google leitet zu falschen Websites, dropper.gen, cycbot.osb, u.a.

Nicole75

Hallo,

ich bin zum ersten Mal in einem Forum und hoffe, alles richtig zu machen...

Am 21.11. hat Antivir mir gemeldet, dass TR/Dropper.Gen gefunden und in Quarantäne verschoben wurde. Ich dachte, dass das Thema damit erledigt ist.

Wenn ich aber mit Firefox gegoogelt habe, wurde ich immer auf andere Seiten geschickt, als ich anklickte.

Ein Suchlauf mit Antivir ergab einige Treffer:TR/Cycbot.osb, TR/Ransom.FM.3 sowie EShoper.DQ.

Nachdem diese in Quarantäne gepackt wurden, erhielt ich aber die nächsten Tage immer wieder die Meldung, dass TR/Cycbot.osb gefunden wurde.

Gestern machte ich einen Suchlauf mit Malware und OTL (um die Ergebnisse zu posten, stellte aber dann fest, dass ich wohl einer alten Anleitung gefolgt bin und wollte heute morgen daher nochmal neu starten), heute morgen meldete Antivir dann TR/Drop.Softomat.AN.


Ich habe jetzt Defogger gemacht, nochmal OTL und auch Gmer.

Hier der OTL.TXT:

OTL logfile created on: 25.11.2011 08:11:12 - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = D:\Florian\DOWNLOADS
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

511,48 Mb Total Physical Memory | 204,66 Mb Available Physical Memory | 40,01% Memory free
1,22 Gb Paging File | 0,83 Gb Available in Paging File | 68,43% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 93,16 Gb Total Space | 70,39 Gb Free Space | 75,56% Space Free | Partition Type: NTFS
Drive D: | 83,38 Gb Total Space | 51,75 Gb Free Space | 62,07% Space Free | Partition Type: NTFS
Drive E: | 9,76 Gb Total Space | 5,35 Gb Free Space | 54,81% Space Free | Partition Type: FAT32
Drive N: | 1396,92 Gb Total Space | 1197,61 Gb Free Space | 85,73% Space Free | Partition Type: FAT32

Computer Name: NAME-XEPX1MHXVH | User Name: Florian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011.11.24 18:34:35 | 000,584,192 | ---- | M] (OldTimer Tools) -- D:\Florian\DOWNLOADS\OTL.exe
PRC - [2011.07.05 18:03:25 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.05.22 19:39:56 | 000,273,544 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Real\RealPlayer\Update\realsched.exe
PRC - [2011.05.02 06:01:22 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2010.11.02 22:31:58 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.10.22 02:00:00 | 002,105,344 | ---- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\WLanGUI.exe
PRC - [2010.10.22 02:00:00 | 000,376,832 | ---- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\WLanNetService.exe
PRC - [2010.07.22 09:17:55 | 000,329,168 | ---- | M] () -- C:\Programme\Verbindungsassistent\WTGService.exe
PRC - [2010.05.14 10:44:46 | 000,248,552 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2010.01.14 21:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.10.14 12:36:56 | 002,793,304 | ---- | M] () -- C:\Programme\Logitech\Logitech WebCam Software\LWS.exe
PRC - [2009.10.14 12:34:18 | 000,560,472 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2009.10.09 05:45:56 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) -- D:\Programme\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
PRC - [2009.10.07 00:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
PRC - [2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.02.23 16:32:56 | 000,126,976 | ---- | M] (SAMSUNG ELECTRONICS) -- D:\Programme\SMSTray.exe
PRC - [2007.01.30 20:36:30 | 000,057,344 | ---- | M] ((주)마크애니) -- C:\Programme\MarkAny\ContentSafer\MaAgent.exe
PRC - [2006.10.11 11:45:12 | 000,075,304 | ---- | M] (ScanSoft, Inc.) -- C:\Programme\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
PRC - [2006.09.25 09:12:20 | 000,045,056 | ---- | M] (ATI Technologies Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\CLI.exe
PRC - [2003.12.29 23:33:16 | 000,094,208 | ---- | M] (ICSI Technology Ltd.) -- C:\WINDOWS\Dit.exe
PRC - [2003.06.27 15:39:10 | 000,506,368 | ---- | M] (Chicony) -- C:\WINDOWS\mHotkey.exe
PRC - [2003.06.27 09:36:30 | 005,798,912 | ---- | M] (Chicony) -- C:\WINDOWS\CNYHKey.exe
PRC - [2002.09.20 16:29:30 | 000,053,248 | ---- | M] (Computer Associates) -- C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe


========== Modules (No Company Name) ==========

MOD - [2011.10.13 18:46:39 | 003,391,488 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_b02740ca\mscorlib.dll
MOD - [2011.10.13 18:46:35 | 000,835,584 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_cbab3089\system.drawing.dll
MOD - [2011.10.13 18:46:26 | 002,088,960 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_7c4b4daf\system.xml.dll
MOD - [2011.10.13 18:46:19 | 003,018,752 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_58dd5f5f\system.windows.forms.dll
MOD - [2011.10.13 18:46:07 | 001,966,080 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_d1e55eac\system.dll
MOD - [2011.10.13 18:45:55 | 001,232,896 | ---- | M] () -- c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\system.dll
MOD - [2011.10.13 18:45:54 | 001,265,664 | ---- | M] () -- c:\windows\assembly\gac\system.web\1.0.5000.0__b03f5f7f11d50a3a\system.web.dll
MOD - [2010.07.22 09:17:55 | 000,329,168 | ---- | M] () -- C:\Programme\Verbindungsassistent\WTGService.exe
MOD - [2010.02.24 11:08:21 | 000,372,736 | ---- | M] () -- c:\windows\assembly\gac\system.management\1.0.5000.0__b03f5f7f11d50a3a\system.management.dll
MOD - [2010.02.24 11:08:20 | 001,339,392 | ---- | M] () -- c:\windows\assembly\gac\system.xml\1.0.5000.0__b77a5c561934e089\system.xml.dll
MOD - [2010.02.24 11:08:16 | 000,323,584 | ---- | M] () -- c:\windows\assembly\gac\system.runtime.remoting\1.0.5000.0__b77a5c561934e089\system.runtime.remoting.dll
MOD - [2010.02.24 11:08:12 | 000,466,944 | ---- | M] () -- c:\windows\assembly\gac\system.drawing\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll
MOD - [2010.02.24 11:08:09 | 002,052,096 | ---- | M] () -- c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll
MOD - [2010.01.28 12:57:53 | 000,355,688 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2009.10.14 12:36:56 | 002,793,304 | ---- | M] () -- C:\Programme\Logitech\Logitech WebCam Software\LWS.exe
MOD - [2009.10.14 12:34:18 | 000,560,472 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LogiShrd\LQCVFX\COCIManager.exe
MOD - [2009.02.27 16:41:26 | 000,311,296 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU
MOD - [2004.02.03 19:38:47 | 000,233,472 | ---- | M] () -- c:\windows\assembly\gac\mscorlib.resources\1.0.5000.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2004.02.03 19:38:47 | 000,180,224 | ---- | M] () -- c:\windows\assembly\gac\system.windows.forms.resources\1.0.5000.0_de_b77a5c561934e089\system.windows.forms.resources.dll
MOD - [2003.06.16 17:42:20 | 000,049,152 | ---- | M] () -- C:\WINDOWS\CNYUSB.dll
MOD - [2003.05.27 17:13:02 | 000,024,576 | ---- | M] () -- C:\WINDOWS\HKCYDLL.dll
MOD - [2003.05.26 19:19:18 | 000,532,544 | ---- | M] () -- C:\WINDOWS\PIC.dll
MOD - [2003.05.16 20:09:32 | 000,011,776 | ---- | M] () -- C:\WINDOWS\HIDMNT.dll
MOD - [2001.10.28 16:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011.07.05 18:03:25 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.05.02 06:01:22 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.10.22 02:00:00 | 000,376,832 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Programme\avmwlanstick\WLanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2010.07.22 09:17:55 | 000,329,168 | ---- | M] () [Auto | Running] -- C:\Programme\Verbindungsassistent\WTGService.exe -- (WTGService)
SRV - [2010.03.23 19:36:11 | 000,867,080 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009.10.09 05:45:56 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- D:\Programme\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor8.0)
SRV - [2009.10.07 00:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2006.08.23 23:38:26 | 000,075,768 | ---- | M] (Zone Labs, LLC) [Auto | Stopped] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2005.04.03 23:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2002.09.20 16:41:02 | 000,077,824 | ---- | M] (Computer Associates) [On_Demand | Stopped] -- C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe -- (CA_LIC_SRVR)
SRV - [2002.09.20 16:29:30 | 000,053,248 | ---- | M] (Computer Associates) [Auto | Running] -- C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe -- (LogWatch)
SRV - [2002.09.20 16:27:06 | 000,077,824 | ---- | M] (Computer Associates) [On_Demand | Stopped] -- C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe -- (CA_LIC_CLNT)
SRV - [2001.11.12 13:31:48 | 000,020,480 | ---- | M] (X10) [On_Demand | Stopped] -- C:\Programme\Common Files\X10\Common\X10nets.exe -- (x10nets)


========== Driver Services (SafeList) ==========

DRV - [2011.11.25 08:03:47 | 000,013,440 | ---- | M] (ICSI Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\USBCRFT.SYS -- (CardReaderFilter)
DRV - [2011.07.05 18:03:37 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.05 18:03:37 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.10.22 02:01:00 | 000,586,752 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fwlanusbn.sys -- (fwlanusbn)
DRV - [2010.10.22 02:01:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avmeject.sys -- (avmeject)
DRV - [2009.10.07 09:49:50 | 000,023,832 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvuvcflt.sys -- (FilterService)
DRV - [2009.10.07 09:49:38 | 006,756,632 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvuvc.sys -- (LVUVC) Logitech Webcam 600(UVC)
DRV - [2009.10.07 09:47:55 | 000,266,008 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvrs.sys -- (LVRS)
DRV - [2009.10.07 00:46:36 | 000,025,752 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009.05.11 11:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009.05.11 09:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.07.24 10:03:56 | 000,101,760 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2006.12.28 01:02:00 | 000,265,088 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV - [2006.12.17 03:50:29 | 001,918,464 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2006.08.23 23:38:36 | 000,392,824 | ---- | M] (Zone Labs, LLC) [Kernel | System | Running] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2006.08.03 01:53:32 | 000,029,680 | ---- | M] (Zone Labs, LLC) [Kernel | Boot | Running] -- C:\WINDOWS\System32\ZoneLabs\srescan.sys -- (srescan)
DRV - [2004.01.16 13:02:58 | 000,017,408 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\x10ufx2.sys -- (XUIF)
DRV - [2004.01.16 09:31:56 | 000,380,736 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PRISMA00.sys -- (PRISM_A00)
DRV - [2003.12.05 18:46:36 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc)
DRV - [2003.06.12 10:47:42 | 000,024,704 | ---- | M] (Philips Semiconductors) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PhTVTune.sys -- (PhTVTune)
DRV - [2003.06.05 10:04:22 | 000,350,752 | ---- | M] (Philips Semiconductors) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Cap7134.sys -- (Cap7134) MEDION (7134)
DRV - [2003.05.22 19:44:44 | 000,670,203 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctxs51.sys -- (Intels51)
DRV - [2002.04.24 12:07:56 | 000,019,928 | ---- | M] (Winbond Electronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wbscr.sys -- (wbscr)
DRV - [2001.08.18 04:33:12 | 000,322,432 | ---- | M] (Matrox Graphics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\G400m.sys -- (G400)
DRV - [2001.08.18 04:19:52 | 000,070,784 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\atiragem.sys -- (atirage)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.medion.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com/
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof0.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = fritz.box

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.update: false
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.1
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:2.7.1.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.3
FF - prefs.js..keyword.URL: "hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 56545
FF - prefs.js..network.proxy.type: 4

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: c:\programme\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: c:\programme\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.647: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.647: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: c:\programme\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Programme\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\System32\Macromed\Flash\NPSWF32.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Programme\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2010.10.18 18:35:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.05.22 19:40:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: D:\Programme\Mozilla Firefox\components [2011.10.02 08:27:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.11.22 18:32:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.11.22 18:32:34 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Programme\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2010.10.18 18:35:57 | 000,000,000 | ---D | M]

[2011.05.15 15:28:46 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\Mozilla\Extensions
[2011.05.15 15:28:46 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\Mozilla\Extensions\home2@tomtom.com
[2011.10.12 07:35:34 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\Mozilla\Firefox\Profiles\5naqbis0.default\extensions
[2011.10.12 07:35:34 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\Mozilla\Firefox\Profiles\5naqbis0.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
[2011.11.22 18:32:39 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.06.25 07:49:36 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\FLORIAN\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\5NAQBIS0.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.11.21 05:21:43 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2010.11.12 18:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2008.07.30 08:58:33 | 000,024,576 | ---- | M] (My Search) -- C:\Programme\mozilla firefox\plugins\NPMySrch.dll
[2011.11.21 02:17:49 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.11.21 02:09:48 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2011.11.21 02:17:49 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011.11.21 02:17:49 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.11.21 02:17:49 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.11.21 02:17:49 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2002.08.29 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\prxtbsof0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ATICCC] C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe ()
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\WLanGUI.exe (AVM Berlin)
O4 - HKLM..\Run: [CHotkey] C:\WINDOWS\mHotkey.exe (Chicony)
O4 - HKLM..\Run: [Cmaudio] C:\WINDOWS\CMICNFG.CPL (C-Media Corporation)
O4 - HKLM..\Run: [Dit] C:\WINDOWS\Dit.exe (ICSI Technology Ltd.)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [ledpointer] C:\WINDOWS\CNYHKey.exe (Chicony)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Programme\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [MAAgent] C:\Programme\MarkAny\ContentSafer\MaAgent.exe ((주)마크애니)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [OpwareSE4] C:\Programme\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [SMSTray] D:\Programme\SMSTray.exe (SAMSUNG ELECTRONICS)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\programme\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Zone Labs Client] D:\Programme\ZoneAlarm\zlclient.exe (Zone Labs, LLC)
O4 - HKCU..\Run: [AOLMIcon] C:\WINDOWS\AolMIcon.exe (AOL Deutschland)
O4 - HKCU..\Run: [TomTomHOME.exe] "C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe" File not found
O4 - Startup: C:\Dokumente und Einstellungen\Florian\Startmenü\Programme\Autostart\Logitech . Produktregistrierung.lnk = C:\Programme\Logitech\Logitech WebCam Software\eReg.exe (Leader Technologies/Logitech)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data]
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab (Shockwave ActiveX Control)
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} hxxp://software-dl.real.com/04a30f04300bfbf27206/netzip/RdxIE601_de.cab (RdxIE Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1266954649468 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1266954780015 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} hxxp://wts.freshfields.com/msrdp.cab (Microsoft RDP Client Control (redist))
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38020.7125 (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0CB1965A-DF6F-4FE6-8C97-7D8A5B9A2A1F}: NameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{92D903A1-F71B-4902-8081-0869BC3C343B}: NameServer = 191.168.178.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\MEDION 5.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\MEDION 5.bmp
O28 - HKLM ShellExecuteHooks: {88485281-8b4b-4f8d-9ede-82e29a064277} - C:\Programme\MarkAny\ContentSafer\MACSMANAGER.dll (MarkAny Cooperation.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.02.03 19:34:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{e25a6e1c-930a-11df-9a33-000c76c43a57}\Shell - "" = AutoRun
O33 - MountPoints2\{e25a6e1c-930a-11df-9a33-000c76c43a57}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e25a6e1c-930a-11df-9a33-000c76c43a57}\Shell\AutoRun\command - "" = L:\AutoRun.exe
O33 - MountPoints2\{e25a6e1f-930a-11df-9a33-000c76c43a57}\Shell - "" = AutoRun
O33 - MountPoints2\{e25a6e1f-930a-11df-9a33-000c76c43a57}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e25a6e1f-930a-11df-9a33-000c76c43a57}\Shell\AutoRun\command - "" = L:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {080D8721-F38D-7776-AC37-AC14E06C3E49} - Outlook Express
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608555} - Internet Explorer Classes for Java
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 9.0
ActiveX: {1AE3B21B-0FE9-7E39-C4D6-53C8D2739150} - Viewpoint Media Player
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 9.0
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4d64f3ba-f112-4efe-a02e-96680859937c} - KB918899
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5b7bf89d-d196-4c32-a303-a57b8ab7f18d} - KB918439
ActiveX: {5c9ff2bf-938d-47fe-85d9-9dbab4f65018} - KB897715
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {795d0712-722c-43ec-906a-fc5e678eada9} - Q831167
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\System32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {abcdf74f-9a64-4e6e-b8eb-6e5a41de6550} -
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {dd772a76-bef3-44d7-8b39-502c8504c1f1} - KB925486
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {eddbec60-89cb-44ef-8291-0850fd28ff6a} - Q832894
ActiveX: {EFCE7BE0-510E-4932-9475-F44CD90DE16A} - Microsoft .NET Framework 1.1 Security Update (KB2572067)
ActiveX: {f15ee071-deb7-4cbb-951f-431c98338d8e} - KB911567
ActiveX: {F5776D81-AE53-4935-8E84-B0B283D8BCEF} - Q330994
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: LanmanWorkstation - File not found
NetSvcs: Messenger - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: Ip6FwHlp - File not found


CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011.11.24 20:05:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Florian\Desktop\Anleitung Trojaner Board-Dateien
[2011.11.24 14:28:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\Malwarebytes
[2011.11.24 14:28:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2011.11.24 14:28:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.11.24 14:28:25 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011.11.23 18:16:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Florian\temp alt
[2011.11.22 07:53:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Florian\Desktop\103534-tr-dropper-gen-meiner-externen-festplatte-entfernen-Dateien
[2011.11.21 16:24:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\PanoramaStudio2
[2011.11.21 16:22:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\PanoramaStudio 2
[2011.11.21 06:11:30 | 000,000,000 | ---D | C] -- C:\Programme\6AFED
[2011.11.21 06:11:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\2496A
[2011.11.20 22:29:01 | 000,000,000 | ---D | C] -- C:\Programme\C2AAD
[2011.11.20 22:28:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\584C2
[2011.11.20 22:28:30 | 000,000,000 | ---D | C] -- C:\Programme\LP
[2011.11.20 11:30:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Florian\restore
[2011.11.20 11:22:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Foto Paradies
[2011.11.19 11:40:26 | 001,048,576 | ---- | C] (hxxp://www.mp3dev.org/) -- C:\WINDOWS\System32\lameACM.acm
[2011.11.19 11:40:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Florian\Startmenü\Programme\Lame MP3 Codec
[2011.11.19 11:40:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\XviD
[2011.11.19 11:38:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Samsung
[2011.11.19 11:38:02 | 000,245,760 | ---- | C] (Teruten Inc.) -- C:\WINDOWS\System32\MSCLib.dll
[2011.11.19 11:38:02 | 000,155,648 | ---- | C] (Teruten Inc.) -- C:\WINDOWS\System32\MSFLib.dll
[2011.11.19 11:38:02 | 000,057,344 | ---- | C] (Marktek Inc.) -- C:\WINDOWS\System32\MTXSYNCICON.dll
[2011.11.19 11:37:59 | 000,040,960 | ---- | C] (Telechips Inc.,) -- C:\WINDOWS\System32\MTTELECHIP.dll
[2011.11.19 11:37:58 | 000,364,544 | ---- | C] ((주)마크애니) -- C:\WINDOWS\System32\MASetupWizard.dll
[2011.11.19 11:37:58 | 000,024,576 | ---- | C] ((주)마크애니) -- C:\WINDOWS\System32\MASetupCleaner.exe
[2011.11.19 11:37:56 | 000,106,609 | ---- | C] ((주) 마크애니, 컨텐츠 사업실) -- C:\WINDOWS\System32\MaJUtilLib.dll
[2011.11.19 11:37:56 | 000,049,152 | ---- | C] ((주) 마크애니) -- C:\WINDOWS\System32\MaJGUILib.dll
[2011.11.19 11:37:56 | 000,045,056 | ---- | C] ((주) 마크애니) -- C:\WINDOWS\System32\MaXMLProto.dll
[2011.11.19 11:37:55 | 000,057,344 | ---- | C] (Marktek) -- C:\WINDOWS\System32\MK_Lyric.dll
[2011.11.19 11:37:55 | 000,045,056 | ---- | C] ((주) 마크애니) -- C:\WINDOWS\System32\MACXMLProto.dll
[2011.11.19 11:37:45 | 000,040,960 | ---- | C] (마크애니연구소) -- C:\WINDOWS\System32\MAMACExtract.dll
[2011.11.19 11:37:45 | 000,000,000 | ---D | C] -- C:\Programme\MarkAny
[2011.11.19 11:37:35 | 000,118,784 | ---- | C] ((주)마크애니) -- C:\WINDOWS\System32\MaDRM.dll
[2011.11.19 11:37:29 | 000,569,344 | ---- | C] ((c) MusicCity) -- C:\WINDOWS\System32\muzdecode.ax
[2011.11.19 11:37:29 | 000,471,040 | ---- | C] (Musiccity Co.Ltd.) -- C:\WINDOWS\System32\muzapp.dll
[2011.11.19 11:37:29 | 000,397,429 | ---- | C] (Pixtree Technologies, Inc.) -- C:\WINDOWS\System32\PixtreeMP4FormatWriter.ax
[2011.11.19 11:37:29 | 000,258,048 | ---- | C] ((c) PeeringPortal) -- C:\WINDOWS\System32\muzoggsp.ax
[2011.11.19 11:37:29 | 000,200,704 | ---- | C] ( (c) MusicCity) -- C:\WINDOWS\System32\muzwmts.dll
[2011.11.19 11:37:29 | 000,163,840 | ---- | C] (Musiccity Co.Ltd.) -- C:\WINDOWS\System32\muzapp.exe
[2011.11.19 11:37:29 | 000,135,168 | ---- | C] (Musiccity Co.Ltd.) -- C:\WINDOWS\System32\muzaf1.dll
[2011.11.19 11:37:29 | 000,131,072 | ---- | C] ((c) MusicCity) -- C:\WINDOWS\System32\muzmpgsp.ax
[2011.11.19 11:37:29 | 000,122,880 | ---- | C] ((c) MUSICCITY) -- C:\WINDOWS\System32\muzeffect.ax
[2011.11.19 11:37:29 | 000,110,592 | ---- | C] (ENJsoft Corporation) -- C:\WINDOWS\System32\tg_dump.dll
[2011.11.19 11:37:29 | 000,110,592 | ---- | C] ((c) MusicCity) -- C:\WINDOWS\System32\muzmp4sp.ax
[2011.11.19 11:36:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\InstallShield
[2011.11.19 11:32:50 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\All Users\Dokumente\Eigene Bilder
[2011.11.19 11:30:11 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\All Users\Dokumente\Eigene Videos
[2011.11.19 11:25:39 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\All Users\Dokumente\Eigene Musik
[2011.11.07 15:39:15 | 000,586,752 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\drivers\fwlanusbn.sys
[2011.11.07 15:39:15 | 000,078,336 | ---- | C] (AVM Berlin) -- C:\WINDOWS\System32\fwusbnci.dll
[2011.11.03 18:27:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Florian\D-Fend Reloaded
[2011.11.03 18:27:33 | 000,000,000 | ---D | C] -- C:\Programme\D-Fend Reloaded
[2011.11.01 16:16:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Florian\Eigene Dateien\Eigene Scans
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.11.25 08:10:26 | 000,000,540 | ---- | M] () -- C:\Dokumente und Einstellungen\Florian\Desktop\Verknüpfung mit OTL.lnk
[2011.11.25 08:10:19 | 000,000,041 | ---- | M] () -- C:\WINDOWS\Filzip.ini
[2011.11.25 08:09:56 | 000,045,700 | ---- | M] () -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\wklnhst.dat
[2011.11.25 08:03:47 | 000,013,440 | ---- | M] (ICSI Technology Ltd.) -- C:\WINDOWS\System32\drivers\USBCRFT.SYS
[2011.11.25 08:03:34 | 000,054,112 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2011.11.25 08:03:10 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1101682426-1674176240-2202698834-1006.job
[2011.11.25 08:02:25 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.11.25 08:02:18 | 536,399,872 | -HS- | M] () -- C:\hiberfil.sys
[2011.11.25 07:59:11 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Florian\defogger_reenable
[2011.11.25 07:37:36 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Florian\Desktop\Defogger.exe
[2011.11.24 20:05:51 | 000,073,918 | ---- | M] () -- C:\Dokumente und Einstellungen\Florian\Desktop\Anleitung Trojaner Board.htm
[2011.11.24 14:50:58 | 000,003,700 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
[2011.11.24 14:28:34 | 000,000,642 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.11.24 11:51:37 | 000,002,608 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.11.22 22:05:01 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1101682426-1674176240-2202698834-1006.job
[2011.11.22 18:32:46 | 000,000,700 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2011.11.22 07:54:04 | 000,255,620 | ---- | M] () -- C:\Dokumente und Einstellungen\Florian\Desktop\103534-tr-dropper-gen-meiner-externen-festplatte-entfernen.html
[2011.11.20 18:18:55 | 000,000,049 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011.11.20 11:22:59 | 000,000,770 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CEWE FOTOSCHAU.lnk
[2011.11.20 11:22:59 | 000,000,765 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Foto Paradies.lnk
[2011.11.19 17:06:32 | 000,005,632 | ---- | M] () -- C:\Dokumente und Einstellungen\Florian\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.11.19 15:57:41 | 000,266,570 | ---- | M] () -- C:\Dokumente und Einstellungen\Florian\Desktop\Die Schönheit der Frau. Lila Hütchen.ppsm
[2011.11.19 11:40:04 | 000,065,024 | ---- | M] () -- C:\WINDOWS\IFinst26.exe
[2011.11.19 11:38:24 | 000,000,522 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Samsung Media Studio5.lnk
[2011.11.19 11:27:23 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2011.11.19 11:27:23 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2011.11.17 17:06:23 | 000,000,837 | ---- | M] () -- C:\Dokumente und Einstellungen\Florian\Startmenü\Programme\Autostart\Logitech . Produktregistrierung.lnk
[2011.11.09 10:41:21 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.11.03 18:02:22 | 000,000,692 | ---- | M] () -- C:\Dokumente und Einstellungen\Florian\Desktop\Audible Manager.lnk
[2011.11.01 15:52:34 | 000,214,556 | ---- | M] () -- C:\WINDOWS\hpwins23.dat
[2011.11.01 11:13:24 | 000,069,835 | ---- | M] () -- C:\WINDOWS\hpqins13.dat
[2011.11.01 11:12:17 | 000,001,846 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\HP Photosmart Essential 3.5.lnk
[2011.10.31 17:01:26 | 000,376,016 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.10.31 17:01:25 | 000,386,338 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.10.31 17:01:25 | 000,062,578 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.10.31 17:01:25 | 000,051,814 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.10.30 08:08:17 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\lvuvc.hs
[2011.10.30 08:08:15 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\logiflt.iad
[2011.10.28 17:47:11 | 000,194,513 | ---- | M] () -- C:\Dokumente und Einstellungen\Florian\Desktop\img-X27162502-0001.pdf
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.11.25 08:10:26 | 000,000,540 | ---- | C] () -- C:\Dokumente und Einstellungen\Florian\Desktop\Verknüpfung mit OTL.lnk
[2011.11.25 07:59:11 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Florian\defogger_reenable
[2011.11.25 07:58:29 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Florian\Desktop\Defogger.exe
[2011.11.24 20:05:42 | 000,073,918 | ---- | C] () -- C:\Dokumente und Einstellungen\Florian\Desktop\Anleitung Trojaner Board.htm
[2011.11.24 14:28:34 | 000,000,642 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.11.22 18:32:46 | 000,000,700 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2011.11.22 07:53:52 | 000,255,620 | ---- | C] () -- C:\Dokumente und Einstellungen\Florian\Desktop\103534-tr-dropper-gen-meiner-externen-festplatte-entfernen.html
[2011.11.20 11:22:59 | 000,000,770 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CEWE FOTOSCHAU.lnk
[2011.11.20 11:22:58 | 000,000,765 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Foto Paradies.lnk
[2011.11.19 15:57:31 | 000,266,570 | ---- | C] () -- C:\Dokumente und Einstellungen\Florian\Desktop\Die Schönheit der Frau. Lila Hütchen.ppsm
[2011.11.19 11:40:26 | 000,299,008 | ---- | C] () -- C:\WINDOWS\System32\LAME_MP3.dll
[2011.11.19 11:40:26 | 000,000,401 | ---- | C] () -- C:\WINDOWS\System32\lame_acm.xml
[2011.11.19 11:40:04 | 000,065,024 | ---- | C] () -- C:\WINDOWS\IFinst26.exe
[2011.11.19 11:38:24 | 000,000,522 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Samsung Media Studio5.lnk
[2011.11.19 11:38:02 | 000,015,120 | ---- | C] () -- C:\WINDOWS\System32\PDINFO.xpd
[2011.11.19 11:37:30 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\vorbisenc.dll
[2011.11.19 11:37:30 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2011.11.19 11:37:29 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll
[2011.11.19 11:37:29 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\Ogg.dll
[2011.11.17 17:06:23 | 000,000,837 | ---- | C] () -- C:\Dokumente und Einstellungen\Florian\Startmenü\Programme\Autostart\Logitech . Produktregistrierung.lnk
[2011.11.07 15:39:15 | 000,015,565 | ---- | C] () -- C:\WINDOWS\System32\drivers\fwlanusbn.bin
[2011.11.01 11:12:17 | 000,001,846 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\HP Photosmart Essential 3.5.lnk
[2011.11.01 11:08:32 | 000,069,835 | ---- | C] () -- C:\WINDOWS\hpqins13.dat
[2011.11.01 11:03:19 | 000,001,847 | ---- | C] () -- C:\WINDOWS\hpwmdl23.dat.temp
[2011.10.28 17:47:10 | 000,194,513 | ---- | C] () -- C:\Dokumente und Einstellungen\Florian\Desktop\img-X27162502-0001.pdf
[2011.10.16 13:48:24 | 000,005,632 | ---- | C] () -- C:\Dokumente und Einstellungen\Florian\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.10.03 06:51:44 | 000,000,140 | ---- | C] () -- C:\Dokumente und Einstellungen\Florian\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2011.10.02 16:41:15 | 000,082,289 | R--- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2011.03.13 16:14:58 | 000,001,378 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ss.ini
[2010.10.19 20:23:00 | 000,078,194 | ---- | C] () -- C:\WINDOWS\hpqins05.dat
[2010.10.18 17:18:43 | 000,214,556 | ---- | C] () -- C:\WINDOWS\hpwins23.dat
[2010.10.18 17:18:43 | 000,001,847 | ---- | C] () -- C:\WINDOWS\hpwmdl23.dat
[2010.06.25 08:02:14 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010.06.18 15:35:12 | 000,010,593 | ---- | C] () -- C:\WINDOWS\CSTBox.INI
[2010.06.13 10:18:33 | 000,002,608 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.04.29 15:22:03 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Equalizer
[2010.04.29 15:22:03 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Echo
[2010.04.05 13:28:33 | 000,000,408 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2010.03.24 20:10:46 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2010.02.23 21:22:14 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2009.10.07 00:46:36 | 000,025,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2009.10.07 00:23:08 | 000,013,584 | ---- | C] () -- C:\WINDOWS\System32\drivers\iKeyLFT2.dll
[2008.08.17 17:12:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ViewNX.INI
[2008.08.15 20:03:51 | 000,000,000 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PKP_DLdw.DAT
[2008.08.15 20:01:50 | 000,000,000 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PKP_DLdu.DAT
[2008.08.15 20:01:50 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\Error Handlers
[2008.08.15 18:09:02 | 000,097,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\Fwusb1b.bin
[2008.08.10 16:12:36 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2008.08.10 16:01:15 | 000,021,441 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2008.07.30 09:17:50 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS64.DLL
[2008.02.12 16:09:15 | 000,008,192 | ---- | C] () -- C:\WINDOWS\suecmdial.dll
[2008.02.12 16:04:15 | 000,000,010 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2008.02.11 13:14:59 | 000,000,197 | ---- | C] () -- C:\WINDOWS\OPLP.INI
[2007.10.28 11:36:13 | 000,000,026 | ---- | C] () -- C:\WINDOWS\ta.ini
[2007.07.07 20:13:36 | 000,000,041 | ---- | C] () -- C:\WINDOWS\System32\Filzip.ini
[2007.05.01 13:23:08 | 000,001,286 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2007.03.23 15:21:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\muveeapp.INI
[2007.02.15 14:36:22 | 000,003,700 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2007.02.15 12:52:13 | 000,520,192 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe
[2007.01.29 20:02:18 | 000,000,049 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007.01.03 11:19:30 | 000,006,336 | ---- | C] () -- C:\WINDOWS\WPQC60DE.DAT
[2007.01.03 11:18:46 | 000,001,040 | ---- | C] () -- C:\WINDOWS\wtapi.ini
[2006.12.29 16:03:07 | 000,000,041 | ---- | C] () -- C:\WINDOWS\Filzip.ini
[2006.12.29 16:02:35 | 000,045,700 | ---- | C] () -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\wklnhst.dat
[2006.12.29 15:47:19 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006.12.29 15:35:48 | 000,127,184 | ---- | C] () -- C:\WINDOWS\Unwise.exe
[2006.12.29 15:21:19 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2006.12.29 15:21:02 | 000,796,584 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2006.12.29 13:17:06 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2006.12.29 11:51:40 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2006.12.17 03:30:22 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.dat
[2006.11.28 20:55:40 | 000,142,347 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2004.12.20 11:08:28 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2004.12.20 11:03:26 | 000,679,936 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2004.02.04 11:02:43 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004.02.04 10:59:26 | 000,000,023 | ---- | C] () -- C:\WINDOWS\AOLMIcon.ini
[2004.02.04 08:31:49 | 004,142,932 | ---- | C] () -- C:\WINDOWS\System32\DETour.exe
[2004.02.04 08:21:26 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2004.02.04 03:26:29 | 000,000,970 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004.02.04 03:26:21 | 000,386,338 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004.02.04 03:26:21 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004.02.04 03:26:21 | 000,062,578 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004.02.04 03:26:21 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004.02.04 03:26:05 | 000,376,016 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004.02.04 03:26:05 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004.02.04 03:26:05 | 000,051,814 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004.02.04 03:26:05 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004.02.04 03:26:05 | 000,004,518 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004.02.04 03:26:03 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004.02.04 03:26:02 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004.02.04 03:25:59 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004.02.04 03:25:59 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004.02.04 03:25:54 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004.02.04 03:25:45 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004.02.04 01:35:11 | 000,000,047 | ---- | C] () -- C:\WINDOWS\InoSetup.ini
[2004.02.04 01:30:46 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004.02.04 01:29:01 | 000,532,544 | ---- | C] () -- C:\WINDOWS\PIC.dll
[2004.02.04 01:29:01 | 000,049,152 | ---- | C] () -- C:\WINDOWS\CNYUSB.dll
[2004.02.04 01:29:01 | 000,024,576 | ---- | C] () -- C:\WINDOWS\HKCYDLL.dll
[2004.02.04 01:29:01 | 000,011,776 | ---- | C] () -- C:\WINDOWS\HIDMNT.dll
[2004.02.04 01:29:01 | 000,000,360 | ---- | C] () -- C:\WINDOWS\CNYHKey.ini
[2004.02.04 01:26:04 | 000,000,282 | ---- | C] () -- C:\WINDOWS\Dit.INI
[2004.02.04 01:14:06 | 000,233,472 | ---- | C] () -- C:\WINDOWS\CMIRMDRV.EXE
[2004.02.04 01:14:06 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRMDRV.DLL
[2004.02.04 01:14:05 | 000,233,472 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.exe
[2004.02.04 01:14:05 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll
[2004.02.04 01:14:05 | 000,003,424 | ---- | C] () -- C:\WINDOWS\cmiainfo.sys
[2004.02.04 01:14:05 | 000,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI
[2004.02.04 01:14:05 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI
[2004.02.04 01:14:02 | 000,266,240 | ---- | C] () -- C:\WINDOWS\CMIUninstall.exe
[2004.02.04 01:14:02 | 000,225,280 | ---- | C] () -- C:\WINDOWS\CmiRmRedundDir.exe
[2004.02.04 01:14:02 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll
[2004.02.03 19:48:03 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004.02.03 19:36:59 | 000,000,863 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004.02.03 19:35:32 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004.02.03 19:32:39 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004.02.03 19:30:10 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004.02.03 19:29:34 | 000,224,024 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004.02.03 07:28:01 | 000,380,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\PRISMA00.sys
[1996.07.03 11:21:41 | 000,000,000 | ---- | C] () -- C:\WINDOWS\DiaEdit.INI

========== LOP Check ==========

[2010.05.16 13:30:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\avg9
[2011.10.16 19:04:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Easybits GO
[2008.08.15 20:03:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EnterNHelp
[2011.07.31 11:35:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\espionServerData
[2008.07.30 08:58:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreeRIP
[2006.12.29 15:39:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\muvee Technologies
[2010.04.05 13:28:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft
[2011.11.24 19:48:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp
[2011.05.15 15:30:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TomTom
[2008.08.15 20:03:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ultima_T15
[2011.11.22 10:30:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\2496A
[2011.11.20 22:28:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\584C2
[2011.03.13 16:33:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\Amazon
[2010.08.22 19:19:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\Canon
[2011.10.16 19:04:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\go
[2011.10.02 16:42:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\Leadertech
[2008.08.17 17:10:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\Nikon
[2010.05.16 13:25:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\Opera
[2011.11.21 16:56:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\PanoramaStudio2
[2011.11.22 16:50:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\PriceGong
[2010.04.05 13:28:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\ScanSoft
[2011.05.15 15:28:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\TomTom
[2010.07.23 07:49:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\Verbindungsassistent
[2011.11.24 13:30:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Florian\Anwendungsdaten\XnView

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*. >
[2010.02.24 09:18:45 | 000,000,000 | -H-D | M] -- C:\$AVG
[2007.02.15 11:42:06 | 000,000,000 | ---D | M] -- C:\ATI
[2011.11.20 11:19:45 | 000,000,000 | -H-D | M] -- C:\Config.Msi
[2007.05.28 12:31:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2008.08.10 17:54:17 | 000,000,000 | ---D | M] -- C:\Garmin
[2008.08.09 15:32:13 | 000,000,000 | ---D | M] -- C:\MapasGPS
[2004.02.04 08:21:54 | 000,000,000 | ---D | M] -- C:\My Music
[2008.02.11 13:12:42 | 000,000,000 | ---D | M] -- C:\OkiDriver
[2011.07.31 11:27:33 | 000,000,000 | ---D | M] -- C:\Program Files
[2011.11.24 18:31:06 | 000,000,000 | R--D | M] -- C:\Programme
[2006.12.29 15:11:46 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2011.11.22 12:33:16 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.11.25 08:05:18 | 000,000,000 | ---D | M] -- C:\WINDOWS

< %PROGRAMFILES%\*.exe >

Invalid Environment Variable: LOCALAPPDATA

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.manifest /3 >
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]


< MD5 for: EXPLORER.EXE >
[2002.08.29 13:00:00 | 001,007,104 | ---- | M] (Microsoft Corporation) MD5=22B0A56E6C5847292437078B484EC61B -- C:\WINDOWS\$NtUninstallKB820291$\explorer.exe
[2002.08.29 13:00:00 | 001,007,104 | ---- | M] (Microsoft Corporation) MD5=22B0A56E6C5847292437078B484EC61B -- C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\953a9cb86706ade89c5e0f457bab54e9\backup\explorer.exe
[2004.08.04 08:57:53 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe
[2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe

< MD5 for: REGEDIT.EXE >
[2004.08.04 08:58:09 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=8193CE5FB09E83F2699FD65BBCBE2FD2 -- C:\WINDOWS\$NtServicePackUninstall$\regedit.exe
[2008.04.14 03:22:58 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\regedit.exe
[2008.04.14 03:22:58 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\ServicePackFiles\i386\regedit.exe
[2002.08.29 13:00:00 | 000,141,312 | ---- | M] (Microsoft Corporation) MD5=FD95FFECC4B1FE72597D7FA6AF8C2870 -- C:\WINDOWS\I386\REGEDIT.EXE
[2002.08.29 13:00:00 | 000,141,312 | ---- | M] (Microsoft Corporation) MD5=FD95FFECC4B1FE72597D7FA6AF8C2870 -- C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\953a9cb86706ade89c5e0f457bab54e9\backup\regedit.exe

< MD5 for: USERINIT.EXE >
[2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2002.08.29 13:00:00 | 000,022,528 | ---- | M] (Microsoft Corporation) MD5=BEBD3F08461F9A88E5ABCE0CB9707000 -- C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\953a9cb86706ade89c5e0f457bab54e9\backup\userinit.exe
[2004.08.04 08:58:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004.08.04 08:58:19 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2002.08.29 13:00:00 | 000,521,728 | ---- | M] (Microsoft Corporation) MD5=616896B708286DA98D6A099293F181D7 -- C:\WINDOWS\$NtUninstallKB841533$\winlogon.exe
[2004.06.17 01:09:16 | 000,488,448 | ---- | M] (Microsoft Corporation) MD5=E40A881E0EF53994B22D9DB55E94DBED -- C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\953a9cb86706ade89c5e0f457bab54e9\backup\winlogon.exe
[2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Kmode: %SystemRoot%\system32\win32k.sys [2011.09.06 15:10:01 | 001,859,072 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-11-20 21:40:36

< End of report >








Kann es sein, dass es diesmal kein Extra.txt gab? Hätte sonst noch den von gestern...


Hier Gmer:


GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2011-11-25 11:16:59
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST3200021A rev.3.01
Running: 8ekd1kyq.exe; Driver: C:\DOKUME~1\Florian\LOKALE~1\Temp\fwlyypow.sys


---- System - GMER 1.0.15 ----

SSDT F8D4A94C ZwClose
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateFile [0xF77572D0]
SSDT F8D4A906 ZwCreateKey
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreatePort [0xF775AC60]
SSDT F8D4A956 ZwCreateSection
SSDT F8D4A8FC ZwCreateThread
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateWaitablePort [0xF775AD40]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteFile [0xF7757950]
SSDT F8D4A90B ZwDeleteKey
SSDT F8D4A915 ZwDeleteValueKey
SSDT F8D4A947 ZwDuplicateObject
SSDT F8D4A91A ZwLoadKey
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwOpenFile [0xF77577A0]
SSDT F8D4A8E8 ZwOpenProcess
SSDT F8D4A8ED ZwOpenThread
SSDT F8D4A924 ZwReplaceKey
SSDT F8D4A91F ZwRestoreKey
SSDT F8D4A95B ZwSetContextThread
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetInformationFile [0xF7757AC0]
SSDT F8D4A910 ZwSetValueKey
SSDT F8D4A8F7 ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!ZwYieldExecution + 25E 804E4AB8 4 Bytes [E8, A8, D4, F8]
? srescan.sys Das System kann die angegebene Datei nicht finden. !
.text ntoskrnl.exe!ZwYieldExecution + 25E 804E4AB8 4 Bytes [E8, A8, D4, F8]

---- User code sections - GMER 1.0.15 ----

.text C:\programme\real\realplayer\update\realsched.exe[2832] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}

---- Devices - GMER 1.0.15 ----

Device \Driver\Tcpip \Device\Ip vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \Driver\Tcpip \Device\Udp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

---- EOF - GMER 1.0.15 ----




Ich hoffe, Ihr könnt mir helfen!

Danke und Grüße
Nicole