
[2009.10.15 00:08:06 | 000,055,856 | ---- | C] () -- C:\Windows\System32\vnetinst.dll
[2009.09.24 21:29:29 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.09.24 21:29:28 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.04.29 20:49:08 | 000,554,496 | ---- | C] () -- C:\Windows\System32\dvmsg.dll
[2009.04.05 04:57:06 | 001,301,502 | ---- | C] () -- C:\Windows\System32\libswish-e-2.dll
[2009.03.02 23:17:37 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2009.01.25 16:22:40 | 000,019,968 | ---- | C] () -- C:\Windows\System32\cpuinf32.dll
[2009.01.11 21:54:32 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2009.01.11 21:54:32 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2009.01.11 21:47:27 | 000,000,050 | ---- | C] () -- C:\Windows\System32\bridf07a.dat
[2009.01.04 04:01:40 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.12.09 23:34:35 | 000,047,104 | ---- | C] () -- C:\Windows\System32\Wh2Robo.dll
[2008.05.27 19:00:19 | 000,000,600 | ---- | C] () -- C:\Users\Mia\AppData\Roaming\winscp.rnd
[2008.05.27 18:42:14 | 000,000,403 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.05.03 20:05:33 | 000,320,384 | ---- | C] () -- C:\Windows\System32\drivers\UDXTTM6000.sys
[2008.04.09 19:24:51 | 000,000,009 | ---- | C] () -- C:\Users\Mia\AppData\Roaming\mdb.bin
[2008.02.16 16:50:45 | 000,219,473 | ---- | C] () -- C:\Windows\SeaMonkeyUninstall.exe
[2008.02.16 16:50:39 | 000,118,784 | ---- | C] () -- C:\Windows\GREUninstall.exe
[2008.02.14 14:40:53 | 000,000,151 | ---- | C] () -- C:\Windows\PhotoSnapViewer.INI
[2008.01.23 11:09:13 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2008.01.13 12:34:25 | 000,000,600 | ---- | C] () -- C:\Users\Mia\AppData\Local\PUTTY.RND
[2008.01.02 16:51:15 | 000,000,030 | ---- | C] () -- C:\Windows\Iedit_.INI
[2008.01.02 12:37:22 | 000,210,944 | ---- | C] () -- C:\Windows\System32\MSVCRT10.DLL
[2007.12.28 21:24:12 | 000,394,240 | ---- | C] () -- C:\Windows\System32\Smab.dll
[2007.12.28 21:24:11 | 000,066,560 | ---- | C] () -- C:\Windows\MOTA113.exe
[2007.12.28 21:24:11 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2007.12.28 21:24:10 | 000,240,128 | ---- | C] () -- C:\Windows\System32\x.264.exe
[2007.12.28 21:24:09 | 000,502,784 | ---- | C] () -- C:\Windows\x2.64.exe
[2007.12.28 21:24:09 | 000,217,073 | ---- | C] () -- C:\Windows\meta4.exe
[2007.10.03 18:30:16 | 000,000,025 | ---- | C] () -- C:\Windows\cdplayer.ini
[2007.09.27 11:50:15 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2007.09.23 11:57:44 | 000,004,294 | ---- | C] () -- C:\Windows\mozver.dat
[2007.09.22 22:39:29 | 000,000,335 | ---- | C] () -- C:\Windows\nsreg.dat
[2007.09.06 11:13:07 | 000,114,176 | ---- | C] () -- C:\Users\Mia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.09.06 10:38:41 | 000,023,182 | ---- | C] () -- C:\Users\Mia\AppData\Roaming\UserTile.png
[2007.09.06 09:02:42 | 000,004,536 | ---- | C] () -- C:\Users\Mia\AppData\Roaming\wklnhst.dat
[2007.09.06 08:45:29 | 000,000,094 | ---- | C] () -- C:\Users\Mia\AppData\Local\fusioncache.dat
[2007.08.24 20:46:48 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1322.dll
[2007.07.12 04:57:45 | 001,729,152 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2007.07.09 17:32:04 | 000,087,312 | ---- | C] () -- C:\Windows\mws.exe
[2007.07.06 07:39:12 | 000,001,208 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2007.07.06 07:39:06 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2007.07.06 07:12:57 | 000,009,867 | ---- | C] () -- C:\Windows\System32\drivers\HOTKEY.sys
[2007.07.06 06:41:51 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2007.07.06 06:41:51 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1283.dll
[2007.06.20 13:44:37 | 000,000,199 | ---- | C] () -- C:\Windows\WISO.INI
[2007.06.20 13:39:38 | 000,299,008 | ---- | C] () -- C:\Windows\System32\midas.dll
[2007.06.20 13:39:38 | 000,120,320 | ---- | C] () -- C:\Windows\System32\UnzDll.dll
[2007.06.11 14:43:56 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007.06.11 14:43:51 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2007.03.05 13:34:28 | 000,676,224 | ---- | C] () -- C:\Windows\System32\OGACheckControl.DLL
[2006.12.11 06:06:31 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2006.11.02 17:33:31 | 000,641,432 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,131,878 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,379,240 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,607,008 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,108,970 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.09.20 07:34:10 | 000,000,000 | ---- | C] () -- C:\Windows\Buhl.ini
[2006.08.28 04:29:02 | 000,115,001 | ---- | C] () -- C:\Windows\System32\pcre.dll
[2006.08.28 04:29:02 | 000,061,447 | ---- | C] () -- C:\Windows\System32\pcreposix.dll
[2006.08.27 22:48:58 | 004,484,537 | ---- | C] () -- C:\Windows\System32\libxml2-2.dll
[2006.08.27 19:55:50 | 000,074,240 | ---- | C] () -- C:\Windows\System32\zlib1.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 709 bytes -> C:\Users\Mia\Desktop\Foto.eml:OECustomProperty
@Alternate Data Stream - 64 bytes -> C:\P1160392.MOV.MPG:TOC.WMV

< End of report >

cosinus · 22.06.2011, 11:18

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

ATTFilter

:OTL
@Alternate Data Stream - 709 bytes -> C:\Users\Mia\Desktop\Foto.eml:OECustomProperty
@Alternate Data Stream - 64 bytes -> C:\P1160392.MOV.MPG:TOC.WMV
:Commands
[purity]
[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

17.06.2011, 14:23	#7
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun? Ok. Wollte nur sichergehen, dass wir auch das richtige Log zum Rechner durchgehen und nicht die Logs verwechseln. __________________ Logfiles bitte immer in CODE-Tags posten

19.06.2011, 21:55	#13
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun? Mach bitte ein neues OTL-Custom-Log. __________________ Logfiles bitte immer in CODE-Tags posten

Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun?

Log-Analyse und Auswertung: Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun?