Rootkit.Win32.ZAccess.c lässt sich nicht entfernen

OTL logfile created on: 05.09.2011 10:38:54 - Run 1
OTL by OldTimer - Version 3.2.27.0     Folder = C:\xxx
Windows Server 2003 Server 2003 R2 Edition Service Pack 2 (Version = 5.2.3790) - Type = NTDomainController
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 1,55 Gb Available Physical Memory | 47,64% Memory free
5,10 Gb Paging File | 3,17 Gb Available in Paging File | 62,16% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 30,01 Gb Total Space | 6,04 Gb Free Space | 20,13% Space Free | Partition Type: NTFS
Drive D: | 273,40 Gb Total Space | 202,64 Gb Free Space | 74,12% Space Free | Partition Type: NTFS
Drive P: | 814,11 Gb Total Space | 641,29 Gb Free Space | 78,77% Space Free | Partition Type: NTFS
Drive S: | 38,32 Gb Total Space | 0,90 Gb Free Space | 2,34% Space Free | Partition Type: NTFS
 
Computer Name: S-CONNECT-STUTT | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - File not found -- C:\WINDOWS\1921001702:433553293.exe
PRC - [2011.09.02 14:50:39 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Rootkit_Progs\OTL.exe
PRC - [2011.09.01 11:21:13 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2011.07.06 19:52:38 | 000,449,584 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.07.06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011.06.29 12:18:11 | 000,471,040 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\dns.exe
PRC - [2011.04.07 15:54:26 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Server\sched.exe
PRC - [2011.04.07 15:54:14 | 000,334,504 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Server\avgnt.exe
PRC - [2011.03.29 15:21:02 | 000,157,696 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wins.exe
PRC - [2010.05.14 11:44:46 | 000,248,552 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2010.01.06 12:22:58 | 000,017,920 | ---- | M] (Sage Software, Inc.) -- C:\Programme\ACT\Act for Windows\Act.Outlook.Service.exe
PRC - [2008.02.08 09:41:12 | 000,185,632 | ---- | M] (Protexis Inc.) -- C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe
PRC - [2007.07.18 17:04:48 | 000,009,728 | ---- | M] (Hewlett-Packard Company) -- C:\WINDOWS\system32\CPQNiMgt\cpqnimgt.exe
PRC - [2007.07.16 17:36:16 | 000,006,656 | ---- | M] (Hewlett-Packard Company) -- C:\WINDOWS\system32\sysdown.exe
PRC - [2007.07.09 19:08:06 | 000,745,472 | ---- | M] (Hewlett-Packard Company) -- C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe
PRC - [2007.07.06 13:12:04 | 000,004,608 | ---- | M] (Hewlett-Packard Company) -- C:\WINDOWS\system32\CpqMgmt\cqmgserv\cqmgserv.exe
PRC - [2007.07.06 13:08:56 | 000,010,240 | ---- | M] (Hewlett-Packard Company) -- C:\WINDOWS\system32\cpqrcmc.exe
PRC - [2007.06.28 13:36:30 | 000,069,632 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\HP\NCU\cpqteam.exe
PRC - [2007.06.22 13:14:28 | 000,005,120 | ---- | M] (Hewlett-Packard Company) -- C:\WINDOWS\system32\CpqMgmt\cqmghost\cqmghost.exe
PRC - [2007.06.21 14:10:50 | 001,417,216 | ---- | M] (Hewlett-Packard Company) -- C:\hp\hpsmh\bin\smhstart.exe
PRC - [2007.06.21 14:10:00 | 000,041,027 | ---- | M] (Apache Software Foundation) -- C:\hp\hpsmh\bin\rotatelogs.exe
PRC - [2007.06.21 14:09:24 | 000,024,631 | ---- | M] (Hewlett-Packard Company) -- C:\hp\hpsmh\bin\hpsmhd.exe
PRC - [2007.06.14 08:53:02 | 000,019,456 | ---- | M] (Hewlett-Packard Company) -- C:\WINDOWS\system32\CpqMgmt\cqmgstor\cqmgstor.exe
PRC - [2007.06.11 12:10:00 | 000,394,856 | R--- | M] (WinZip Computing, S.L.) -- C:\Programme\WinZip\WZQKPICK.EXE
PRC - [2007.06.11 11:01:18 | 000,082,432 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\HP\Cissesrv\cissesrv.exe
PRC - [2007.02.18 14:00:00 | 000,356,864 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\lserver.exe
PRC - [2007.02.18 14:00:00 | 000,053,760 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\nfsclnt.exe
PRC - [2007.02.18 14:00:00 | 000,036,352 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\nfssvc.exe
PRC - [2007.02.18 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\inetsrv\inetinfo.exe
PRC - [2007.02.18 13:00:00 | 001,056,768 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.02.18 13:00:00 | 000,793,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ntfrs.exe
PRC - [2007.02.18 13:00:00 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\dfssvc.exe
PRC - [2007.02.18 13:00:00 | 000,078,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\sfmprint.exe
PRC - [2007.02.18 13:00:00 | 000,071,680 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\tssdis.exe
PRC - [2007.02.18 13:00:00 | 000,069,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\rdpclip.exe
PRC - [2007.02.18 13:00:00 | 000,065,536 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\sfmsvc.exe
PRC - [2007.02.18 13:00:00 | 000,040,448 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ismserv.exe
PRC - [2007.02.18 13:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\userinit.exe
PRC - [2007.02.17 07:46:28 | 000,427,520 | ---- | M] (Microsoft Corporation) -- C:\Programme\Remote Desktop\mstsc.exe
PRC - [2007.01.08 15:12:14 | 010,215,491 | R--- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Acrobat 6.0\Acrobat\Acrobat.exe
PRC - [2003.10.24 06:37:56 | 000,217,194 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] --  -- (WinHttpAutoProxySvc)
SRV - File not found [Disabled | Stopped] --  -- (HidServ)
SRV - [2011.07.06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.06.29 12:18:11 | 000,471,040 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\dns.exe -- (DNS)
SRV - [2011.06.20 15:28:26 | 000,255,656 | ---- | M] () [Auto | Stopped] -- C:\Programme\Avira\AntiVir Server\avguard.exe -- (AntiVirService)
SRV - [2011.04.07 15:54:26 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Server\sched.exe -- (AntiVirScheduler)
SRV - [2011.03.29 15:21:02 | 000,157,696 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wins.exe -- (WINS) WINS (Windows Internet Name Service)
SRV - [2010.01.04 18:41:38 | 000,081,920 | ---- | M] (Sage Software, Inc.) [Auto | Stopped] -- C:\Programme\ACT\Act for Windows\Act.Scheduler.exe -- (ACT! Scheduler)
SRV - [2008.11.04 01:06:28 | 000,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2008.02.08 09:41:12 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2007.09.20 18:10:02 | 000,032,768 | ---- | M] (Inter-Tel (Delaware), Inc) [Disabled | Stopped] -- C:\Dokumente und Einstellungen\vertrieb-2\Eigene Dateien\Inter-Tel\Collaboration Client 2.0\lkWebLink.exe -- (LkWebLink)
SRV - [2007.07.18 17:04:48 | 000,009,728 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\WINDOWS\system32\CPQNiMgt\cpqnimgt.exe -- (CpqNicMgmt)
SRV - [2007.07.16 17:36:16 | 000,006,656 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\WINDOWS\system32\sysdown.exe -- (sysdown)
SRV - [2007.07.09 19:08:06 | 000,745,472 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe -- (cpqvcagent)
SRV - [2007.07.06 13:12:04 | 000,004,608 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\WINDOWS\system32\CpqMgmt\cqmgserv\cqmgserv.exe -- (CqMgServ)
SRV - [2007.07.06 13:08:56 | 000,010,240 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\WINDOWS\system32\cpqrcmc.exe -- (CpqRcmc)
SRV - [2007.06.22 13:14:28 | 000,200,192 | ---- | M] (Hewlett-Packard Company) [Disabled | Stopped] -- C:\WINDOWS\system32\CIMntfy\cimntfy.exe -- (CIMnotify)
SRV - [2007.06.22 13:14:28 | 000,005,120 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\WINDOWS\system32\CpqMgmt\cqmghost\cqmghost.exe -- (CqMgHost)
SRV - [2007.06.21 14:10:50 | 001,417,216 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\hp\hpsmh\bin\smhstart.exe -- (SysMgmtHp)
SRV - [2007.06.14 08:53:02 | 000,019,456 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\WINDOWS\system32\CpqMgmt\cqmgstor\cqmgstor.exe -- (CqMgStor)
SRV - [2007.06.11 11:01:18 | 000,082,432 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\HP\Cissesrv\cissesrv.exe -- (Cissesrv)
SRV - [2007.02.18 14:00:00 | 000,356,864 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\lserver.exe -- (TermServLicensing)
SRV - [2007.02.18 14:00:00 | 000,216,576 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2007.02.18 14:00:00 | 000,084,992 | R--- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\wdssrv.dll -- (WDSServer) Windows-Bereitstellungsdiensteserver (WDS-Server)
SRV - [2007.02.18 14:00:00 | 000,083,456 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\grovel.exe -- (Groveler) Einzelinstanzspeicherung (Groveler)
SRV - [2007.02.18 14:00:00 | 000,053,760 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\nfsclnt.exe -- (Client For NFS)
SRV - [2007.02.18 14:00:00 | 000,036,352 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\nfssvc.exe -- (NfsSvc)
SRV - [2007.02.18 14:00:00 | 000,030,720 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\rqs.exe -- (rqs)
SRV - [2007.02.18 14:00:00 | 000,017,920 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\tftpd.exe -- (TFTPD)
SRV - [2007.02.18 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (IISADMIN)
SRV - [2007.02.18 13:00:00 | 000,793,088 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\ntfrs.exe -- (NtFrs)
SRV - [2007.02.18 13:00:00 | 000,164,864 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\dfssvc.exe -- (Dfs) Verteiltes Dateisystem (DFS)
SRV - [2007.02.18 13:00:00 | 000,094,720 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\llssrv.exe -- (LicenseService)
SRV - [2007.02.18 13:00:00 | 000,078,336 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\sfmprint.exe -- (MacPrint)
SRV - [2007.02.18 13:00:00 | 000,071,680 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\tssdis.exe -- (Tssdis)
SRV - [2007.02.18 13:00:00 | 000,067,072 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\rsopprov.exe -- (RSoPProv)
SRV - [2007.02.18 13:00:00 | 000,065,536 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\sfmsvc.exe -- (MacFile)
SRV - [2007.02.18 13:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\trksvr.dll -- (TrkSvr) Überwachung verteilter Verknüpfungen (Server)
SRV - [2007.02.18 13:00:00 | 000,040,448 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\ismserv.exe -- (IsmServ)
SRV - [2007.02.18 13:00:00 | 000,012,288 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\sacsvr.dll -- (sacsvr) Hilfsprogramm für spezielle Verwaltungskonsole (SAC)
SRV - [2007.02.18 13:00:00 | 000,008,192 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\ias.dll -- (IAS)
SRV - [2006.10.26 15:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.09.02 14:19:33 | 000,150,528 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tsk10.tmp -- (AFD)
DRV - [2011.09.01 19:32:00 | 000,082,432 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tsk6.tmp -- (IPSec)
DRV - [2011.09.01 19:00:45 | 000,180,224 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tsk5.tmp -- (NetBT)
DRV - [2011.09.01 15:20:19 | 000,439,296 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\tsk3.tmp -- (MRxSmb)
DRV - [2011.07.06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.05.31 18:03:00 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.04.21 11:05:48 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.09.17 12:07:42 | 000,207,488 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NUServerXP32.sys -- (NUServerXP32)
DRV - [2010.02.18 13:25:44 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.02.20 17:11:30 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | Auto | Running] -- C:\Programme\Avira\AntiVir Server\avgio.sys -- (avgio)
DRV - [2007.07.16 17:36:16 | 000,117,248 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hpqilo2.sys -- (hpqilo2)
DRV - [2007.07.06 16:40:10 | 000,212,480 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\cpqteam.sys -- (CPQTeam)
DRV - [2007.06.22 14:55:14 | 000,035,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cpqcidrv.sys -- (CpqCiDrv)
DRV - [2007.06.21 23:33:52 | 000,065,072 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\HpCISSs2.sys -- (HpCISSs2)
DRV - [2007.06.04 16:54:48 | 000,033,280 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\bxdiagx.sys -- (b06diag)
DRV - [2007.06.04 16:48:36 | 000,050,176 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bxnd52x.sys -- (l2nd)
DRV - [2007.02.18 14:00:00 | 000,470,528 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nfssvr.sys -- (NfsSvr)
DRV - [2007.02.18 14:00:00 | 000,323,072 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nfsrdr.sys -- (NfsRdr)
DRV - [2007.02.18 14:00:00 | 000,072,192 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sis.sys -- (SIS)
DRV - [2007.02.18 14:00:00 | 000,065,536 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rpcxdr.sys -- (RpcXdr)
DRV - [2007.02.18 14:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\portmap.sys -- (Portmap)
DRV - [2007.02.18 14:00:00 | 000,022,528 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\msnfsflt.sys -- (msnfsflt)
DRV - [2007.02.18 13:00:00 | 000,175,104 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wlbs.sys -- (WLBS)
DRV - [2007.02.18 13:00:00 | 000,165,376 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sfmsrv.sys -- (MACSRV)
DRV - [2007.02.18 13:00:00 | 000,150,528 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\sfmatalk.sys -- (AppleTalk)
DRV - [2007.02.18 13:00:00 | 000,069,120 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\ClusDisk.sys -- (ClusDisk)
DRV - [2007.02.18 13:00:00 | 000,034,816 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\Dfs.sys -- (DfsDriver)
DRV - [2007.02.15 19:00:00 | 000,026,624 | ---- | M] (DameWare) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\dwvkbd.sys -- (dwvkbd)
DRV - [2007.02.07 19:00:00 | 000,003,712 | ---- | M] (DameWare Development, LLC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\DamewareMini.sys -- (DwMirror)
DRV - [2006.04.05 23:03:54 | 001,431,040 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/hardAdmin.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.09.01 11:21:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins
 
[2011.06.30 09:23:59 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Extensions
[2011.06.30 08:21:57 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.10.12 16:08:41 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2009.09.02 09:00:18 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011.09.01 11:21:13 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.02.03 12:02:02 | 000,000,902 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 192.168.0.208	xxxappserver
O1 - Hosts: 192.168.0.206	xxxserver
O1 - Hosts: 192.168.0.209	xxxfile
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O4 - HKLM..\Run: [Act! Preloader] C:\Programme\ACT\Act for Windows\ActSage.exe (Sage Software, Inc.)
O4 - HKLM..\Run: [Act.Outlook.Service] C:\Programme\ACT\Act for Windows\Act.Outlook.Service.exe (Sage Software, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Server\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CPQTEAM] C:\Programme\HP\NCU\cpqteam.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\xxxLaufwerk.bat ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ShowSuperHidden = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 -  File not found
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://www.apple.com/qtactivex/qtplugin.cab (QuickTime Plugin Control)
O16 - DPF: {0AFD9937-10D5-436F-9F2B-08BF61754446} hxxp://crmserver/crm/Plugin/OTLTools.cab (OutlookTools Object)
O16 - DPF: {3DFD2B52-C6E9-11D4-8226-005004F658FC} hxxp://crmserver.sphinxcomputer.local/CRM/Plugin/eWarePluginX.cab (XeWare Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1198161576656 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} hxxp://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.9.160.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = xxx.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B21C9066-E8EB-4D5E-BB57-993B4B2A07B3}: NameServer = 192.168.50.200,216.146.36.36
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F59CA6CD-E03B-451C-9ACE-3F69B47E7BB1}: DhcpNameServer = 212.9.160.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F59CA6CD-E03B-451C-9ACE-3F69B47E7BB1}: NameServer = 216.146.35.35,216.146.36.36
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll -  File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop BackupWallPaper: 
O29 - HKLM SecurityProviders - (pwdssp.dll) - C:\WINDOWS\System32\pwdssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.12.20 15:13:03 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.09.02 15:18:55 | 000,000,000 | ---D | C] -- C:\Rootkit_Progs
[2011.09.02 14:19:33 | 000,094,768 | ---- | C] (Kaspersky Lab, GERT) -- C:\WINDOWS\System32\drivers\99784405.sys
[2011.09.02 13:42:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2011.09.02 13:40:37 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.09.02 13:40:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.09.02 13:40:34 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011.09.02 13:40:34 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.09.01 19:32:00 | 000,094,768 | ---- | C] (Kaspersky Lab, GERT) -- C:\WINDOWS\System32\drivers\09038975.sys
[2011.09.01 19:00:45 | 000,094,768 | ---- | C] (Kaspersky Lab, GERT) -- C:\WINDOWS\System32\drivers\75285522.sys
[2011.09.01 18:51:42 | 000,094,768 | ---- | C] (Kaspersky Lab, GERT) -- C:\WINDOWS\System32\drivers\74714373.sys
[2011.09.01 18:35:07 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2011.09.01 15:20:19 | 000,094,768 | ---- | C] (Kaspersky Lab, GERT) -- C:\WINDOWS\System32\drivers\28935471.sys
[2011.09.01 11:09:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Avira
[2011.09.01 11:07:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira
[2011.09.01 11:07:21 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2011.09.01 11:07:18 | 000,138,192 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2011.09.01 11:07:18 | 000,066,616 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2011.09.01 11:07:18 | 000,046,424 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys
[2011.09.01 11:07:18 | 000,021,336 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys
[2011.09.01 11:07:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
[2011.09.01 10:46:25 | 000,000,000 | ---D | C] -- C:\Antivir
[2011.08.11 07:39:30 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeeds.dll
[2011.08.11 07:39:30 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeedsbs.dll
[2011.08.11 07:39:29 | 001,212,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\urlmon.dll
[2011.08.11 07:39:29 | 000,916,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wininet.dll
[2011.08.11 07:39:29 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\url.dll
[2011.08.11 07:39:29 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\url.dll
[2011.08.11 07:39:29 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\jsproxy.dll
[2011.08.11 07:39:29 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsproxy.dll
[2011.04.19 09:44:30 | 000,207,488 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\NUServerXP32.sys
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.09.05 10:38:17 | 000,000,952 | -HS- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys
[2011.09.05 08:08:12 | 000,000,434 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{38EC0CAE-CD42-46D8-B4A3-7F00F82ECCBC}.job
[2011.09.05 08:07:18 | 000,002,607 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Microsoft Office Outlook 2007.lnk
[2011.09.05 07:15:05 | 000,698,638 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.09.05 07:15:05 | 000,647,750 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.09.05 07:15:05 | 000,152,672 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.09.05 07:15:05 | 000,129,788 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.09.05 07:14:03 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.09.05 07:10:20 | 000,000,000 | ---- | M] () -- C:\WINDOWS\1921001702
[2011.09.05 07:10:19 | 000,043,408 | -HS- | M] () -- C:\WINDOWS\System32\c_85914.nl_
[2011.09.05 07:10:15 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.09.02 14:19:33 | 000,094,768 | ---- | M] (Kaspersky Lab, GERT) -- C:\WINDOWS\System32\drivers\99784405.sys
[2011.09.02 13:42:40 | 000,586,306 | ---- | M] () -- C:\WINDOWS\System32\drivers\Cat.DB
[2011.09.01 19:32:00 | 000,094,768 | ---- | M] (Kaspersky Lab, GERT) -- C:\WINDOWS\System32\drivers\09038975.sys
[2011.09.01 19:00:45 | 000,094,768 | ---- | M] (Kaspersky Lab, GERT) -- C:\WINDOWS\System32\drivers\75285522.sys
[2011.09.01 18:51:42 | 000,094,768 | ---- | M] (Kaspersky Lab, GERT) -- C:\WINDOWS\System32\drivers\74714373.sys
[2011.09.01 15:20:19 | 000,094,768 | ---- | M] (Kaspersky Lab, GERT) -- C:\WINDOWS\System32\drivers\28935471.sys
[2011.09.01 10:42:00 | 000,001,536 | ---- | M] () -- C:\HBEDV.KEY
[2011.08.30 08:08:44 | 000,002,505 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Microsoft Office    Excel 2007.lnk
[2011.08.29 11:17:00 | 000,261,167 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\xxx.pdf
[2011.08.29 07:08:45 | 000,065,536 | ---- | M] () -- C:\WINDOWS\NETLOGON.CHG
[2011.08.24 15:45:15 | 000,000,027 | ---- | M] () -- C:\WINDOWS\EZSET_SP.INI
[2011.08.17 08:43:31 | 000,378,239 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\xxx.pdf
[2011.08.12 08:14:24 | 000,007,762 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\xxx.pdf
[2011.08.11 09:05:40 | 000,003,423 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.08.09 10:29:01 | 000,271,665 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\PCI_1730-AE.pdf
[2011.08.09 10:14:20 | 000,395,556 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\PCI-1730U_DS20110805143351.pdf
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.09.02 13:42:31 | 000,586,306 | ---- | C] () -- C:\WINDOWS\System32\drivers\Cat.DB
[2011.09.01 19:55:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\1921001702
[2011.09.01 18:00:49 | 000,043,408 | -HS- | C] () -- C:\WINDOWS\System32\c_85914.nl_
[2011.09.01 10:42:00 | 000,001,536 | ---- | C] () -- C:\HBEDV.KEY
[2011.08.29 11:17:00 | 000,261,167 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\xxx.pdf
[2011.08.12 08:14:27 | 000,007,762 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\xxx.pdf
[2011.08.09 10:29:01 | 000,271,665 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\PCI_1730-AE.pdf
[2011.08.09 10:14:20 | 000,395,556 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\PCI-1730U_DS20110805143351.pdf
[2011.05.20 09:43:36 | 000,000,027 | ---- | C] () -- C:\WINDOWS\EZSET_SP.INI
[2010.09.20 18:15:39 | 000,000,952 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys
[2010.09.20 18:15:39 | 000,000,088 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\572815C7D2.sys
[2010.09.02 12:47:04 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\ActAB32.dll
[2010.09.02 12:47:03 | 000,192,585 | ---- | C] () -- C:\WINDOWS\System32\ActExt.dll
[2009.03.02 17:34:03 | 000,003,584 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.08.04 09:59:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\HPMProp.INI
[2008.05.06 13:32:58 | 000,001,843 | ---- | C] () -- C:\WINDOWS\System32\RC98E1A0.dat
[2008.05.06 13:32:58 | 000,000,072 | ---- | C] () -- C:\WINDOWS\ricdb.ini
[2008.05.06 13:32:57 | 000,000,148 | ---- | C] () -- C:\WINDOWS\System32\RPCS.ini
[2008.01.11 18:42:19 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\nhciClassInstallL.dll
[2008.01.07 14:54:53 | 000,000,170 | ---- | C] () -- C:\WINDOWS\hpbafd.ini
[2008.01.03 22:16:21 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2008.01.02 13:38:01 | 000,004,765 | ---- | C] () -- C:\WINDOWS\System32\dhcpctrs.ini
[2008.01.02 13:25:54 | 000,001,311 | ---- | C] () -- C:\WINDOWS\System32\dfsmgmt.dll.config
[2008.01.02 13:25:52 | 000,039,160 | ---- | C] () -- C:\WINDOWS\System32\Dfsrperf.ini
[2008.01.02 13:25:20 | 000,080,471 | ---- | C] () -- C:\WINDOWS\System32\w3ctrs.ini
[2008.01.02 13:25:20 | 000,017,138 | ---- | C] () -- C:\WINDOWS\System32\axperf.ini
[2008.01.02 13:25:18 | 000,017,728 | ---- | C] () -- C:\WINDOWS\System32\infoctrs.ini
[2008.01.02 13:25:17 | 000,024,875 | ---- | C] () -- C:\WINDOWS\System32\dnsperf.ini
[2007.12.20 16:28:28 | 000,121,995 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2007.12.20 15:16:24 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2007.12.20 15:09:12 | 000,021,268 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2007.12.20 13:51:22 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2007.12.20 13:50:36 | 000,284,520 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2007.12.20 13:39:40 | 000,004,725 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2007.12.20 13:39:38 | 000,179,440 | ---- | C] () -- C:\WINDOWS\System32\schema.ini
[2007.12.20 13:39:26 | 000,698,638 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2007.12.20 13:39:26 | 000,647,750 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2007.12.20 13:39:26 | 000,275,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2007.12.20 13:39:26 | 000,272,566 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2007.12.20 13:39:26 | 000,152,672 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2007.12.20 13:39:26 | 000,129,788 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2007.12.20 13:39:26 | 000,035,730 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2007.12.20 13:39:26 | 000,029,710 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2007.12.20 13:39:22 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2007.12.20 13:39:22 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2007.12.20 13:39:12 | 000,053,024 | ---- | C] () -- C:\WINDOWS\System32\ntdsctrs.ini
[2007.12.20 13:39:12 | 000,042,502 | ---- | C] () -- C:\WINDOWS\System32\ntfrsrep.ini
[2007.12.20 13:39:12 | 000,011,343 | ---- | C] () -- C:\WINDOWS\System32\ntfrscon.ini
[2007.12.20 13:39:08 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2007.12.20 13:39:00 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\drivers\netbt.sys
[2007.12.20 13:38:44 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2007.12.20 13:38:44 | 000,046,907 | ---- | C] () -- C:\WINDOWS\mib.bin
[2007.12.20 13:38:02 | 000,082,432 | ---- | C] () -- C:\WINDOWS\System32\drivers\ipsec.sys
[2007.12.20 13:38:02 | 000,023,830 | ---- | C] () -- C:\WINDOWS\System32\ipsecprf.ini
[2007.12.20 13:37:54 | 000,024,711 | ---- | C] () -- C:\WINDOWS\System32\iasperf.ini
[2007.12.20 13:37:28 | 000,216,006 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2007.12.20 13:36:52 | 000,005,948 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2007.12.20 13:36:40 | 000,000,041 | ---- | C] () -- C:\WINDOWS\System32\mqtgsvc.exe.cfg
[2007.06.14 08:53:02 | 000,029,696 | ---- | C] () -- C:\WINDOWS\System32\cqstrutl.dll
[2003.09.17 15:00:56 | 000,266,327 | ---- | C] () -- C:\WINDOWS\System32\ADErrorHandling.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 816 bytes -> C:\WINDOWS\1921001702:433553293.exe
@Alternate Data Stream - 60 bytes -> C:\Microsoft UAM-Datenträger:AFP_AfpInfo
@Alternate Data Stream - 44 bytes -> C:\Microsoft UAM-Datenträger:AFP_DeskTop
@Alternate Data Stream - 4096 bytes -> C:\Microsoft UAM-Datenträger:AFP_IdIndex
@Alternate Data Stream - 125 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2

< End of report >