Hallo,
ich habe seit ein paar Tagen ein Problem. Beim starten des Rechners (Microsoft Vista) erscheint dieser weiße Bildschirm mit den Text „Bitte warten Sie während die Verbindung hergestellt wird“ und das selbe noch mal auf Englisch.

Habe mich hier im Forum mal ein bisschen durchgelesen und eine CD mit OTLPENet von meinem anderen Rechner erstellt. Hier ist die Datei, ich hoffe ihr könnt mir helfen....

Funktioniert noch der abgesicherte Modus mit Netzwerktreibern? Mit Internetverbindung?



Abgesicherter Modus zur Bereinigung

• Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
• Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:
  
  

Nein, leider nicht mehr...

Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
SRV - File not found [Auto] --  -- (solewxte)
O3 - HKU\Patrick_Passehl_ON_C\..\Toolbar\WebBrowser: (no name) - {1D8566BD-F06F-4029-A3BE-BA80AF5A09F3} - No CLSID value found.
O3 - HKU\Patrick_Passehl_ON_C\..\Toolbar\WebBrowser: (no name) - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - No CLSID value found.
O4 - HKLM..\Run: [Vs6sXYle8XGBDXh] C:\Users\Patrick Passehl\AppData\Roaming\CodeArchiver.exe ()
O4 - HKU\LocalService_ON_C..\Run: [InfoCockpit]  File not found
O4 - HKU\NetworkService_ON_C..\Run: [InfoCockpit]  File not found
O4 - HKU\Patrick_Passehl_ON_C..\Run: [Binary Noise] C:\Users\Patrick Passehl\AppData\Roaming\B7F500.exe ()
O4 - HKU\Patrick_Passehl_ON_C..\Run: [msvcrt_] C:\Users\Patrick Passehl\AppData\Roaming\Ms_dir_\msvcrt.exe ()
O4 - HKU\Patrick_Passehl_ON_C..\Run: [Vs6sXYle8XGBDXh] C:\Users\Patrick Passehl\AppData\Roaming\CodeArchiver.exe ()
O4 - HKU\Patrick_Passehl_ON_C..\Run: [Xymolydeo] C:\Users\Patrick Passehl\AppData\Roaming\Beqe\yccoe.exe ()
O4 - HKU\Patrick_Passehl_ON_C..\Run: [ypjlbexihhwwzhr] C:\ProgramData\ypjlbexihhwwzhrixxqc.exe ()
O4 - HKU\.DEFAULT..\RunOnce: [FlashPlayerUpdate]  File not found
O4 - HKU\.DEFAULT..\RunOnce: [Shockwave Updater] C:\Windows\System32\Macromed\Shockwave 10\SwHelper_1020022.exe (Adobe Systems, Inc.)
O4 - Startup: Error locating startup folders.
F3 - HKU\Patrick_Passehl_ON_C WinNT: Load - (C:\Users\PATRIC~1\LOCALS~1\Temp\mstvakfv.scr) - C:\Users\Patrick Passehl\Local Settings\Temp\mstvakfv.scr ()
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\Patrick_Passehl_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\Patrick_Passehl_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Patrick_Passehl_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Patrick_Passehl_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O9 - Extra Button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} -  File not found
O9 - Extra 'Tools' menuitem : PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} -  File not found
O20 - HKLM Winlogon: Shell - (C:\Users\Patrick Passehl\AppData\Roaming\CodeArchiver.exe) - C:\Users\Patrick Passehl\AppData\Roaming\CodeArchiver.exe ()
O20 - HKU\Patrick_Passehl_ON_C Winlogon: Shell - (C:\Users\Patrick Passehl\AppData\Roaming\CodeArchiver.exe) - C:\Users\Patrick Passehl\AppData\Roaming\CodeArchiver.exe ()
O20 - HKU\Patrick_Passehl_ON_C Winlogon: UserInit - (C:\Users\Patrick Passehl\AppData\Roaming\CodeArchiver.exe) - C:\Users\Patrick Passehl\AppData\Roaming\CodeArchiver.exe ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009/05/12 15:29:52 | 000,000,064 | ---- | M] () - I:\autorun.inf -- [ FAT ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
[2012/06/06 14:17:13 | 000,000,000 | ---D | C] -- C:\ProgramData\jwbthmgnccpdfmr
[2012/06/06 14:16:34 | 000,000,000 | ---D | C] -- C:\Users\Patrick Passehl\AppData\Roaming\Obok
[2012/06/06 14:16:34 | 000,000,000 | ---D | C] -- C:\Users\Patrick Passehl\AppData\Roaming\Beqe
[2012/06/06 14:16:34 | 000,000,000 | ---D | C] -- C:\Users\Patrick Passehl\AppData\Roaming\Axunyb
[2012/06/06 14:16:32 | 000,000,000 | ---D | C] -- C:\Users\Patrick Passehl\AppData\Roaming\Ms_dir_
[2012/05/20 14:50:38 | 000,000,000 | ---D | C] -- C:\Users\Patrick Passehl\AppData\Local\Conduit
[2012/06/06 14:19:23 | 000,237,056 | ---- | M] () -- C:\Users\Patrick Passehl\AppData\Roaming\CodeArchiver.exe
[2012/06/06 14:17:23 | 000,000,448 | ---- | M] () -- C:\ProgramData\pmfeimdeombirwf
[2012/06/06 14:16:35 | 000,053,760 | -HS- | M] () -- C:\ProgramData\ypjlbexihhwwzhrixxqc.exe
[2012/05/27 11:03:55 | 000,381,952 | ---- | M] () -- C:\Users\Patrick Passehl\AppData\Local\dimowkds.exe
@Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:16E15B52
:Commands
[purity]
[resethosts]
         

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen!
2.) Ordner movedfiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten!

4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

VIELEN VIELEN DANK FÜR DIE HILFE, es hat tatsächlich geklappt.
Gibt es ein Virenschutzprogramm gegen den Virus den ich mir eingefangen hatte.
Nicht das mir das gleich nochmal passiert...


Gruß Patrick

Wir sind noch nicht fertig

Bitte jetzt routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

 hier steht das Log
         

Ich war leider zu schnell bzw. vorschnell unterwegs.

Habe so wie der PC lief den Scan Malwarebytes durchgeführt und leider die Funde schon entfernt. Kann leider mit keinen Log Dienen.

Den Online Eset Scanner habe ich jetzt auch durchlaufen lassen.
Hier ist der log.txt

 ESETSmartInstaller@High as downloader log:
all ok
         

Kann leider mit keinen Log Dienen.

Warum was soll das, die Logs sind alle im Reiter Logdatein bei Malwarebytes zu sehen!


Und ESET hast du wahrscheinlich falsch gemacht, da gab es extra einen dicken Hinweis zu

Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt so öffnen: per Rechtsklick => als Administrator ausführen

Danke für die schnelle Hilfe

Nein, bei Malwarebytes habe ich keine Logdateien.
Habe in den Einstellungen gesehen, das bei Logdateien speichern auch kein Haken ist.
Das muss aber standartmäßig sein, denn bei Enstellungen ändere ich nie etwas.

Zu ESET:
Ich habe es so geöffnet "per Rechtsklick => als Administrator ausführen"
Werde es aber Heute Abend nochmal versuchen...

Habe in den Einstellungen gesehen, das bei Logdateien speichern auch kein Haken ist.

Ja schön blöd
Den Haken musst du rausgenommen haben, von allein passiert das nicht!

Wie gesagt, bei den Einstellungen spiele ich nicht rum. Kanns leider nicht rückgängig machen.

Beim ESET Scanner ist auch etwas anderes herausgekommen

 ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=12dbecce73a67247bed579809b3636c4
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-06-21 08:51:51
# local_time=2012-06-21 10:51:51 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 99534401 99534401 0 0
# compatibility_mode=5892 16776573 100 100 194221 177835375 0 0
# compatibility_mode=8192 67108863 100 0 88967 88967 0 0
# scanned=267039
# found=8
# cleaned=0
# scan_time=9261
C:\Users\Patrick Passehl\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\1d3393da-1b7a732b	Java/Exploit.Agent.NAO trojan (unable to clean)	00000000000000000000000000000000	I
C:\Users\Patrick Passehl\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\49c02227-1cc5c3f3	multiple threats (unable to clean)	00000000000000000000000000000000	I
C:\Users\Patrick Passehl\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\479d0273-34fbf6cb	Java/Exploit.CVE-2012-0507.F trojan (unable to clean)	00000000000000000000000000000000	I
C:\Users\Patrick Passehl\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\16dbbcf7-2ceff5f5	a variant of Java/Agent.DM trojan (unable to clean)	00000000000000000000000000000000	I
C:\Users\Patrick Passehl\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\795f8d46-3e8436a8	Java/Exploit.CVE-2012-0507.BO trojan (unable to clean)	00000000000000000000000000000000	I
C:\Users\Patrick Passehl\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\47c05b88-28619431	multiple threats (unable to clean)	00000000000000000000000000000000	I
C:\_OTL\MovedFiles.zip	multiple threats (unable to clean)	00000000000000000000000000000000	I
C:\_OTL\MovedFiles\06192012_150549\C_Users\Patrick Passehl\AppData\Roaming\B7F500.exe	a variant of Win32/Kryptik.AGOI trojan (unable to clean)	00000000000000000000000000000000	I
         

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Nein es geht alles wieder und vermissen tue ich auch nichts.

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

 hier steht das Log
         

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die OTL.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Setze oben mittig den Haken bei Scanne alle Benutzer
• Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Klick auf .
• Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Habe es endlich geschafft...

OTL Logfile:

OTL logfile created on: 05.07.2012 09:26:24 - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = C:\
Windows Vista (TM) Home Premium Service Pack 2 (Version = 6.0.6002) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.022,00 Mb Total Physical Memory | 179,00 Mb Available Physical Memory | 17,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 46,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 224,88 Gb Total Space | 60,40 Gb Free Space | 26,86% Space Free | Partition Type: NTFS
Drive D: | 436,59 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: PATRICKS-PC | User Name: Patrick Passehl
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand] --  -- (stllssvr)
SRV - File not found [Auto] --  -- (CLTNetCnService)
SRV - [2011.09.02 15:29:30 | 002,152,152 | ---- | M] (Lavasoft Limited) [Auto] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2010.08.17 17:13:02 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () [Auto] -- C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe -- (AAV UpdateService)
SRV - [2008.08.29 16:20:56 | 000,935,208 | ---- | M] (Nero AG) [Auto] -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2008.04.07 09:17:30 | 000,430,592 | ---- | M] (Nokia.) [On_Demand] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008.02.13 14:57:40 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.01.09 18:16:12 | 000,061,440 | ---- | M] (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) [Auto] -- C:\Program Files\Common Files\Marmiko Shared\MZCCntrl.exe -- (MZCCntrl)
SRV - [2006.12.05 16:05:18 | 000,112,152 | R--- | M] (InterVideo) [Auto] -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)
SRV - [2006.10.23 14:50:35 | 000,046,640 | R--- | M] (AOL LLC) [Disabled] -- C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe -- (AOL ACS)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (upperdev)
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand] --  -- (IpInIp)
DRV - File not found [Kernel | On_Demand] --  -- (huawei_ext_ctrl)
DRV - File not found [Kernel | On_Demand] --  -- (huawei_enumerator)
DRV - File not found [Kernel | On_Demand] --  -- (huawei_cdcecm)
DRV - File not found [Kernel | On_Demand] --  -- (huawei_cdcacm)
DRV - File not found [Kernel | On_Demand] --  -- (ew_usbenumfilter)
DRV - File not found [Kernel | On_Demand] --  -- (ew_hwusbdev)
DRV - File not found [Kernel | On_Demand] --  -- (EraserUtilDrv10822)
DRV - [2011.07.21 14:59:08 | 000,064,512 | ---- | M] (Lavasoft AB) [File_System | Boot] -- C:\Windows\System32\drivers\Lbd.sys -- (Lbd)
DRV - [2011.07.21 14:59:08 | 000,015,232 | ---- | M] () [Kernel | On_Demand] -- C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys -- (Lavasoft Kernexplorer)
DRV - [2010.07.10 06:37:00 | 011,008,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008.11.11 13:42:00 | 000,024,832 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2008.11.11 13:41:00 | 000,019,968 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2008.11.11 13:41:00 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2008.09.22 04:20:42 | 000,043,520 | ---- | M] (VIA Technologies, Inc.              ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\fetnd6v.sys -- (FETND6V)
DRV - [2008.07.30 07:51:30 | 000,277,736 | ---- | M] (Protect Software GmbH) [Kernel | Auto] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11)
DRV - [2008.03.01 14:13:41 | 000,278,728 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2008.03.01 14:13:40 | 000,025,416 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2008.01.30 11:19:46 | 000,715,248 | ---- | M] () [Kernel | Boot] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2006.11.01 22:18:15 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2006.10.09 16:03:56 | 000,017,152 | ---- | M] (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand] -- C:\Program Files\Common Files\Marmiko Shared\MInfraIS\MIINPazx.sys -- (MIINPazX)
DRV - [2006.10.09 15:46:44 | 000,017,536 | ---- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand] -- C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyx.sys -- (MTOnlPktAlyX)
DRV - [2006.10.04 10:14:26 | 000,017,280 | ---- | M] (Marmiko IT-Solutions GmbH) [Kernel | On_Demand] -- C:\Program Files\Common Files\Marmiko Shared\MAcNdis5.sys -- (MACNDIS5)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
 
IE - HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
 
IE - HKU\S-1-5-21-3700254375-2736591557-4141664051-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dth.de/
IE - HKU\S-1-5-21-3700254375-2736591557-4141664051-1002\Software\Microsoft\Internet Explorer\Main,Start Page Restore = hxxp://www.myspace.com/
IE - HKU\S-1-5-21-3700254375-2736591557-4141664051-1002\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3700254375-2736591557-4141664051-1002\..\URLSearchHook: {1d8566bd-f06f-4029-a3be-ba80af5a09f3} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-3700254375-2736591557-4141664051-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Patrick Passehl\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Patrick Passehl\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
 
 
 
O1 HOSTS File: ([2012.06.19 21:05:54 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1       localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O4 - HKLM..\Run: [ Malwarebytes Anti-Malware  (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Media Codec Update Service] C:\Program Files\Essentials Codec Pack\update.exe (MediaCodec.Org)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [ToADiMon.exe] C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\.DEFAULT..\Run: [InfoCockpit]  File not found
O4 - HKU\.DEFAULT..\Run: [T-Online_Software_6\WLAN-Access Finder] C:\Program Files\T-Online\WLAN-Access Finder\ToWLaAcF.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3700254375-2736591557-4141664051-1002..\Run: [T-Online_Software_6\WLAN-Access Finder] C:\Program Files\T-Online\WLAN-Access Finder\ToWLaAcF.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} -  File not found
O13 - gopher Prefix: missing
O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} https://picasaweb.google.com/s/v/71.18/uploader2.cab (UploadListView Class)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)
O16 - DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://navigram.com/engine/v1111/Navigram.cab (Navigram Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {DAF94F73-2AA6-44D8-A562-A28831820D34} hxxp://www.pixum.de/apps/EasyUploadX.cab (Pixum EasyUploadX Control)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Patrick Passehl\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Patrick Passehl\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.03.24 13:06:41 | 000,000,053 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{073e2c78-ac55-11de-b45c-00038a000015}\Shell\AutoRun\command - "" = K:\.\dth_player.exe
O33 - MountPoints2\{0a5bbace-a8d0-11e0-b8b0-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{0a5bbace-a8d0-11e0-b8b0-00038a000015}\Shell\AutoRun\command - "" = J:\AutoRun.exe
O33 - MountPoints2\{0a5bbad8-a8d0-11e0-b8b0-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{0a5bbad8-a8d0-11e0-b8b0-00038a000015}\Shell\AutoRun\command - "" = J:\AutoRun.exe
O33 - MountPoints2\{0cdada94-eaf5-11de-986b-00038a000015}\Shell\AutoRun\command - "" = K:\InstallSeagateManager.exe
O33 - MountPoints2\{17f9cc9e-8bab-11dc-9dd7-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{17f9cc9e-8bab-11dc-9dd7-806e6f6e6963}\Shell\AutoRun\command - "" = D:\reatogoMenu.exe -- [2005.07.16 23:36:50 | 000,240,128 | R--- | M] ()
O33 - MountPoints2\{7d5d07d7-9d38-11dc-abbf-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{7d5d07d7-9d38-11dc-abbf-00038a000015}\Shell\AutoRun\command - "" = J:\poker.exe
O33 - MountPoints2\{c84d9552-cf14-11dc-ae6d-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{c84d9552-cf14-11dc-ae6d-00038a000015}\Shell\AutoRun\command - "" = J:\autorun.exe
O33 - MountPoints2\{fe318905-b843-11dc-abe4-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{fe318905-b843-11dc-abe4-00038a000015}\Shell\AutoRun\command - "" = J:\setup.exe
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\reatogoMenu.exe -- [2005.07.16 23:36:50 | 000,240,128 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: msncache -  File not found
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader - Schnellstart.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe - (Adobe Systems Incorporated)
MsConfig - StartUpReg: Ad-Watch - hkey= - key= - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft Limited)
MsConfig - StartUpReg: Canaveral - hkey= - key= -  File not found
MsConfig - StartUpReg: ehTray.exe - hkey= - key= - C:\Windows\ehome\ehtray.exe (Microsoft Corporation)
MsConfig - StartUpReg: InfoCockpit - hkey= - key= -  File not found
MsConfig - StartUpReg: ISUSPM - hkey= - key= - C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
MsConfig - StartUpReg: mcexecwin - hkey= - key= -  File not found
MsConfig - StartUpReg: PhonostarTimer - hkey= - key= - C:\Program Files\phonostar\ps_timer.exe (phonostar)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
MsConfig - StartUpReg: SpybotSD TeaTimer - hkey= - key= - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
MsConfig - StartUpReg: T-Online_Software_6 - hkey= - key= - Reg Error: Value error. File not found
MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
MsConfig - StartUpReg: WMPNSCFG - hkey= - key= - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
MsConfig - StartUpReg: Yahoo! Pager - hkey= - key= - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
MsConfig - State: "startup" - 2
MsConfig - State: "services" - 2
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)
ActiveX: {0291E591-EA41-4c82-8106-3DC6CE7F7664} - Reg Error: Value error.
ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.2
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.2
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - Reg Error: Value error.
ActiveX: {347B0667-C7ED-429B-BDE3-CC8D3BACAA31} - Reg Error: Value error.
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - Reg Error: Value error.
ActiveX: {A38B334A-A0A2-436D-BAA0-34FE5E517E44} - Microsoft .NET Framework 1.1 Security Update (KB2656370)
ActiveX: {AA218328-0EA8-4D70-8972-E987A9190FF4} - Reg Error: Value error.
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.ac3acm - C:\Windows\System32\AC3ACM.acm (fccHandler)
Drivers32: msacm.alf2cd - C:\Windows\System32\alf2cd.acm (NCT Company)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.scg726 - C:\Windows\System32\Scg726.acm (SHARP Corporation)
Drivers32: msacm.sl_anet - C:\Windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.voxacm160 - C:\Windows\System32\vct3216.acm (Voxware, Inc.)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.dvsd - C:\Windows\System32\mcdvd_32.dll (MainConcept)
Drivers32: vidc.iv31 - C:\Windows\System32\ir32_32.dll (Intel(R) Corporation)
Drivers32: vidc.iv32 - C:\Windows\System32\ir32_32.dll (Intel(R) Corporation)
Drivers32: vidc.xvid - C:\Windows\System32\xvidvfw.dll ()
Drivers32: vidc.yvu9 - C:\Windows\System32\Iyvu9_32.dll ()
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.21 16:57:32 | 000,000,000 | ---D | C] -- C:\Users\Patrick Passehl\Documents\Tele Columbus
[2012.06.20 19:34:40 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.06.19 21:05:51 | 002,237,440 | R--- | C] (OldTimer Tools) -- C:\OTLPE.exe
[2012.06.19 21:05:49 | 000,000,000 | ---D | C] -- C:\_OTL
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.05 09:30:01 | 000,000,360 | ---- | M] () -- C:\Windows\tasks\Recovery DVD Creator.job
[2012.07.05 09:30:01 | 000,000,360 | ---- | M] () -- C:\Windows\tasks\Erweiterte Garantie.job
[2012.07.05 08:57:19 | 000,004,080 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.05 08:57:19 | 000,004,080 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.05 08:39:03 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.05 08:35:02 | 000,001,160 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3700254375-2736591557-4141664051-1002UA.job
[2012.07.05 08:06:32 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.05 07:53:25 | 000,037,877 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.07.05 07:53:24 | 000,037,877 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.07.05 06:57:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.05 06:57:06 | 1072,160,768 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.04 09:35:06 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3700254375-2736591557-4141664051-1002Core.job
[2012.07.03 06:10:01 | 000,000,064 | ---- | M] () -- C:\Windows\System32\rp_stats.dat
[2012.07.03 06:10:01 | 000,000,044 | ---- | M] () -- C:\Windows\System32\rp_rules.dat
[2012.07.01 13:12:36 | 000,238,080 | ---- | M] () -- C:\Users\Patrick Passehl\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.01 12:57:14 | 000,638,510 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.07.01 12:57:14 | 000,604,126 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.07.01 12:57:14 | 000,130,462 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.07.01 12:57:14 | 000,107,562 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.07.01 12:35:27 | 000,002,095 | ---- | M] () -- C:\Users\Patrick Passehl\Desktop\Google Chrome.lnk
[2012.07.01 12:35:27 | 000,002,057 | ---- | M] () -- C:\Users\Patrick Passehl\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012.06.21 17:07:18 | 000,012,416 | ---- | M] () -- C:\Users\Patrick Passehl\Documents\em tipps.odt
[2012.06.20 22:29:33 | 000,000,906 | ---- | M] () -- C:\Users\Patrick Passehl\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012.06.20 22:13:01 | 000,423,000 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.06.20 20:53:39 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat
[2012.06.20 20:53:39 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat
[2012.06.20 20:53:20 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2012.06.19 19:48:22 | 202,978,829 | ---- | M] () -- C:\Users\Patrick Passehl\Documents\mail juni.zip
[2012.06.19 17:29:31 | 000,000,869 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.19 17:29:31 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.05 21:27:03 | 000,023,190 | ---- | M] () -- C:\Users\Patrick Passehl\Documents\Pattis Konzerte.odt
 
========== Files Created - No Company Name ==========
 
[2012.06.21 17:07:18 | 000,012,416 | ---- | C] () -- C:\Users\Patrick Passehl\Documents\em tipps.odt
[2012.06.20 20:53:20 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2012.06.19 17:29:31 | 000,000,869 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.19 17:24:09 | 202,978,829 | ---- | C] () -- C:\Users\Patrick Passehl\Documents\mail juni.zip
[2012.06.19 15:09:33 | 1072,160,768 | -HS- | C] () -- C:\hiberfil.sys
[2011.10.28 09:03:36 | 000,000,008 | ---- | C] () -- C:\Users\Patrick Passehl\AppData\Roaming\kjm2jn1e5vihk7p8.dat
[2011.08.05 18:58:09 | 000,016,432 | ---- | C] () -- C:\Windows\System32\lsdelete.exe
[2011.08.05 18:24:23 | 000,000,064 | ---- | C] () -- C:\Windows\System32\rp_stats.dat
[2011.08.05 18:24:23 | 000,000,044 | ---- | C] () -- C:\Windows\System32\rp_rules.dat
[2011.04.04 10:12:45 | 000,001,356 | ---- | C] () -- C:\Users\Patrick Passehl\AppData\Local\d3d9caps.dat
[2010.11.01 06:43:31 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2010.03.29 18:37:12 | 000,000,008 | ---- | C] () -- C:\Users\Patrick Passehl\AppData\Roaming\jasltw.dat
[2010.03.11 22:27:16 | 000,037,877 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010.03.11 22:27:16 | 000,037,877 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.12.21 23:06:36 | 000,000,055 | ---- | C] () -- C:\Windows\cryavitompeg.ini
[2009.12.21 23:05:17 | 000,000,005 | ---- | C] () -- C:\Windows\System32\SySavitompeg.dat
[2009.09.17 08:50:08 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.09.17 08:50:07 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.07.23 23:07:57 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009.06.07 06:55:50 | 000,170,496 | ---- | C] () -- C:\Windows\APCBTUn.exe
[2009.06.07 06:55:48 | 000,000,064 | ---- | C] () -- C:\Windows\APCBT.ini
[2009.03.18 16:39:48 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.11.13 13:32:05 | 000,000,029 | ---- | C] () -- C:\Users\Patrick Passehl\AppData\Roaming\default.rss
[2008.11.13 13:32:03 | 000,000,000 | ---- | C] () -- C:\Users\Patrick Passehl\AppData\Roaming\downloads.m3u
[2008.11.01 12:39:24 | 000,000,141 | ---- | C] () -- C:\Windows\disney.ini
[2008.11.01 12:38:55 | 000,000,185 | ---- | C] () -- C:\Windows\disneysy.ini
[2008.10.11 09:19:04 | 000,056,832 | ---- | C] () -- C:\Windows\System32\Iyvu9_32.dll
[2008.10.11 08:40:11 | 000,000,012 | ---- | C] () -- C:\Windows\Ulead32.ini
[2008.09.07 09:16:43 | 000,012,288 | ---- | C] () -- C:\Windows\impborl.dll
[2008.08.10 07:52:57 | 000,524,288 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008.08.10 07:52:57 | 000,139,264 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2008.05.14 07:53:41 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2008.05.12 21:25:10 | 000,004,767 | ---- | C] () -- C:\Windows\Irremote.ini
[2008.04.04 07:59:18 | 000,000,066 | ---- | C] () -- C:\Users\Patrick Passehl\AppData\default.pls
[2008.03.30 12:24:50 | 000,000,074 | ---- | C] () -- C:\Windows\tm.ini
[2008.03.29 23:57:26 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2008.03.21 18:24:18 | 001,273,648 | ---- | C] () -- C:\Users\Patrick Passehl\AppData\Local\rx_image.Cache
[2008.03.01 14:13:41 | 000,278,728 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2008.03.01 14:13:40 | 000,025,416 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2008.02.24 01:27:41 | 000,000,000 | ---- | C] () -- C:\Windows\CleaningLab.INI
[2008.02.23 14:35:24 | 000,000,089 | ---- | C] () -- C:\Windows\CLEANI~1.INI
[2008.02.23 14:24:01 | 000,000,099 | ---- | C] () -- C:\Windows\magix.ini
[2008.02.13 14:45:29 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2008.02.06 13:02:56 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2008.02.06 13:02:14 | 000,006,768 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2007.11.06 21:25:26 | 000,238,080 | ---- | C] () -- C:\Users\Patrick Passehl\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.11.05 19:42:55 | 000,000,103 | ---- | C] () -- C:\Users\Patrick Passehl\AppData\Local\fusioncache.dat
[2007.10.10 15:37:54 | 000,278,528 | ---- | C] () -- C:\Windows\ImgUploaderLang_3.dll
[2007.10.10 15:37:54 | 000,278,528 | ---- | C] () -- C:\Windows\ImgUploaderLang_2.dll
[2007.10.10 15:37:54 | 000,278,528 | ---- | C] () -- C:\Windows\ImgUploaderLang_1.dll
[2007.06.27 13:22:54 | 000,692,224 | ---- | C] () -- C:\Windows\libcurl.dll
[2007.03.12 19:59:00 | 000,299,008 | ---- | C] () -- C:\Program Files\navigram_register.exe
[2007.02.06 02:05:26 | 000,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,423,000 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,604,126 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,107,562 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:25:25 | 000,557,568 | ---- | C] () -- C:\Windows\System32\hpotscld.dll
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.10.27 09:26:56 | 000,069,632 | ---- | C] () -- C:\Windows\System32\vuins32.dll
[2006.01.01 10:26:54 | 000,638,510 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.01.01 10:26:54 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.01.01 10:26:54 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.01.01 10:26:53 | 000,130,462 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.01.01 01:49:08 | 000,000,335 | ---- | C] () -- C:\Windows\nsreg.dat
[2006.01.01 01:47:15 | 000,049,152 | ---- | C] () -- C:\Windows\System32\ChCfg.exe
[2003.02.20 15:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
[1997.05.29 00:00:00 | 000,012,288 | ---- | C] () -- C:\Windows\System32\HLINKPRX.DLL
[1996.12.04 00:00:00 | 000,022,016 | ---- | C] () -- C:\Windows\System32\DOCOBJ.DLL
 
========== LOP Check ==========
 
[2012.03.28 19:35:11 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\Acamer
[2009.12.21 23:46:19 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\AnvSoft
[2010.09.29 10:31:40 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\Auslogics
[2008.08.10 07:55:19 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\AVSMedia
[2008.12.11 21:22:15 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\BITS
[2012.02.05 18:57:08 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\DesktopIconForAmazon
[2007.11.06 17:41:16 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\eMule
[2008.12.11 21:26:44 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\FlashGet
[2012.01.05 11:15:29 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\fotobuch.de AG
[2009.05.26 14:50:04 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\FUJIFILM
[2012.04.03 14:16:10 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\Giuw
[2008.01.08 18:30:46 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\InterVideo
[2009.11.08 09:29:09 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\IrfanView
[2012.03.30 22:17:02 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\Kodyud
[2010.07.11 12:24:30 | 000,000,000 | -HSD | M] -- C:\Users\Patrick Passehl\AppData\Roaming\lowsec
[2012.01.28 12:57:48 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\Navigram
[2008.06.21 12:23:37 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\Nokia
[2007.11.05 17:04:49 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\Packard Bell
[2010.03.14 14:10:00 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\PC Suite
[2007.11.09 10:33:22 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\PeerNetworking
[2012.05.03 23:00:47 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\phonostar-Player
[2010.01.24 11:14:50 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\ProtectDisc
[2009.12.21 23:33:09 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\Spesoft Audio Converter
[2011.07.07 22:01:57 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\T-Mobile
[2007.11.05 17:20:17 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\T-Online
[2010.11.02 11:01:31 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\Tropico 3
[2008.10.11 09:19:55 | 000,000,000 | ---D | M] -- C:\Users\Patrick Passehl\AppData\Roaming\Ulead Systems
[2012.02.06 20:04:34 | 000,000,000 | ---D | M] -- C:\ProgramData\AAV
[2007.11.05 16:37:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2011.07.25 21:12:34 | 000,000,000 | ---D | M] -- C:\ProgramData\DatacardService
[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2007.11.05 16:37:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2012.05.20 20:57:44 | 000,000,000 | ---D | M] -- C:\ProgramData\DriverGenius
[2010.11.02 20:52:00 | 000,000,000 | ---D | M] -- C:\ProgramData\EA Core
[2010.11.02 20:52:00 | 000,000,000 | ---D | M] -- C:\ProgramData\Electronic Arts
[2007.11.10 11:12:15 | 000,000,000 | ---D | M] -- C:\ProgramData\eMule
[2007.11.05 16:37:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2012.01.05 11:15:30 | 000,000,000 | ---D | M] -- C:\ProgramData\fotobuch.de AG
[2008.06.21 11:56:13 | 000,000,000 | ---D | M] -- C:\ProgramData\Installations
[2008.02.06 13:16:23 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX
[2008.06.21 12:23:30 | 000,000,000 | ---D | M] -- C:\ProgramData\PC Suite
[2009.04.30 18:09:03 | 000,000,000 | ---D | M] -- C:\ProgramData\PCSettings
[2008.07.24 10:16:14 | 000,000,000 | ---D | M] -- C:\ProgramData\sIF0VXNKi
[2010.11.02 20:28:34 | 000,000,000 | ---D | M] -- C:\ProgramData\Solidshield
[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2007.11.05 16:37:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2007.11.05 17:19:41 | 000,000,000 | ---D | M] -- C:\ProgramData\T-Online
[2009.07.15 16:24:11 | 000,000,000 | ---D | M] -- C:\ProgramData\TablePlanner
[2009.08.02 08:24:26 | 000,000,000 | ---D | M] -- C:\ProgramData\TEMP
[2006.11.02 15:02:04 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2011.01.02 11:35:33 | 000,000,000 | ---D | M] -- C:\ProgramData\tmp
[2008.11.12 11:27:41 | 000,000,000 | ---D | M] -- C:\ProgramData\Ulead Systems
[2006.01.01 01:50:36 | 000,000,000 | ---D | M] -- C:\ProgramData\Viewpoint
[2009.04.30 23:27:46 | 000,000,000 | ---D | M] -- C:\ProgramData\VManager
[2007.11.05 16:37:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2010.02.22 15:41:10 | 000,000,000 | ---D | M] -- C:\ProgramData\WindowsSearch
[2012.07.05 09:30:01 | 000,000,360 | ---- | M] () -- C:\Windows\Tasks\Erweiterte Garantie.job
[2012.07.05 09:30:01 | 000,000,360 | ---- | M] () -- C:\Windows\Tasks\Recovery DVD Creator.job
[2012.07.04 11:18:59 | 000,032,534 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
Invalid Environment Variable: %ALLUSERSPROFILE%\Application Data\*.
 
Invalid Environment Variable: %ALLUSERSPROFILE%\Application Data\*.exe
 
Invalid Environment Variable: %APPDATA%\*.
 
Invalid Environment Variable: %APPDATA%\*.exe
 
< %SYSTEMDRIVE%\*.exe >
[2007.03.12 19:59:00 | 000,299,008 | ---- | M] () -- C:\navigram_register.exe
[2011.07.13 04:55:05 | 002,237,440 | R--- | M] (OldTimer Tools) -- C:\OTLPE.exe
 
 
< MD5 for: AGP440.SYS  >
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.02.14 10:53:41 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008.02.14 10:53:41 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.02.14 10:53:41 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.11.05 16:54:37 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2007.11.05 16:54:37 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2008.01.19 09:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2008.01.30 11:19:46 | 000,715,248 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\drivers\sptd.sys
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< CREATERESTOREPOINT >
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 76 bytes -> C:\Users\Patrick Passehl\Documents\Ulead VideoStudio:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Patrick Passehl\Documents\Steuerfälle:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Patrick Passehl\Documents\restore:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Patrick Passehl\Documents\Picture Motion Browser:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Patrick Passehl\Documents\NeroVision:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Patrick Passehl\Documents\Nero Collections:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Patrick Passehl\Documents\NAVIGON:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Patrick Passehl\Documents\magicg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Patrick Passehl\Documents\InterVideo:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Patrick Passehl\Documents\FUSSBALL MANAGER 11:Roxio EMC Stream
< End of report >
         

--- --- ---
[/code]