Verschlüsselungs Trojaner, oder doch nicht? Nichts geht mehr II

OTL logfile created on: 5/31/2012 9:28:37 AM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale:  | Country:  | Language:  | Date Format: 
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): C:\pagefile.sys 4092 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 48.83 Gb Total Space | 0.82 Gb Free Space | 1.69% Space Free | Partition Type: NTFS
Drive D: | 416.93 Gb Total Space | 92.15 Gb Free Space | 22.10% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand] --  -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - File not found [Disabled] --  -- (HidServ)
SRV - [2012/05/09 02:15:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/05/09 02:15:04 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2012/05/09 02:15:04 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/05/07 08:58:25 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/05/05 06:06:24 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/04/10 02:32:05 | 001,044,816 | ---- | M] (Flexera Software, Inc.) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/10/08 00:50:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011/02/02 08:08:16 | 000,018,656 | ---- | M] () [Auto] -- C:\Programme\Autodesk\Content Service\Connect.Service.ContentService.exe -- (Autodesk Content Service)
SRV - [2010/07/09 07:32:02 | 000,196,928 | ---- | M] (Nitro PDF Software) [Auto] -- C:\Programme\Nitro PDF\Professional\NitroPDFDriverService.exe -- (NitroDriverReadSpool)
SRV - [2007/09/16 17:21:18 | 000,072,704 | ---- | M] (Adobe Systems) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2007/01/31 09:55:42 | 000,096,370 | ---- | M] (Canon Inc.) [Auto] -- C:\Programme\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2006/10/26 09:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (SenFiltService)
DRV - File not found [Kernel | On_Demand] --  -- (RTLWUSB)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - File not found [Kernel | On_Demand] --  -- (AEAudio)
DRV - File not found [Kernel | On_Demand] --  -- (ADIHdAudAddService)
DRV - File not found [Kernel | On_Demand] --  -- (ADIDTSFiltService)
DRV - [2012/05/09 02:15:05 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012/05/09 02:15:05 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/10/19 11:56:15 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011/07/07 19:21:30 | 000,119,656 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nvhda32.sys -- (NVHDA)
DRV - [2011/03/18 12:08:54 | 000,025,240 | ---- | M] (Almico Software) [Kernel | Boot] -- C:\WINDOWS\system32\speedfan.sys -- (speedfan)
DRV - [2010/11/16 04:56:26 | 000,059,136 | ---- | M] (Silicon Laboratories) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\silabser.sys -- (silabser)
DRV - [2010/11/16 04:56:26 | 000,047,176 | ---- | M] (Silicon Laboratories) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\silabenm.sys -- (silabenm)
DRV - [2010/07/04 15:51:26 | 000,004,096 | ---- | M] () [Kernel | Unavailable] -- C:\Programme\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)
DRV - [2010/06/17 10:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/04/09 16:09:58 | 000,108,448 | ---- | M] (Your Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Mach3.sys -- (Mach3)
DRV - [2009/03/29 22:09:28 | 000,239,336 | ---- | M] (Microsoft Corporation) [File_System | Disabled] -- C:\WINDOWS\system32\drivers\RsFx0103.sys -- (RsFx0103)
DRV - [2009/01/22 10:25:26 | 000,120,064 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008/10/31 05:38:08 | 004,942,336 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008/05/21 19:57:38 | 000,034,576 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\npf.sys -- (npf)
DRV - [2008/04/13 14:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2008/04/13 14:46:22 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)
DRV - [2008/03/13 06:53:24 | 000,003,026 | ---- | M] (Logix4u) [Kernel | System] -- C:\WINDOWS\system32\drivers\hwinterface.sys -- (hwinterface)
DRV - [2007/10/11 12:27:37 | 000,096,832 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2007/09/25 10:59:46 | 000,015,152 | ---- | M] () [Kernel | On_Demand] -- C:\Programme\MediaCoder\SysInfo.sys -- (CrystalSysInfo)
DRV - [2007/03/17 15:00:02 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\el90xbc5.sys -- (EL90XBC)
DRV - [2007/03/17 14:07:03 | 000,025,244 | ---- | M] (Adaptec) [Kernel | System] -- C:\WINDOWS\System32\drivers\aspi32.sys -- (Aspi32)
DRV - [2007/01/24 07:25:16 | 000,037,928 | ---- | M] (Ross Garner) [Kernel | Auto] -- C:\WINDOWS\System32\drivers\smp_LPT.sys -- (smp_lpt)
DRV - [2006/12/06 07:41:16 | 000,044,416 | R--- | M] (JMicron Technology Corp.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\jraid.sys -- (JRAID)
DRV - [2006/11/22 04:01:48 | 000,693,760 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock)
DRV - [2006/05/16 09:25:02 | 000,018,944 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2006/05/16 09:25:00 | 000,052,736 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2006/03/16 02:03:10 | 000,067,712 | R--- | M] (Silicon Image, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\SI3132.sys -- (SI3132)
DRV - [2006/02/07 07:52:58 | 000,006,912 | R--- | M] (JMicron ) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\JGOGO.sys -- (JGOGO)
DRV - [2005/10/17 23:15:28 | 000,005,504 | R--- | M] (Silicon Image, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\SiRemFil.sys -- (SiRemFil)
DRV - [2005/07/25 05:04:08 | 000,048,640 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2005/04/12 04:41:20 | 000,004,608 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ElbyDelay.sys -- (ElbyDelay)
DRV - [2005/03/30 05:12:38 | 000,014,544 | ---- | M] (EnTech Taiwan) [Kernel | Auto] -- C:\WINDOWS\System32\drivers\TVicPort.sys -- (TVicPort)
DRV - [2004/10/31 23:21:32 | 000,010,368 | R--- | M] (Silicon Image, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\SiWinAcc.sys -- (SiFilter)
DRV - [2004/08/12 22:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2002/12/16 23:41:10 | 000,076,288 | ---- | M] (Rainbow Technologies, Inc.) [Kernel | Auto] -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS -- (Sentinel)
DRV - [2000/08/18 07:57:52 | 000,017,524 | ---- | M] (   ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\gt680x.sys -- (GT680x)
DRV - [1996/04/03 15:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot] -- C:\WINDOWS\system32\giveio.sys -- (giveio)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\NetworkService_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKU\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Rainer_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dsl-start.computerbild.de/
IE - HKU\Rainer_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.google.de/ [binary data]
IE - HKU\Rainer_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\Rainer_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Rainer_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
IE - HKU\systemprofile_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKU\systemprofile_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\UpdatusUser_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKU\UpdatusUser_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Programme\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: C:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.652: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.652: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: C:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/05/31 11:56:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012/05/07 08:58:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012/04/29 05:55:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2012/04/22 07:36:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins
 
[2012/04/22 08:34:22 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012/05/07 08:58:25 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2010/10/19 07:04:49 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2007/11/20 11:52:00 | 002,884,992 | ---- | M] () -- C:\Programme\mozilla firefox\plugins\NPSWF32.dll
[2012/03/13 01:23:34 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/03/13 01:06:36 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012/03/13 01:23:34 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011/10/05 08:35:32 | 000,002,048 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\fcmdSrch.xml
[2012/03/13 01:23:34 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/03/13 01:23:34 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/03/13 01:23:34 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2001/08/18 07:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll (facemoods.com BHO)
O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Inforce) - {A4BB4016-FC66-4F48-9E51-45A738A95288} - C:\Programme\Inforce\InforceIEToolbar.dll ()
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Programme\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll (facemoods.com)
O3 - HKU\Rainer_ON_C\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [facemoods] C:\Programme\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe (facemoods.com)
O4 - HKLM..\Run: [Gtwatch]  File not found
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe (HP)
O4 - HKLM..\Run: [HPWT myPrintMileage Agent] C:\Programme\Hewlett-Packard\HP Business Inkjet 1000\Toolbox\mpm.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PDFPrint] C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [TkBellExe] C:\Programme\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\Rainer_ON_C..\Run: [Akamai NetSession Interface] C:\Dokumente und Einstellungen\Rainer\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKU\Rainer_ON_C..\Run: [Inforce] C:\Programme\Inforce\InforceTray.exe (SDS Software Dirk Sandhorst)
O4 - HKU\Rainer_ON_C..\Run: [Panda Media Booster ] C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\494ec4d8.exe (Business Hotel Meison, Shirahama-cho)
O4 - HKU\.DEFAULT..\RunOnce: [ShowDeskFix]  File not found
O4 - HKU\NetworkService_ON_C..\RunOnce: [ShowDeskFix]  File not found
O4 - HKU\systemprofile_ON_C..\RunOnce: [ShowDeskFix]  File not found
O4 - HKU\UpdatusUser_ON_C..\RunOnce: [ShowDeskFix]  File not found
O4 - Startup: Error locating startup folders.
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Rainer_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Rainer_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Rainer_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWinKeys = 1
O7 - HKU\Rainer_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Rainer_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\systemprofile_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\UpdatusUser_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Links - {17D706CB-31AD-49de-9162-C66B95E7171A} - C:\Programme\Inforce\InforceIE2.htm ()
O9 - Extra 'Tools' menuitem : Selektierte Links in Inforce einfügen - {17D706CB-31AD-49de-9162-C66B95E7171A} - C:\Programme\Inforce\InforceIE2.htm ()
O9 - Extra Button: Inforce - {210E0934-296A-473a-8A07-F0A4F0E77CFF} - C:\Programme\Inforce\InforceIE.htm ()
O9 - Extra 'Tools' menuitem : Aktuelle URL in Inforce einfügen - {210E0934-296A-473a-8A07-F0A4F0E77CFF} - C:\Programme\Inforce\InforceIE.htm ()
O9 - Extra Button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programme\WinHTTrack\WinHTTrackIEBar.dll ()
O9 - Extra 'Tools' menuitem : Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programme\WinHTTrack\WinHTTrackIEBar.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012/04/10 16:58:36 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2007/09/01 15:28:50 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/05/30 07:00:52 | 000,117,993 | ---- | C] (Business Hotel Meison, Shirahama-cho) -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\494ec4d8.exe
[2012/05/23 11:29:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\foobar2000
[2012/05/23 11:29:30 | 000,000,000 | ---D | C] -- C:\Programme\foobar2000
[2012/05/15 02:27:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rainer\Eigene Dateien\Formulare
[2012/05/09 06:00:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\NVIDIA
[2012/05/07 08:58:31 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service
[2012/05/07 08:58:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla
[2012/05/02 10:32:42 | 000,000,000 | ---D | C] -- C:\Programme\Omega
[2012/05/02 10:32:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\iCordForum.com
[2011/09/08 09:58:45 | 000,017,524 | ---- | C] (   ) -- C:\WINDOWS\System32\drivers\gt680x.sys
[2008/07/19 15:07:47 | 000,049,152 | ---- | C] ( ) -- C:\Dokumente und Einstellungen\Rainer\CompiledAdapter
[2007/09/18 10:02:12 | 000,127,059 | ---- | C] ( ) -- C:\WINDOWS\System32\DSLLK189.dll
[2007/09/17 04:00:37 | 000,047,360 | ---- | C] (VSO Software) -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\pcouffin.sys
[2004/12/13 03:57:36 | 000,065,536 | ---- | C] ( ) -- C:\WINDOWS\System32\RCCOLLAB.DLL
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/05/30 07:11:00 | 000,000,228 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012/05/30 07:09:57 | 000,003,072 | -H-- | M] () -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\panda.dll
[2012/05/30 07:09:14 | 000,000,272 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1659004503-515967899-839522115-1003.job
[2012/05/30 07:09:09 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/05/30 07:08:55 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/05/30 07:06:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/05/30 07:03:01 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/05/30 07:00:52 | 000,117,993 | ---- | M] (Business Hotel Meison, Shirahama-cho) -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\494ec4d8.exe
[2012/05/30 06:52:39 | 000,285,176 | ---- | M] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2012/05/30 06:52:39 | 000,000,001 | ---- | M] () -- C:\WINDOWS\System32\nvdrssel.bin
[2012/05/30 06:50:49 | 000,285,176 | ---- | M] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2012/05/30 06:08:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/05/30 02:12:00 | 000,000,280 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1659004503-515967899-839522115-1003.job
[2012/05/28 13:22:48 | 000,002,509 | ---- | M] () -- C:\Dokumente und Einstellungen\Rainer\Desktop\Microsoft Office Word 2003.lnk
[2012/05/23 11:29:32 | 000,000,796 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\foobar2000.lnk
[2012/05/23 11:29:32 | 000,000,738 | ---- | M] () -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\foobar2000.lnk
[2012/05/23 11:29:32 | 000,000,720 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\foobar2000.lnk
[2012/05/23 05:02:56 | 000,000,030 | ---- | M] () -- C:\WINDOWS\Iedit.INI
[2012/05/15 15:12:43 | 000,423,816 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/05/15 13:35:20 | 000,614,664 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012/05/15 13:35:20 | 000,589,184 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/05/15 13:35:20 | 000,139,490 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012/05/15 13:35:20 | 000,121,906 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/05/15 13:28:55 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/05/15 13:21:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Silverlight
[2012/05/09 05:59:49 | 000,000,219 | ---- | M] () -- C:\WINDOWS\System32\lsprst7.tgz
[2012/05/09 05:59:49 | 000,000,205 | ---- | M] () -- C:\WINDOWS\System32\lsprst7.dll
[2012/05/09 05:59:49 | 000,000,087 | ---- | M] () -- C:\WINDOWS\System32\ssprs.tgz
[2012/05/09 05:59:49 | 000,000,017 | -H-- | M] () -- C:\WINDOWS\System32\servdat.slm
[2012/05/09 02:15:05 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012/05/09 02:15:05 | 000,083,392 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012/05/05 06:06:21 | 000,419,488 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/05/05 06:06:21 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/05/02 10:32:42 | 000,000,614 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Omega.lnk
[2012/05/02 10:32:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\iCordForum.com
[2012/05/01 10:50:57 | 000,002,345 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Gutscheine1.de.lnk
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/05/30 07:00:52 | 000,003,072 | -H-- | C] () -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\panda.dll
[2012/05/23 11:29:32 | 000,000,796 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\foobar2000.lnk
[2012/05/23 11:29:32 | 000,000,738 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\foobar2000.lnk
[2012/05/23 11:29:32 | 000,000,720 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\foobar2000.lnk
[2012/05/02 10:32:42 | 000,000,614 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Omega.lnk
[2012/04/29 05:22:59 | 000,004,998 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\mtbjfghn.xbe
[2012/04/22 07:08:05 | 000,000,218 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\.recently-used.xbel
[2012/02/15 05:12:03 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/02/05 07:58:07 | 000,000,099 | ---- | C] () -- C:\WINDOWS\System32\nvUnsupRes.dat
[2012/02/05 07:01:21 | 000,000,015 | ---- | C] () -- C:\WINDOWS\System32\nvModes.dat
[2012/02/05 06:27:18 | 000,000,409 | ---- | C] () -- C:\Dokumente und Einstellungen\UpdatusUser\WGANotify.settings
[2012/02/05 06:26:04 | 000,285,176 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2012/02/05 06:26:04 | 000,285,176 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2012/02/05 06:26:04 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2012/02/05 06:24:50 | 002,130,002 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data
[2011/09/08 09:44:09 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WATCH.INI
[2011/09/04 18:20:51 | 000,000,865 | ---- | C] () -- C:\WINDOWS\posteriza[1].INI
[2011/07/29 03:53:00 | 000,000,038 | ---- | C] () -- C:\WINDOWS\osAviSplitter.INI
[2011/05/14 07:57:00 | 001,190,070 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\Favoriten.rar
[2011/05/06 07:35:47 | 000,000,000 | ---- | C] () -- C:\WINDOWS\McHmm.INI
[2011/02/18 10:03:01 | 000,858,218 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\Lokale Einstellungen\Anwendungsdaten\debuggee.mdmp
[2011/02/15 20:51:52 | 000,049,529 | ---- | C] () -- C:\WINDOWS\System32\secushr.dat
[2011/02/15 20:48:33 | 000,007,640 | ---- | C] () -- C:\WINDOWS\System32\secustat.dat
[2011/02/15 20:47:08 | 000,000,025 | ---- | C] () -- C:\WINDOWS\libem.INI
[2011/01/24 11:11:05 | 002,099,310 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-1659004503-515967899-839522115-1003-0.dat
[2011/01/13 11:01:39 | 000,300,606 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2011/01/12 05:37:47 | 000,102,400 | ---- | C] () -- C:\WINDOWS\scrub2k.exe
[2011/01/12 05:37:47 | 000,000,391 | ---- | C] () -- C:\WINDOWS\hpw1000k.ini
[2011/01/12 05:36:10 | 000,014,637 | ---- | C] () -- C:\WINDOWS\hpbj1000.ini
[2010/10/28 07:19:04 | 000,000,105 | ---- | C] () -- C:\WINDOWS\Mach3.INI
[2010/10/20 07:57:00 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010/10/19 06:57:06 | 000,015,873 | ---- | C] () -- C:\WINDOWS\System32\Inetde.dll
[2009/09/16 11:27:58 | 000,508,224 | ---- | C] () -- C:\WINDOWS\System32\ICCProfiles.dll
[2008/11/05 05:42:45 | 000,062,400 | ---- | C] () -- C:\WINDOWS\System32\IFC.dll
[2008/11/05 05:41:56 | 000,422,848 | ---- | C] () -- C:\WINDOWS\System32\PPL.dll
[2008/07/18 09:15:19 | 000,290,904 | ---- | C] () -- C:\WINDOWS\System32\vc6-re200l.dll
[2008/06/24 13:20:09 | 000,679,936 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008/06/11 14:39:05 | 000,406,016 | ---- | C] () -- C:\WINDOWS\System32\PSDrvCheck.exe
[2008/05/31 13:13:55 | 000,435,102 | ---- | C] () -- C:\WINDOWS\System32\drqbap_nav.dat
[2008/05/31 13:13:24 | 000,005,243 | ---- | C] () -- C:\WINDOWS\System32\drqbap.dat
[2008/05/31 13:13:24 | 000,000,941 | ---- | C] () -- C:\WINDOWS\System32\drqbap_navps.dat
[2008/05/21 19:56:36 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2008/05/14 18:06:07 | 000,000,235 | ---- | C] () -- C:\WINDOWS\IfoEdit.INI
[2008/03/30 15:22:43 | 000,000,130 | ---- | C] () -- C:\WINDOWS\EurekaLog.ini
[2008/01/30 18:48:04 | 000,001,142 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2008/01/30 18:43:47 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2008/01/14 15:27:31 | 000,502,784 | ---- | C] () -- C:\WINDOWS\x2.64.exe
[2008/01/14 15:27:31 | 000,408,576 | ---- | C] () -- C:\WINDOWS\System32\Smab.dll
[2008/01/14 15:27:31 | 000,240,128 | ---- | C] () -- C:\WINDOWS\System32\x.264.exe
[2008/01/14 15:27:31 | 000,217,073 | ---- | C] () -- C:\WINDOWS\meta4.exe
[2008/01/14 15:27:31 | 000,066,560 | ---- | C] () -- C:\WINDOWS\MOTA113.exe
[2008/01/14 15:27:31 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2008/01/12 17:54:06 | 000,000,034 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2008/01/12 17:37:32 | 000,000,106 | ---- | C] () -- C:\WINDOWS\Ra2Wav1_P2.INI
[2007/12/28 06:03:55 | 000,671,212 | ---- | C] () -- C:\WINDOWS\unins001.exe
[2007/12/28 06:03:55 | 000,000,882 | ---- | C] () -- C:\WINDOWS\unins001.dat
[2007/11/30 07:09:57 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2007/10/23 12:50:18 | 000,000,030 | ---- | C] () -- C:\WINDOWS\Iedit.INI
[2007/10/19 13:53:43 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2007/10/10 09:18:16 | 000,000,125 | ---- | C] () -- C:\WINDOWS\WINHELP.INI
[2007/10/06 17:52:21 | 000,000,080 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib
[2007/10/06 09:13:56 | 000,087,608 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\inst.exe
[2007/10/06 09:08:30 | 000,013,312 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2007/09/21 14:04:01 | 000,000,500 | RHS- | C] () -- C:\Dokumente und Einstellungen\Rainer\ntuser.pol
[2007/09/18 16:40:44 | 000,000,025 | -H-- | C] () -- C:\WINDOWS\kpe.dat
[2007/09/18 05:02:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\graphedit.INI
[2007/09/17 04:00:37 | 000,081,920 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\ezpinst.exe
[2007/09/17 04:00:37 | 000,007,887 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\pcouffin.cat
[2007/09/17 04:00:37 | 000,001,144 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\pcouffin.inf
[2007/09/16 17:56:43 | 000,006,404 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\UserCustomPreset_Adobe Premiere Pro 2.0.vpr
[2007/09/16 17:52:15 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2007/09/16 17:52:15 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2007/09/16 17:52:15 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2007/09/16 17:52:15 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2007/09/16 17:52:15 | 000,000,073 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
[2007/09/16 17:19:08 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\pxhpinst.exe
[2007/09/12 09:49:32 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2007/09/12 05:45:53 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2007/09/06 13:55:01 | 000,031,744 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/09/06 10:24:11 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2007/09/06 10:22:58 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2007/09/04 10:09:16 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/09/01 16:43:14 | 000,015,481 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2007/09/01 16:30:56 | 000,000,400 | R--- | C] () -- C:\WINDOWS\System32\raidmgmt.ini
[2007/09/01 16:30:55 | 000,000,804 | R--- | C] () -- C:\WINDOWS\System32\AsusSetup.ini
[2007/09/01 16:30:20 | 000,026,912 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini
[2007/09/01 16:29:50 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2007/09/01 16:29:23 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2007/09/01 16:18:05 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2007/09/01 16:13:26 | 000,423,816 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2007/09/01 15:36:02 | 000,000,409 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\WGANotify.settings
[2007/09/01 15:33:37 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2007/09/01 15:33:28 | 000,000,409 | ---- | C] () -- C:\WINDOWS\system32\config\systemprofile\WGANotify.settings
[2007/09/01 15:25:14 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2007/09/01 15:24:50 | 000,271,264 | ---- | C] () -- C:\WINDOWS\System32\vbrun100.dll
[2007/04/20 00:05:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2007/04/20 00:05:00 | 001,626,112 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2007/04/20 00:05:00 | 001,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2007/04/20 00:05:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2007/04/20 00:05:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2007/04/20 00:05:00 | 001,018,748 | ---- | C] () -- C:\WINDOWS\System32\nvucode.bin
[2007/04/20 00:05:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2007/04/20 00:05:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2007/04/20 00:05:00 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2007/04/20 00:05:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007/03/17 14:07:09 | 001,800,192 | ---- | C] () -- C:\WINDOWS\System32\hmtcdres.dll
[2007/03/17 14:07:08 | 000,394,240 | ---- | C] () -- C:\WINDOWS\System32\hmtcd.dll
[2006/07/22 04:12:06 | 000,656,495 | ---- | C] () -- C:\WINDOWS\System32\royale.exe
[2005/08/09 18:13:31 | 000,831,488 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2005/08/09 18:13:31 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2005/08/09 18:12:28 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005/04/04 01:59:00 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\implode.dll
[2005/02/08 10:23:10 | 000,369,664 | ---- | C] () -- C:\WINDOWS\System32\python23.dll
[2004/09/28 01:38:30 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\wmatimer.dll
[2004/08/03 19:12:38 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/02 08:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2003/02/20 11:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/05/13 05:16:19 | 000,356,352 | ---- | C] () -- C:\WINDOWS\System32\xvid.dll
[2001/08/18 07:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/18 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001/08/18 07:00:00 | 000,614,664 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2001/08/18 07:00:00 | 000,589,184 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001/08/18 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001/08/18 07:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2001/08/18 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001/08/18 07:00:00 | 000,139,490 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2001/08/18 07:00:00 | 000,121,906 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001/08/18 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001/08/18 07:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2001/08/18 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001/08/18 07:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/08/18 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[1996/04/03 15:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys
 
========== LOP Check ==========
 
[2008/06/12 16:16:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\1clickPro
[2008/02/08 17:00:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Ashampoo
[2011/06/29 04:28:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\AskToolbar
[2012/04/10 13:06:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Autodesk
[2011/02/16 09:37:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\BITS
[2012/05/30 06:57:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\BOM
[2010/10/21 03:18:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Broad Intelligence
[2011/01/04 06:12:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\CadSoft
[2007/11/30 07:21:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Canon
[2007/09/17 08:25:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\CopyToDvd
[2007/10/17 06:48:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\DassaultSystemes
[2007/09/17 03:41:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\DeepBurner
[2011/04/08 07:59:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Downloaded Installations
[2011/01/18 10:24:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\DVDVideoSoftIEHelpers
[2011/04/08 09:49:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\elsterformular
[2011/10/05 08:36:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\facemoods.com
[2011/02/15 20:47:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\FlashGet
[2011/02/15 20:46:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\FlashGetBHO
[2012/05/23 12:51:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\foobar2000
[2012/04/26 04:00:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Hartz VI Rechner
[2011/08/29 20:07:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\inkscape
[2012/05/09 05:59:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\IronCAD
[2011/01/25 18:41:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Local
[2008/07/18 09:12:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\MCS Electronics
[2011/01/08 06:03:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Mp3tag
[2011/09/01 08:35:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Nitro PDF
[2007/09/18 12:56:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Opera
[2011/02/15 07:42:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\PreisHai4
[2011/01/21 10:45:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\PriceGong
[2008/01/12 18:06:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\S.A.D
[2012/03/14 02:46:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\TeamViewer
[2012/04/22 07:34:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Thunderbird
[2011/03/23 19:34:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\TubeBox
[2007/09/18 16:41:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Ulead Systems
[2010/10/20 05:54:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Vso
[2007/12/15 07:52:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Xilisoft Corporation
[2010/10/21 04:22:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\XMedia Recode
[2011/09/03 22:20:36 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\Anwendungsdaten\Nitro PDF
[2007/10/06 09:16:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\1Click DVD Copy Pro
[2008/02/08 16:57:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ashampoo
[2012/04/10 13:06:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Autodesk
[2007/10/17 06:48:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DassaultSystemes
[2011/04/08 08:00:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular
[2007/09/12 09:49:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MailFrontier
[2007/09/16 17:52:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Minnetonka Audio Software
[2011/01/31 05:58:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\National Instruments
[2008/01/14 13:55:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NCH Swift Sound
[2011/04/08 08:01:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nitro PDF
[2007/09/06 10:18:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pinnacle
[2011/08/03 10:08:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SafeNet Sentinel
[2008/01/26 08:41:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SlySoft
[2007/09/18 16:40:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ulead Systems
[2012/05/30 07:11:00 | 000,000,228 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 76 bytes -> C:\Dokumente und Einstellungen\Rainer\Eigene Dateien\Verträge:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Dokumente und Einstellungen\Rainer\Eigene Dateien\Gutschein.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Dokumente und Einstellungen\Rainer\Eigene Dateien\Anwalt:Roxio EMC Stream
< End of report >