so hier die OTL.txt

wie gehts jetzt weiter ?

OTL logfile created on: 6/1/2012 10:25:35 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 84.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 94.00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37.25 Gb Total Space | 6.43 Gb Free Space | 17.25% Space Free | Partition Type: NTFS
Drive D: | 18.63 Gb Total Space | 10.41 Gb Free Space | 55.88% Space Free | Partition Type: NTFS
Drive E: | 244.44 Mb Total Space | 244.44 Mb Free Space | 100.00% Space Free | Partition Type: FAT
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto] -- -- (Transbase TECDOC CD 2_2012 Service)
SRV - File not found [Disabled] -- -- (HidServ)
SRV - File not found [On_Demand] -- -- (AppMgmt)
SRV - [2012/05/08 13:51:50 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/05/08 13:51:49 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/05/04 15:50:50 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/02/26 19:15:42 | 000,055,144 | ---- | M] (Apple Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/12/21 22:31:26 | 000,217,088 | ---- | M] (Teruten) [Auto] -- C:\WINDOWS\system32\FsUsbExService.Exe -- (FsUsbExService)
SRV - [2008/11/11 03:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008/10/06 04:18:06 | 000,033,752 | ---- | M] (NOS Microsystems Ltd.) [On_Demand] -- C:\Programme\NOS\bin\getPlus_HelperSvc.exe -- (getPlus(R) Helper) getPlus(R)
SRV - [2006/05/25 12:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) [Auto] -- C:\WINDOWS\system32\TODDSrv.exe -- (TODDSrv)
SRV - [2005/09/26 06:22:28 | 000,036,864 | ---- | M] () [Auto] -- C:\WINDOWS\system32\acs.exe -- (ACS)
SRV - [2005/06/06 16:26:22 | 000,032,768 | ---- | M] () [Auto] -- C:\WINDOWS\system32\TpKmpSvc.exe -- (TpKmpSVC)
SRV - [2005/01/17 10:38:38 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto] -- C:\Programme\Toshiba\ConfigFree\CFSvcs.exe -- (CFSvcs)
SRV - [2004/10/21 21:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/08/27 18:33:00 | 000,110,592 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) [Auto] -- C:\WINDOWS\system32\DVDRAMSV.exe -- (DVD-RAM_Service)
SRV - [2004/07/13 19:05:00 | 001,527,887 | ---- | M] (The Firebird Project) [On_Demand] -- C:\Programme\Firebird\V1_5_1\Bin\fbserver.exe -- (FirebirdServerDefaultInstance)
SRV - [2004/07/13 19:05:00 | 000,065,536 | ---- | M] (The Firebird Project) [Auto] -- C:\Programme\Firebird\V1_5_1\Bin\fbguard.exe -- (FirebirdGuardianDefaultInstance)
SRV - [2003/06/19 18:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe -- (MDM)
SRV - [2000/09/28 17:58:42 | 000,129,536 | ---- | M] (Symantec Corporation) [Auto] -- C:\WINDOWS\system32\WFXSVC.EXE -- (wfxsvc)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (WINIO)
DRV - File not found [Kernel | On_Demand] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand] -- -- (slabbus) CP2101 USB Composite Device driver (WDM)
DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP)
DRV - File not found [Kernel | System] -- -- (PCIDump)
DRV - File not found [Kernel | System] -- -- (lbrtfdc)
DRV - File not found [Kernel | System] -- -- (i2omgmt)
DRV - File not found [Kernel | System] -- -- (Changer)
DRV - [2012/05/08 13:51:50 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012/05/08 13:51:50 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/10/11 09:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011/06/07 05:13:36 | 000,020,032 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\dgderdrv.sys -- (dgderdrv)
DRV - [2010/12/21 01:55:02 | 000,123,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ss_mdm.sys -- (ss_mdm)
DRV - [2010/12/21 01:55:02 | 000,098,560 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ss_bus.sys -- (ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM)
DRV - [2010/12/21 01:55:02 | 000,014,848 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ss_mdfl.sys -- (ss_mdfl)
DRV - [2010/07/28 05:19:28 | 000,058,112 | ---- | M] (Silicon Laboratories) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\silabser.sys -- (silabser)
DRV - [2010/07/28 05:19:28 | 000,047,176 | ---- | M] (Silicon Laboratories) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\silabenm.sys -- (silabenm)
DRV - [2010/06/17 09:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/06/02 09:49:20 | 000,993,464 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2010/06/02 09:49:20 | 000,738,360 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2010/06/02 09:49:18 | 000,217,016 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2009/12/21 22:31:26 | 000,036,640 | ---- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2009/10/29 06:05:08 | 000,114,304 | R--- | M] (OMNIKEY) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\cxbu0wdm.sys -- (cxbu0wdm)
DRV - [2008/08/26 03:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2006/12/01 14:43:32 | 000,016,512 | ---- | M] (Adaptec) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\ASPI32.SYS -- (Aspi32)
DRV - [2006/08/02 12:54:00 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | System] -- C:\WINDOWS\system32\drivers\SMAPINT.SYS -- (Smapint)
DRV - [2006/08/02 12:54:00 | 000,009,343 | ---- | M] () [Kernel | System] -- C:\WINDOWS\system32\drivers\TDSMAPI.SYS -- (TDSMAPI)
DRV - [2006/08/01 20:27:48 | 000,012,544 | ---- | M] (Intel Corporation) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2006/06/28 10:25:24 | 004,304,384 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006/06/28 05:50:00 | 000,098,816 | ---- | M] (TOSHIBA Corporation) [File_System | Auto] -- C:\WINDOWS\system32\drivers\tdudf.sys -- (tdudf)
DRV - [2006/04/01 12:46:28 | 000,471,264 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211)
DRV - [2006/03/18 01:36:42 | 001,155,584 | ---- | M] (Agere Systems) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006/03/02 13:49:50 | 000,015,360 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV - [2006/02/26 23:46:20 | 000,081,408 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2006/01/12 10:21:18 | 000,031,872 | ---- | M] (Quanta Computer, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\qkbfiltr.sys -- (qkbfiltr)
DRV - [2005/12/11 17:40:44 | 001,414,656 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005/06/10 15:42:00 | 000,005,504 | ---- | M] (Quanta Computer Corp) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\BoiHwSetup.sys -- (BoiHwsetup)
DRV - [2005/06/01 21:33:00 | 000,102,384 | ---- | M] (Matsushita Electric Industrial Co.,Ltd.) [File_System | System] -- C:\WINDOWS\system32\drivers\meiudf.sys -- (meiudf)
DRV - [2005/05/05 08:27:38 | 000,007,936 | ---- | M] (Quanta Computer, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\qmofiltr.sys -- (qmofiltr)
DRV - [2004/08/03 17:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)
DRV - [2004/05/14 10:31:10 | 000,122,716 | ---- | M] (DeTeWe Berlin) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ULISA.SYS -- (ulisa) DeTeWe ISDN-Adapter (USB)
DRV - [2003/12/01 00:54:20 | 000,043,136 | R--- | M] (Prolific Technology Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2003/01/29 08:35:00 | 000,012,032 | ---- | M] (TOSHIBA Corporation.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\Netdevio.sys -- (Netdevio)
DRV - [2002/07/01 07:36:54 | 000,236,968 | ---- | M] (DeTeWe Berlin) [Kernel | Auto] -- C:\WINDOWS\System32\Drivers\E504C.SYS -- (CAPI20)
DRV - [2001/09/18 11:46:56 | 000,038,480 | ---- | M] (DeTeWe Berlin) [Kernel | Auto] -- C:\WINDOWS\System32\drivers\detewecp.sys -- (DETEWECP)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Künkel_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page =
IE - HKU\Künkel_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050&SSPV=IEAUTOTB
IE - HKU\Künkel_ON_C\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\Künkel_ON_C\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKU\Künkel_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Künkel_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local




FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)



O1 HOSTS File: ([2004/08/04 08:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - No CLSID value found.
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - No CLSID value found.
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\Künkel_ON_C\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKU\Künkel_ON_C\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CherryConfigDlg] C:\Programme\Cherry\SmartDevice\ConfigDlg.exe (Cherry GmbH)
O4 - HKLM..\Run: [GloboFleet CC] C:\Programme\Buyond_GmbH\GloboFleet_CC\GloboFleet_CC.exe (Buyond GmbH)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [SfWinStartInfo] C:\Programme\SFirm32\sfWinStartupInfo.exe (Star Finanz - Software Entwicklung und Vertriebs GmbH)
O4 - HKU\Künkel_ON_C..\Run: [C44031C4] C:\WINDOWS\system32\7B9864D4C44031C454AC.exe ()
O4 - HKU\Künkel_ON_C..\Run: [KiesHelper] C:\Programme\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKU\Künkel_ON_C..\Run: [KiesPDLR] C:\Programme\SAMSUNG\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKU\Künkel_ON_C..\Run: [KiesTrayAgent] C:\Programme\SAMSUNG\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Künkel_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Künkel_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\Künkel_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\Künkel_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_07\bin\NPJPI150_07.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_07-windows-i586.cab (Java Plug-in 1.5.0_07)
O16 - DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_07-windows-i586.cab (Java Plug-in 1.5.0_07)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer =
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\7B9864D4C44031C454AC.exe) - C:\WINDOWS\system32\7B9864D4C44031C454AC.exe ()
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\tpfnf2: DllName - notifyf2.dll - C:\WINDOWS\System32\notifyf2.dll ()
O20 - Winlogon\Notify\tphotkey: DllName - tphklock.dll - C:\WINDOWS\System32\tphklock.dll ()
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found
O28 - HKLM ShellExecuteHooks: {A213B520-C6C2-11d0-AF9D-008029E1027E} - C:\Programme\WinFax\WFXSEH32.DLL (Symantec Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/08/30 03:42:06 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{62bdd6e5-7fd1-11db-9f74-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{62bdd6e5-7fd1-11db-9f74-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{62bdd6e5-7fd1-11db-9f74-806d6172696f}\Shell\AutoRun\command - "" = D:\Autorun.exe
O33 - MountPoints2\{df5f87dc-6077-11dd-a63d-0016e382ce76}\Shell\AutoRun\command - "" = E:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {76C19B34-F0C8-11cf-87CC-0020AFEECF20} - Simp Chinese Language Pack
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found


========== Files/Folders - Created Within 30 Days ==========

[2012/05/31 12:32:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\Xndj
[2012/05/28 16:30:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\DVDVideoSoftTB
[2012/05/19 15:16:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\Mozilla
[2012/05/19 15:16:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\TuneUp Companion
[2012/05/19 15:15:42 | 000,000,000 | ---D | C] -- C:\Programme\TuneUpMedia
[2012/05/19 15:15:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\TuneUpMedia
[2012/05/19 15:15:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUpMedia
[2012/05/19 15:05:59 | 000,000,000 | ---D | C] -- C:\Programme\Conduit
[2012/05/19 15:05:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Künkel\Lokale Einstellungen\Anwendungsdaten\DVDVideoSoftTB
[2012/05/19 15:05:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Künkel\Lokale Einstellungen\Anwendungsdaten\Temp
[2012/05/19 15:05:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Künkel\Lokale Einstellungen\Anwendungsdaten\Conduit
[2012/05/19 15:05:56 | 000,000,000 | ---D | C] -- C:\Programme\DVDVideoSoftTB
[2012/05/19 15:05:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\OpenCandy
[2012/05/19 15:05:11 | 002,557,952 | ---- | C] (Nokia Corporation and/or its subsidiary(-ies)) -- C:\WINDOWS\System32\QtCore4.dll
[2012/05/19 15:05:01 | 000,405,176 | ---- | C] (Newtonsoft) -- C:\WINDOWS\System32\Newtonsoft.Json.Net20.dll
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\Künkel\Eigene Dateien\*.tmp files -> C:\Dokumente und Einstellungen\Künkel\Eigene Dateien\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/06/01 14:54:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/06/01 14:54:05 | 000,992,672 | ---- | M] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012/06/01 14:32:48 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/06/01 14:32:32 | 000,001,374 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/06/01 14:32:23 | 2137,444,352 | -HS- | M] () -- C:\hiberfil.sys
[2012/05/31 18:29:00 | 000,000,228 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012/05/31 17:50:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/05/31 12:31:16 | 000,059,904 | -H-- | M] () -- C:\WINDOWS\System32\7B9864D4C44031C454AC.exe
[2012/05/31 12:26:44 | 000,000,036 | ---- | M] () -- C:\WINDOWS\iltwain.ini
[2012/05/28 16:30:03 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/05/22 16:31:42 | 000,000,505 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Rapido - Windows.lnk
[2012/05/22 10:38:52 | 005,320,470 | ---- | M] () -- C:\Dokumente und Einstellungen\Künkel\Desktop\Att2011LIGHT.pdf
[2012/05/19 15:16:13 | 000,000,686 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TuneUp Companion.lnk
[2012/05/19 15:16:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\TuneUp Companion
[2012/05/19 15:05:12 | 000,000,912 | ---- | M] () -- C:\Dokumente und Einstellungen\Künkel\Desktop\DVDVideoSoft Free Studio.lnk
[2012/05/19 15:05:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\DVDVideoSoft
[2012/05/19 15:05:11 | 000,001,029 | ---- | M] () -- C:\Dokumente und Einstellungen\Künkel\Desktop\Free YouTube to MP3 Converter.lnk
[2012/05/11 15:50:50 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh323
[2012/05/11 15:50:40 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh322
[2012/05/11 15:50:32 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh321
[2012/05/11 15:50:22 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh320
[2012/05/11 12:32:52 | 000,147,608 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/05/10 16:26:54 | 000,497,022 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012/05/10 16:26:54 | 000,473,046 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/05/10 16:26:54 | 000,101,480 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012/05/10 16:26:54 | 000,084,918 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/05/10 16:23:09 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/05/08 13:51:50 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012/05/08 13:51:50 | 000,083,392 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012/05/04 15:50:49 | 000,419,488 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/05/04 15:50:49 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\Künkel\Eigene Dateien\*.tmp files -> C:\Dokumente und Einstellungen\Künkel\Eigene Dateien\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/05/31 12:32:21 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh325
[2012/05/31 12:32:21 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh324
[2012/05/31 12:32:21 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh323
[2012/05/31 12:32:21 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh322
[2012/05/31 12:32:21 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh321
[2012/05/31 12:32:21 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh320
[2012/05/31 12:31:16 | 000,059,904 | -H-- | C] () -- C:\WINDOWS\System32\7B9864D4C44031C454AC.exe
[2012/05/22 10:38:52 | 005,320,470 | ---- | C] () -- C:\Dokumente und Einstellungen\Künkel\Desktop\Att2011LIGHT.pdf
[2012/05/19 15:16:13 | 000,000,686 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TuneUp Companion.lnk
[2012/05/19 09:34:58 | 040,864,777 | ---- | C] () -- C:\Dokumente und Einstellungen\Künkel\Desktop\NEWGENERATION2011LIGHT2.pdf
[2012/05/10 18:03:08 | 000,992,672 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012/04/09 05:28:25 | 000,000,103 | ---- | C] () -- C:\WINDOWS\Setup_tmp.ini
[2012/02/16 12:29:01 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/11/04 18:21:01 | 000,000,029 | ---- | C] () -- C:\WINDOWS\hbcikrnl.ini.lock
[2011/09/10 11:38:08 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/09/10 09:49:02 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\$_hpcst$.hpc
[2011/06/07 05:13:38 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll
[2011/06/07 05:13:38 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2011/06/07 05:13:38 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2011/06/07 05:13:38 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll
[2011/06/07 05:13:38 | 000,030,568 | ---- | C] () -- C:\WINDOWS\MusiccityDownload.exe
[2011/05/30 06:02:07 | 000,000,239 | ---- | C] () -- C:\WINDOWS\HBCIKRNL.INI
[2011/05/30 05:40:12 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2011/04/26 16:34:46 | 000,016,578 | -HS- | C] () -- C:\Dokumente und Einstellungen\Künkel\Lokale Einstellungen\Anwendungsdaten\25c1hi2x1n2l8vd7024s80e27bw77dfd8v0d10f3
[2011/04/26 16:34:46 | 000,016,578 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\25c1hi2x1n2l8vd7024s80e27bw77dfd8v0d10f3
[2011/01/06 07:00:43 | 000,009,343 | ---- | C] () -- C:\WINDOWS\System32\drivers\TDSMAPI.SYS
[2011/01/06 06:58:02 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\TpKmpSvc.exe
[2011/01/05 12:19:20 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\notifyf2.dll
[2011/01/05 12:19:20 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\tphklock.dll
[2011/01/05 12:19:19 | 000,073,782 | ---- | C] () -- C:\WINDOWS\System32\ibmpmsvc.exe
[2010/05/11 11:28:10 | 000,023,456 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/04/23 15:08:00 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Künkel\info
[2009/04/03 16:00:01 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDevice.Dll
[2009/04/03 16:00:00 | 000,036,640 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDisk.Sys
[2008/10/29 07:22:13 | 000,000,034 | ---- | C] () -- C:\WINDOWS\System32\BD2030.DAT
[2008/09/13 16:33:09 | 000,000,031 | ---- | C] () -- C:\WINDOWS\RACETRK.INI
[2008/09/13 15:09:54 | 000,000,277 | ---- | C] () -- C:\WINDOWS\CCWIN.INI
[2008/08/02 06:00:06 | 000,002,951 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Config.nt.bak
[2008/08/02 06:00:06 | 000,001,806 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Autoexec.nt.bak
[2008/08/02 06:00:06 | 000,000,820 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\hosts.bak
[2007/10/25 11:26:10 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2007/10/11 18:12:05 | 000,000,480 | RH-- | C] () -- C:\WINDOWS\ssystda.dat
[2007/09/05 04:39:26 | 000,015,428 | ---- | C] () -- C:\Dokumente und Einstellungen\Künkel\RefEdit.exd
[2007/08/20 08:19:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WTNSETUP.INI
[2007/08/20 08:06:40 | 000,037,888 | ---- | C] () -- C:\WINDOWS\System32\DCCWFP32.DLL
[2007/08/20 08:06:39 | 000,000,250 | ---- | C] () -- C:\WINDOWS\WINFAX.INI
[2007/08/20 08:06:35 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\IMPLODE.DLL
[2007/02/22 13:33:21 | 000,015,156 | ---- | C] () -- C:\WINDOWS\System32\SELF32.INI
[2007/01/18 12:09:13 | 000,000,487 | ---- | C] () -- C:\WINDOWS\Capictrl.INI
[2007/01/05 15:02:14 | 000,000,036 | ---- | C] () -- C:\WINDOWS\iltwain.ini
[2007/01/05 15:01:50 | 000,007,803 | ---- | C] () -- C:\WINDOWS\System32\dymourl.ini
[2007/01/05 15:01:19 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\DYMOCFG.DLL
[2007/01/05 15:01:19 | 000,002,560 | ---- | C] () -- C:\WINDOWS\System32\lmmonres.dll
[2006/12/31 11:07:50 | 000,000,039 | ---- | C] () -- C:\WINDOWS\orgaMAX.ini
[2006/12/17 08:22:13 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ToDisc.INI
[2006/12/12 13:27:20 | 000,000,206 | ---- | C] () -- C:\WINDOWS\ITRACE32.INI
[2006/12/12 12:31:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WFXMACRO.INI
[2006/12/09 14:44:08 | 000,100,352 | ---- | C] () -- C:\Dokumente und Einstellungen\Künkel\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/12/01 18:19:50 | 000,655,360 | ---- | C] () -- C:\WINDOWS\System32\dslang32.dll
[2006/12/01 18:19:50 | 000,327,680 | ---- | C] () -- C:\WINDOWS\System32\ldf251.dll
[2006/12/01 16:47:41 | 000,397,312 | ---- | C] () -- C:\WINDOWS\esi_kl01.dat
[2006/12/01 16:41:12 | 000,000,058 | ---- | C] () -- C:\WINDOWS\hwendix.sys
[2006/12/01 16:37:31 | 000,008,487 | ---- | C] () -- C:\WINDOWS\RBSystem.ini
[2006/12/01 15:52:11 | 000,001,899 | ---- | C] () -- C:\WINDOWS\sfinst.ini
[2006/12/01 15:51:03 | 000,000,059 | ---- | C] () -- C:\WINDOWS\WINPHONE.INI
[2006/12/01 15:28:58 | 000,000,862 | ---- | C] () -- C:\WINDOWS\brwmark.ini
[2006/12/01 15:28:58 | 000,000,205 | ---- | C] () -- C:\WINDOWS\brqikmon.ini
[2006/12/01 14:43:50 | 000,052,858 | ---- | C] () -- C:\WINDOWS\System32\interceptor.sys
[2006/11/29 13:55:21 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\Künkel\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2006/11/29 13:54:14 | 000,245,760 | ---- | C] () -- C:\WINDOWS\System32\ControlWZCS.exe
[2006/11/29 13:54:11 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\acs.exe
[2006/11/29 13:54:06 | 000,311,296 | ---- | C] () -- C:\WINDOWS\System32\AegisI5.exe
[2006/11/29 13:53:51 | 000,270,336 | ---- | C] () -- C:\WINDOWS\System32\PlugPlayPCIDevice.exe
[2006/10/27 09:16:40 | 000,138,512 | ---- | C] () -- C:\WINDOWS\System32\OUTLCTL.DLL
[2006/08/30 09:06:55 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/08/30 08:42:42 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/08/30 08:32:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NDSTray.INI
[2006/08/30 08:31:38 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2006/08/30 08:31:38 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2006/08/30 08:31:38 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2006/08/30 08:31:38 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2006/08/30 08:31:38 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2006/08/30 08:31:38 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2006/08/30 08:18:52 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini
[2006/08/30 08:18:52 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll
[2006/08/30 08:18:52 | 000,010,161 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini
[2006/08/30 08:18:52 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini
[2006/08/30 08:17:15 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2006/08/30 08:17:15 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2006/08/30 08:00:36 | 000,112,421 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2006/08/30 04:35:19 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006/08/30 04:34:31 | 000,147,608 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2006/08/30 03:44:58 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2006/08/30 03:43:53 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2006/08/30 03:40:02 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2006/08/30 03:28:30 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\ToshBIOS.dll
[2006/08/30 03:28:29 | 000,159,744 | ---- | C] () -- C:\WINDOWS\MakeMrk.exe
[2006/08/30 03:28:29 | 000,000,083 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2006/08/30 03:28:18 | 000,497,022 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2006/08/30 03:28:18 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2006/08/30 03:28:18 | 000,101,480 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2006/08/30 03:28:18 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2006/08/30 03:28:06 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2006/08/30 03:28:04 | 000,473,046 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006/08/30 03:28:04 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2006/08/30 03:28:04 | 000,084,918 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006/08/30 03:28:04 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2006/08/30 03:28:01 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2006/08/30 03:28:01 | 000,004,631 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2006/08/30 03:28:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2006/08/30 03:27:58 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2006/08/30 03:27:57 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2006/08/30 03:27:53 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2006/08/30 03:27:45 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2006/08/01 04:56:40 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\TPeculiarity.dll
[2005/12/08 05:56:50 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\tsbwls.dll
[2005/11/14 09:20:36 | 000,235,520 | R--- | C] () -- C:\WINDOWS\System32\libjcc.dll
[2000/11/09 09:39:06 | 000,000,181 | ---- | C] () -- C:\WINDOWS\UNO.INI
[1999/08/12 21:22:00 | 000,117,248 | ---- | C] () -- C:\WINDOWS\System32\brdiag2.exe
[1999/08/09 22:49:00 | 000,222,112 | ---- | C] () -- C:\WINDOWS\System32\brstats8.exe
[1999/08/09 22:49:00 | 000,006,720 | ---- | C] () -- C:\WINDOWS\System32\brstlan8.dll
[1999/06/30 21:01:00 | 000,001,150 | ---- | C] () -- C:\WINDOWS\System32\brinthlp.dll
[1999/06/02 21:00:00 | 000,006,802 | ---- | C] () -- C:\WINDOWS\System32\brhl1030.ini
[1999/03/05 21:00:00 | 000,000,411 | ---- | C] () -- C:\WINDOWS\System32\brwmark.ini

========== LOP Check ==========

[2011/01/05 13:17:16 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\Anwendungsdaten\toshiba
[2011/01/05 12:35:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\ASCOMP Software
[2011/05/30 05:49:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\Cherry
[2011/01/05 12:35:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\DataDesign
[2012/05/19 15:05:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\DVDVideoSoft
[2012/03/09 11:50:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\DVDVideoSoftIEHelpers
[2010/11/10 12:40:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\Equsty
[2011/01/09 17:09:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\FinalMediaPlayer
[2011/01/05 12:35:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\GetRightToGo
[2011/01/05 12:35:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\InterVideo
[2011/01/05 12:35:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\MSNInstaller
[2012/05/19 15:05:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\OpenCandy
[2011/01/05 12:35:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\Opera
[2011/09/10 09:59:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\PC Suite
[2011/01/06 13:28:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\ProtectDisc
[2011/09/10 10:23:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\Samsung
[2011/07/13 05:18:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\TeamViewer
[2011/01/05 12:35:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\toshiba
[2012/05/19 15:17:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\TuneUpMedia
[2012/03/09 11:38:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\Uniblue
[2011/01/05 12:35:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\Upfou
[2012/05/31 12:32:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Künkel\Anwendungsdaten\Xndj
[2011/01/05 12:34:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\avg9
[2011/01/05 12:34:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Downloaded Installations
[2011/01/05 12:34:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\fun communications
[2011/01/05 12:34:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\G DATA
[2012/06/01 14:32:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GloboFleet
[2011/01/05 12:34:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\OfflineCatalog
[2011/05/14 03:18:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Drivers HeadQuarters
[2011/09/10 09:59:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2011/09/10 10:23:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Samsung
[2011/01/05 12:34:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan
[2012/04/09 05:28:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SFirm LOGS
[2012/03/26 22:40:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TECDOC_CD
[2012/05/22 17:11:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUpMedia
[2007/03/26 11:17:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WinZip
[2011/01/05 12:34:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012/03/09 11:45:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
[2012/05/31 18:29:00 | 000,000,228 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*. >
[2011/01/05 12:33:34 | 000,000,000 | -H-D | M] -- C:\$AVG
[2011/01/05 12:33:34 | 000,000,000 | ---D | M] -- C:\487b3257957d00c72c
[2011/01/07 07:51:27 | 000,000,000 | ---D | M] -- C:\9c8447b3540b0d818942b8fe1a
[2011/01/05 12:34:07 | 000,000,000 | -H-D | M] -- C:\ALCAR
[2011/04/27 14:27:31 | 000,000,000 | ---D | M] -- C:\Avenger
[2011/10/10 04:09:29 | 000,000,000 | ---D | M] -- C:\BOSCH_PR
[2012/05/23 03:59:55 | 000,000,000 | ---D | M] -- C:\Config.Msi
[2012/05/22 16:34:39 | 000,000,000 | ---D | M] -- C:\COSMOS
[2011/01/07 08:49:18 | 000,000,000 | ---D | M] -- C:\d2b3785f13917d06462bf8
[2011/01/05 12:34:23 | 000,000,000 | ---D | M] -- C:\Daten Von System Alt
[2011/01/05 12:47:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2011/01/06 09:15:20 | 000,000,000 | ---D | M] -- C:\DRIVERS
[2011/01/07 07:50:56 | 000,000,000 | ---D | M] -- C:\e280eda30579cd05c003a8
[2011/01/05 12:47:34 | 000,000,000 | -HSD | M] -- C:\found.000
[2011/01/05 12:48:40 | 000,000,000 | ---D | M] -- C:\I386
[2011/01/05 12:48:40 | 000,000,000 | ---D | M] -- C:\PCBAXTMP
[2011/09/10 09:46:57 | 000,000,000 | ---D | M] -- C:\Program Files
[2012/05/19 15:15:42 | 000,000,000 | R--D | M] -- C:\Programme
[2011/01/06 11:07:02 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2011/01/05 13:00:18 | 000,000,000 | ---D | M] -- C:\SUPPORT
[2012/06/01 11:11:33 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011/10/05 11:54:58 | 000,000,000 | ---D | M] -- C:\TECDOC_CD
[2011/09/10 11:28:01 | 000,000,000 | ---D | M] -- C:\Temp
[2011/01/05 13:10:01 | 000,000,000 | ---D | M] -- C:\Toolscd
[2011/01/05 13:10:05 | 000,000,000 | ---D | M] -- C:\unzipped
[2011/01/05 13:10:06 | 000,000,000 | ---D | M] -- C:\VALUEADD
[2012/05/17 03:55:31 | 000,000,000 | ---D | M] -- C:\WINDOWS
[2011/01/05 13:19:29 | 000,000,000 | ---D | M] -- C:\XMAS

< %PROGRAMFILES%\*.exe >

Invalid Environment Variable: %LOCALAPPDATA%\*.exe

< %systemroot%\*. /mp /s >


< MD5 for: AGP440.SYS >
[2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\I386\sp2.cab:AGP440.sys
[2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/09/23 13:50:31 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/09/23 13:50:31 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\dllcache\agp440.sys
[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\I386\sp2.cab:atapi.sys
[2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/09/23 13:50:31 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/09/23 13:50:31 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 15:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/13 15:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\i386\atapi.sys
[2004/08/04 08:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 22:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 22:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004/08/04 08:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2004/08/04 08:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[2007/06/13 09:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2008/04/13 22:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe
[2008/04/13 22:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007/06/13 09:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: NETLOGON.DLL >
[2008/04/13 22:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 22:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/04 08:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2008/04/13 22:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 22:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004/08/04 08:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll

< MD5 for: USER32.DLL >
[2005/03/02 14:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll
[2007/03/08 11:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2005/03/02 14:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2004/08/04 08:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll
[2007/03/08 11:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2008/04/13 22:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008/04/13 22:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll

< MD5 for: USERINIT.EXE >
[2008/04/13 22:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 22:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004/08/04 08:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004/08/04 08:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/13 22:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 22:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

< MD5 for: WS2IFSL.SYS >
[2004/08/04 08:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004/08/04 08:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/08/30 05:33:58 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2006/08/30 05:33:58 | 000,638,976 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2006/08/30 05:33:58 | 000,413,696 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

< %systemroot%\system32\*.dll /lockedfiles >
[2011/03/03 02:54:43 | 000,149,504 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dnsapi.dll
[2012/02/29 21:15:30 | 006,076,928 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ieframe.dll
[2012/02/29 21:15:30 | 000,268,288 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iertutil.dll
[2008/04/13 22:22:18 | 000,280,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\mstask.dll
[2008/04/13 22:22:20 | 000,067,072 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ntdsapi.dll
[2008/04/13 22:22:23 | 000,023,040 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\psapi.dll
[2011/01/21 10:44:10 | 008,503,296 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shell32.dll
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

Invalid Environment Variable: %USERPROFILE%\*.*

Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe

Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll

Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
< End of report >

Hallo und Herzlich Willkommen!

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:

• "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
  - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
  - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
• Charakteristische Merkmale/Profilinformationen:
  - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du durch [X] oder Sternchen (*) ersetzen
• Die Systemprüfung und Bereinigung:
  - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
• Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
• Innerhalb der Betreuungszeit:
  - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
• Die Reihenfolge:
  - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
• GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
• Ansonsten unsere Forumsregeln:
  - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
• Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen

Bevor wir etwas gegen die vorhandenen Malware unternehmen wollen:

• Starte OTLPE
• Kontrolliere deine eigene Dateien (wie Dokumente, Musik, Bilder etc), ob der Trojaner sie verschlüsselt hat?!
• Welche Art und Weise wurden die Daten bereits verschlüsselt? Kannst Du ein Beispiel nennen? Dateiändung wurden zugefügt (z.B "locked- .wxyz"), oder nach einem Zufallsprinzip besteht ein Dateiname aus Groß und Kleinbuchstaben (wie z.B QsEEUTODXNVqyssQ)?

Nämlich manche Varianten lassen sich entschlüsseln, andere wieder leider nicht..

gruß
kira