CRYPT.ZPACK.GEN2, JAVA.Ternub.gen und andere Schädlinge gefunden

Jackomo

Zuerst Mal Hallo und einen Guten Abend,

leider habe ich dieses Board zu spät gefunden, wie üblich, denn man sucht ja nicht nach Lösungen wenn man keine Probleme hat...

Ich stecke etwas in der Klemme und hoffe Ihr könnt mir helfen. Ich weiss nicht ob am Ende der PC nun sauber ist oder nicht.

Ich h abe den PC meiner kleinen Schwester "zur Durchsicht" bekommen, "ist langsam" meinte Sie.
PC OS ist WIN XP mit SrvPck3
Die Antivir Lösung war eine ältere premium Version, aber mit aktueller Signatur.
Aufgefallen ist als Erstes, dass der letzte SystemScan von 2009 war .
Ich habe dann zuerst die neue AVIRA Premium Version und Malwarebytes installiert.

Avira hat beim Scan sofort zwei Funde signalisiert und in Quarantäne verschoben.
TR/CRYPT.ZPACK.GEN2
EXP/JAVA.Ternub.gen
Danach habe ich Malwarebytes laufen lassen - keine Funde.
Dachte das wärs gewesen - offenbar aber nicht...

Der PC ist, auch für einen betagten Rechner immer noch sehr sehr langsam.
Daher habe ich heute mal gegoogelt und bin auf das board hier gestoßen.

Bin dann nach Eurer Anleitung mal Alles schrittweise durchgegangen und hoffe den Rechner sauber bekommen zu haben.

Also Zuerst Malwarebytes gestartet - Ohne Funde wie Ihr seht, wobei der Echtzeitscanner von AVIRA noch im Hintergrund lief und Funde aufgezeigt hat, allerdings andere wie beim ersten Scan oben.

************************************************
Malwarebytes Anti-Malware (PRO) 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.12.20.09

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
HP_USER :: NAME-CD5FDA878D [limitiert]

Schutz: Aktiviert

20.12.2012 19:16:54
mbam-log-2012-12-20 (19-16-54).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 274280
Laufzeit: 6 Minute(n), 10 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

***************************************
Von AVIRA Exportierte Ereignisse:

20.12.2012 19:00 [System-Scanner] Malware gefunden
Die Datei 'C:\asdidwkt.lnk'
enthielt einen Virus oder unerwünschtes Programm 'EXP/CVE-2010-2568.V'
[exploit].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5b63f6ea.qua'
verschoben!

20.12.2012 19:00 [System-Scanner] Malware gefunden
Die Datei 'C:\amecxohknk.lnk'
enthielt einen Virus oder unerwünschtes Programm 'EXP/CVE-2010-2568.V'
[exploit].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '43fbd947.qua'
verschoben!

20.12.2012 18:57 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\asdidwkt.lnk'
wurde ein Virus oder unerwünschtes Programm 'EXP/CVE-2010-2568.V' [exploit]
gefunden.
Ausgeführte Aktion: Zugriff verweigern

20.12.2012 18:57 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\asdidwkt.lnk'
wurde ein Virus oder unerwünschtes Programm 'EXP/CVE-2010-2568.V' [exploit]
gefunden.
Ausgeführte Aktion: Zugriff verweigern

20.12.2012 18:57 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\amecxohknk.lnk'
wurde ein Virus oder unerwünschtes Programm 'EXP/CVE-2010-2568.V' [exploit]
gefunden.
Ausgeführte Aktion: Zugriff verweigern

20.12.2012 18:57 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\amecxohknk.lnk'
wurde ein Virus oder unerwünschtes Programm 'EXP/CVE-2010-2568.V' [exploit]
gefunden.
Ausgeführte Aktion: Zugriff verweigern

***************************************************
Dann Defogger gestartet (Reboot hat er nicht gefordert)

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:42 on 20/12/2012 (HP_USER)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
****************************************
Danach OTL gestartet
OTL Text

OTL logfile created on: 20.12.2012 19:43:45 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\HP_USER\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy

2.44 Gb Total Physical Memory | 1.95 Gb Available Physical Memory | 80.20% Memory free
4.72 Gb Paging File | 4.26 Gb Available in Paging File | 90.20% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 856.52 Gb Total Space | 811.65 Gb Free Space | 94.76% Space Free | Partition Type: NTFS
Drive D: | 74.97 Gb Total Space | 70.96 Gb Free Space | 94.64% Space Free | Partition Type: FAT32
Drive F: | 3.60 Gb Total Space | 3.49 Gb Free Space | 97.05% Space Free | Partition Type: FAT32

Computer Name: NAME-CD5FDA878D | User Name: HP_USER | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.12.20 18:56:26 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\HP_USER\Eigene Dateien\Downloads\OTL.exe
PRC - [2012.12.20 18:54:04 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\HP_USER\Eigene Dateien\Downloads\Defogger.exe
PRC - [2012.12.16 14:42:58 | 003,696,632 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\CDP\afcdpsrv.exe
PRC - [2012.12.16 00:56:51 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.12.16 00:56:23 | 000,565,024 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe
PRC - [2012.12.16 00:56:22 | 000,079,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.12.16 00:56:17 | 000,400,160 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe
PRC - [2012.12.16 00:56:16 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.12.16 00:56:15 | 000,384,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.11.29 14:50:25 | 003,463,080 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version8\TeamViewer_Service.exe
PRC - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012.08.23 01:09:54 | 000,813,032 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
PRC - [2012.08.23 01:09:34 | 000,403,328 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
PRC - [2012.08.23 01:08:50 | 006,010,264 | ---- | M] (Acronis) -- C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe
PRC - [2012.08.18 21:18:30 | 007,017,888 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\SyncAgent\syncagentsrv.exe
PRC - [2012.07.24 15:13:58 | 000,941,440 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\TibMounter\TibMounterMonitor.exe
PRC - [2012.05.31 14:41:40 | 000,132,488 | ---- | M] (Capital Intellect Inc) -- C:\Programme\Gemeinsame Dateien\Winferno\WSS\WSS.exe
PRC - [2011.11.15 18:30:16 | 002,139,400 | ---- | M] () -- C:\Programme\Acronis\DiskDirector\OSS\reinstall_svc.exe
PRC - [2010.06.04 12:22:41 | 000,618,496 | ---- | M] () -- C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
PRC - [2010.05.18 07:46:01 | 001,989,120 | ---- | M] () -- C:\WINDOWS\twain_32\Samsung\SCX3200\Scan2Pc.exe
PRC - [2008.04.14 06:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.10.03 14:46:34 | 000,438,359 | ---- | M] (Motive Communications, Inc.) -- C:\Programme\BLUEWIN\Quick Help\SmartBridge\QuickHelpAlert.exe
PRC - [2004.07.27 16:50:18 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe


========== Modules (No Company Name) ==========

MOD - [2012.12.20 18:54:04 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\HP_USER\Eigene Dateien\Downloads\Defogger.exe
MOD - [2012.12.16 00:56:56 | 000,397,088 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2012.08.23 01:12:16 | 000,019,840 | ---- | M] () -- C:\Programme\Acronis\TrueImageHome\ti_managers_proxy_stub.dll
MOD - [2012.08.23 00:42:50 | 000,435,584 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Acronis\Home\ulxmlrpcpp.dll
MOD - [2012.08.23 00:32:28 | 001,525,120 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Acronis\Home\icudt38.dll
MOD - [2012.01.09 19:44:20 | 000,166,912 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2011.11.15 18:30:16 | 002,139,400 | ---- | M] () -- C:\Programme\Acronis\DiskDirector\OSS\reinstall_svc.exe
MOD - [2010.06.04 12:22:41 | 000,618,496 | ---- | M] () -- C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
MOD - [2010.05.18 07:46:01 | 001,989,120 | ---- | M] () -- C:\WINDOWS\twain_32\Samsung\SCX3200\Scan2Pc.exe
MOD - [2009.11.19 13:10:25 | 001,384,520 | ---- | M] () -- C:\WINDOWS\twain_32\Samsung\SCX3200\SSOle.dll
MOD - [2009.11.19 10:17:59 | 000,026,624 | ---- | M] () -- C:\WINDOWS\system32\ssb3ml3.dll
MOD - [2005.03.15 15:17:28 | 000,204,800 | ---- | M] () -- c:\Programme\HP\Digital Imaging\bin\HpqUtil.dll


========== Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2012.12.16 14:42:58 | 003,696,632 | ---- | M] (Acronis) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Acronis\CDP\afcdpsrv.exe -- (afcdpsrv)
SRV - [2012.12.16 00:56:51 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.12.16 00:56:23 | 000,565,024 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService)
SRV - [2012.12.16 00:56:17 | 000,400,160 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2012.12.16 00:56:16 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.11.29 14:50:25 | 003,463,080 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Programme\TeamViewer\Version8\TeamViewer_Service.exe -- (TeamViewer8)
SRV - [2012.11.29 09:26:17 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.08.23 01:09:54 | 000,813,032 | ---- | M] (Acronis) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2012.08.18 21:18:30 | 007,017,888 | ---- | M] (Acronis) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Acronis\SyncAgent\syncagentsrv.exe -- (syncagentsrv)
SRV - [2012.05.31 14:41:40 | 000,132,488 | ---- | M] (Capital Intellect Inc) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Winferno\WSS\WSS.exe -- (Winferno Subscription Service)
SRV - [2011.11.15 18:30:16 | 002,139,400 | ---- | M] () [Auto | Running] -- C:\Programme\Acronis\DiskDirector\OSS\reinstall_svc.exe -- (OS Selector)
SRV - [2004.10.22 03:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\SSPORT.sys -- (SSPORT)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\DgiVecp.sys -- (DgiVecp)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2012.12.16 22:16:46 | 000,114,048 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\snapman.sys -- (snapman)
DRV - [2012.12.16 14:43:01 | 000,234,752 | ---- | M] (Acronis) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afcdp.sys -- (afcdp)
DRV - [2012.12.16 14:42:49 | 000,806,184 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\tdrpman.sys -- (tdrpman)
DRV - [2012.12.16 14:42:44 | 000,689,672 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\tib_mounter.sys -- (tib_mounter)
DRV - [2012.12.16 14:42:34 | 000,139,336 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\vididr.sys -- (vididr)
DRV - [2012.12.16 14:42:31 | 000,099,720 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\vidsflt.sys -- (vidsflt)
DRV - [2012.12.16 14:42:13 | 000,093,928 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\fltsrv.sys -- (fltsrv)
DRV - [2012.12.16 00:57:11 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2012.12.16 00:57:10 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.12.16 00:57:10 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012.12.16 00:57:09 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.09.29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2008.04.13 23:26:50 | 000,012,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usb8023.sys -- (USB_RNDIS)
DRV - [2007.05.30 16:31:59 | 000,019,345 | ---- | M] (Motive, Inc.) [Kernel | On_Demand | Stopped] -- C:\Programme\Common Files\Motive\MREMPR5.sys -- (MREMPR5)
DRV - [2007.05.30 16:31:47 | 000,018,003 | ---- | M] (Motive, Inc.) [Kernel | On_Demand | Stopped] -- C:\Programme\Common Files\Motive\MRENDIS5.sys -- (MRENDIS5)
DRV - [2005.12.12 17:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PS2.sys -- (Ps2)
DRV - [2005.06.07 23:44:36 | 001,235,968 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005.04.20 12:00:56 | 002,317,696 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM)
DRV - [2005.03.09 15:53:00 | 000,043,008 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2005.03.04 12:10:26 | 000,074,496 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
DRV - [2004.08.03 21:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bluewin.ch/index_d.html
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7HPEA_de
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.trojaner-board.de/69886-a...beachten.html"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - user.js - File not found


FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.12.15 15:51:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins

[2012.12.15 16:06:40 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\HP_USER\Anwendungsdaten\Mozilla\Extensions
[2012.12.15 15:51:20 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.11.29 09:26:57 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.11.29 10:19:31 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.11.29 10:19:31 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.11.29 10:19:31 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.11.29 10:19:32 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.11.29 10:19:31 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.11.29 10:19:31 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2004.08.04 12:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O4 - HKLM..\Run: [3200 Scan2PC] C:\WINDOWS\Twain_32\Samsung\SCX3200\Scan2pc.exe ()
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [AcronisTibMounterMonitor] C:\Programme\Gemeinsame Dateien\Acronis\TibMounter\TibMounterMonitor.exe (Acronis)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [HPHUPD08] c:\Programme\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe (Hewlett-Packard)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [Motive SmartBridge] C:\Programme\BLUEWIN\Quick Help\SmartBridge\QuickHelpAlert.exe (Motive Communications, Inc.)
O4 - HKLM..\Run: [PCDrProfiler] File not found
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Reminder] C:\Windows\Creator\Remind_XP.exe (SoftThinks)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Quick Help.lnk = C:\Programme\BLUEWIN\Quick Help\bin\matcli.exe (Motive Communications, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Hilfe zu Verbindungen - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Hilfe zu Verbindungen - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1198750983781 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1198751483656 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{74037B92-63E7-40CD-96A6-F0EF1D14DABA}: DhcpNameServer = 15.243.128.51 15.243.160.51
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D598938C-0BB9-42D3-A27A-7A2FE2B55B39}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\HP_USER\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\HP_USER\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.11.02 19:05:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2001.07.28 07:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - [2004.04.30 23:01:14 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012.12.20 19:07:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2012.12.20 18:37:33 | 002,712,200 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\Dokumente und Einstellungen\HP_USER\Desktop\procexp.exe
[2012.12.20 18:36:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\HP_USER\Eigene Dateien\Downloads
[2012.12.16 23:20:47 | 000,000,000 | RHSD | C] -- C:\BOOTWIZ
[2012.12.16 23:10:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\TeamViewer 8
[2012.12.16 14:47:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\HP_USER\Anwendungsdaten\Acronis
[2012.12.16 14:42:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\GroupPolicy
[2012.12.16 14:42:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Acronis
[2012.12.16 14:41:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Acronis
[2012.12.16 14:40:36 | 000,000,000 | ---D | C] -- C:\Programme\Acronis
[2012.12.16 14:40:13 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Acronis
[2012.12.16 13:50:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\HP_USER\Anwendungsdaten\Sonic
[2012.12.16 01:14:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\HP_USER\Anwendungsdaten\Avira
[2012.12.16 01:09:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira
[2012.12.16 01:08:53 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2012.12.16 01:08:36 | 000,036,552 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2012.12.16 01:08:35 | 000,134,336 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012.12.16 01:08:35 | 000,083,944 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012.12.16 01:08:21 | 000,000,000 | ---D | C] -- C:\Programme\Avira
[2012.12.15 16:10:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\HP_USER\Anwendungsdaten\Malwarebytes
[2012.12.15 16:09:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.12.15 16:09:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.12.15 16:09:43 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.12.15 16:09:42 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.12.15 15:57:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\HP_USER\Lokale Einstellungen\Anwendungsdaten\Mozilla
[2012.12.15 15:57:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\HP_USER\Anwendungsdaten\Mozilla
[2012.12.15 15:51:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla
[2012.12.15 15:51:24 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service
[2012.12.15 15:44:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2012.12.15 15:40:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Windows Genuine Advantage
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.12.20 19:42:23 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\HP_USER\defogger_reenable
[2012.12.20 19:37:58 | 000,000,188 | ---- | M] () -- C:\WINDOWS\System\hpsysdrv.DAT
[2012.12.20 19:37:18 | 000,000,408 | ---- | M] () -- C:\WINDOWS\tasks\WSSHelper.job
[2012.12.20 19:36:21 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.12.20 19:36:17 | 2615,726,080 | -HS- | M] () -- C:\hiberfil.sys
[2012.12.20 16:13:29 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.12.20 16:13:22 | 000,187,408 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.12.16 23:23:20 | 000,251,712 | RHS- | M] () -- C:\ntldr
[2012.12.16 23:23:20 | 000,047,564 | RHS- | M] () -- C:\ntdetect.com
[2012.12.16 23:23:20 | 000,004,952 | RHS- | M] () -- C:\bootfont.bin
[2012.12.16 23:23:20 | 000,000,297 | -HS- | M] () -- C:\boot.ini
[2012.12.16 23:09:59 | 000,000,798 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TeamViewer 8.lnk
[2012.12.16 22:36:08 | 000,001,024 | ---- | M] () -- C:\WINDOWS\System32\AutoPartNt.let
[2012.12.16 22:15:34 | 000,000,917 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Acronis Migrate Easy 7.0.lnk
[2012.12.16 16:24:03 | 000,000,942 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Acronis Disk Director 11 Home.lnk
[2012.12.16 14:41:49 | 000,000,847 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\True Image 2013.lnk
[2012.12.16 13:29:09 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Bench32.INI
[2012.12.16 01:09:34 | 000,001,682 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
[2012.12.16 00:57:11 | 000,028,520 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2012.12.16 00:57:10 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012.12.16 00:57:10 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2012.12.16 00:57:09 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012.12.15 15:51:27 | 000,000,707 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2012.12.15 14:51:47 | 000,027,650 | ---- | M] () -- C:\Dokumente und Einstellungen\HP_USER\Eigene Dateien\Antivir-Lizenz-2013-15.pdf
[2012.12.12 15:09:29 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.12.03 10:18:15 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2012.12.03 10:18:15 | 000,001,409 | ---- | M] () -- C:\WINDOWS\QTFont.for
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.12.20 19:42:23 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\HP_USER\defogger_reenable
[2012.12.16 23:09:59 | 000,000,798 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TeamViewer 8.lnk
[2012.12.16 22:34:35 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\AutoPartNt.let
[2012.12.16 22:15:34 | 000,000,917 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Acronis Migrate Easy 7.0.lnk
[2012.12.16 16:24:02 | 000,000,942 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Acronis Disk Director 11 Home.lnk
[2012.12.16 14:41:49 | 000,000,847 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\True Image 2013.lnk
[2012.12.16 13:29:09 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Bench32.INI
[2012.12.16 01:09:34 | 000,001,682 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
[2012.12.16 00:29:07 | 2615,726,080 | -HS- | C] () -- C:\hiberfil.sys
[2012.12.15 15:51:27 | 000,000,707 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2012.12.15 15:51:26 | 000,000,713 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk
[2012.12.15 14:51:47 | 000,027,650 | ---- | C] () -- C:\Dokumente und Einstellungen\HP_USER\Eigene Dateien\Antivir-Lizenz-2013-15.pdf
[2012.12.03 10:18:15 | 000,054,156 | -H-- | C] () -- C:\WINDOWS\QTFont.qfn
[2012.12.03 10:18:15 | 000,001,409 | ---- | C] () -- C:\WINDOWS\QTFont.for
[2012.09.25 13:32:28 | 013,192,999 | ---- | C] () -- C:\Dokumente und Einstellungen\HP_USER\grusskarten.cpr
[2012.02.15 10:52:18 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.01.09 17:30:04 | 000,484,656 | ---- | C] () -- C:\WINDOWS\ssndii.exe
[2011.01.09 17:29:36 | 000,116,016 | ---- | C] () -- C:\WINDOWS\Wiainst.exe
[2011.01.09 17:28:03 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\ssb3ml3.dll
[2011.01.07 21:41:17 | 000,140,288 | R--- | C] () -- C:\WINDOWS\System32\SaXPEH.dll
[2011.01.07 21:41:17 | 000,138,240 | R--- | C] () -- C:\WINDOWS\System32\SaXPUIEx.dll
[2011.01.07 21:41:17 | 000,117,248 | R--- | C] () -- C:\WINDOWS\System32\SaXPIPH.dll
[2011.01.07 21:41:17 | 000,087,552 | R--- | C] () -- C:\WINDOWS\System32\SaXPSTI.dll
[2011.01.07 21:41:16 | 000,197,632 | R--- | C] () -- C:\WINDOWS\System32\SaXPWIA.dll
[2007.12.27 11:19:24 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2006.12.14 23:05:28 | 000,000,477 | ---- | C] () -- C:\Programme\Verknüpfung mit QuickTime.lnk
[2006.11.15 11:46:50 | 000,003,584 | ---- | C] () -- C:\Dokumente und Einstellungen\HP_USER\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006.01.15 16:16:36 | 000,000,852 | ---- | C] () -- C:\Dokumente und Einstellungen\HP_USER\Anwendungsdaten\wklnhst.dat
[2006.01.09 14:25:46 | 000,000,144 | ---- | C] () -- C:\Dokumente und Einstellungen\HP_USER\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat

========== ZeroAccess Check ==========

[2005.01.01 18:27:01 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008.04.14 06:52:26 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 11:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 06:52:34 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012.12.16 16:26:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Acronis
[2009.09.12 15:56:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Winferno

========== Purity Check ==========



< End of report >


******************************************************
Extras.txt

OTL Extras logfile created on: 20.12.2012 19:43:45 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\HP_USER\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy

2.44 Gb Total Physical Memory | 1.95 Gb Available Physical Memory | 80.20% Memory free
4.72 Gb Paging File | 4.26 Gb Available in Paging File | 90.20% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 856.52 Gb Total Space | 811.65 Gb Free Space | 94.76% Space Free | Partition Type: NTFS
Drive D: | 74.97 Gb Total Space | 70.96 Gb Free Space | 94.64% Space Free | Partition Type: FAT32
Drive F: | 3.60 Gb Total Space | 3.49 Gb Free Space | 97.05% Space Free | Partition Type: FAT32

Computer Name: NAME-CD5FDA878D | User Name: HP_USER | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%ProgramFiles%\iTunes\iTunes.exe" = %ProgramFiles%\iTunes\iTunes.exe:*:enabled:iTunes -- (Apple Computer, Inc.)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpqste08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hposfx08.exe" = C:\Programme\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpqscnvw.exe" = C:\Programme\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe -- ()
"C:\Programme\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Programme\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe -- (Hewlett-Packard)
"C:\Programme\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard)
"C:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Co.)
"C:\Programme\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Programme\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe -- ()
"C:\Programme\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Programme\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe -- ( )
"C:\Programme\HP\Digital Imaging\bin\hpoews01.exe" = C:\Programme\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Computer, Inc.)
"C:\Programme\AOL 9.0\waol.exe" = C:\Programme\AOL 9.0\waol.exe:*:Enabled:AOL Germany
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\WINDOWS\twain_32\Samsung\ScanMgr.exe" = C:\WINDOWS\twain_32\Samsung\ScanMgr.exe:*:Enabled:Scan Manger -- (Samsung Electronics)
"C:\WINDOWS\twain_32\Samsung\SCX3200\Scan2Pc.exe" = C:\WINDOWS\twain_32\Samsung\SCX3200\Scan2Pc.exe:*:Enabled:ScanToPC -- ()
"C:\WINDOWS\twain_32\Samsung\SCX3200\Sscan2io.exe" = C:\WINDOWS\twain_32\Samsung\SCX3200\Sscan2io.exe:*:Enabled:SScanToIO -- ()
"C:\WINDOWS\Temp\InsB\Setup\bin\MainInst.exe" = C:\WINDOWS\Temp\InsB\Setup\bin\MainInst.exe:*:Enabled:Samsung SCX-3200 Series Installer
"C:\Dokumente und Einstellungen\HP_USER\Lokale Einstellungen\Temp\Ins74\Setup\bin\MainInst.exe" = C:\Dokumente und Einstellungen\HP_USER\Lokale Einstellungen\Temp\Ins74\Setup\bin\MainInst.exe:*:Enabled:Samsung SCX-3200 Series Installer -- ()
"C:\Dokumente und Einstellungen\HP_USER\Lokale Einstellungen\Temp\InsA8\Setup\bin\MainInst.exe" = C:\Dokumente und Einstellungen\HP_USER\Lokale Einstellungen\Temp\InsA8\Setup\bin\MainInst.exe:*:Enabled:Samsung SCX-3200 Series Installer -- ()
"C:\Programme\TeamViewer\Version8\TeamViewer.exe" = C:\Programme\TeamViewer\Version8\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\TeamViewer\Version8\TeamViewer_Service.exe" = C:\Programme\TeamViewer\Version8\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service -- (TeamViewer GmbH)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{03B1B42B-F6DE-41d9-8CFF-DC44E895C7A7}" = PhotoGallery
"{0611BD4E-4FE4-4a62-B0C0-18A4CC463428}" = CP_Package_Variety1
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data
"{09984AEC-6B9F-4ca7-B78D-CB44D4771DA3}" = Destinations
"{0B33B738-AD79-4E32-90C5-E67BFB10BBFF}" = AiO_Scan
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{172975EB-9465-4861-95B5-C7BB6D3DE62A}" = DocumentViewer
"{193DB24F-9A66-4896-8404-22D53EA89075}" = 1400_Help
"{1C139D7D-9FEA-468d-A9C8-2A6E3BDE564A}" = CP_Package_Variety3
"{1E04F83B-2AB9-4301-9EF7-E86307F79C72}" = Google Earth
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus
"{21DB3D90-D816-4092-A260-CA3F6B55A6DD}" = Sonic_PrimoSDK
"{23A7B376-BBEC-4e76-BBD7-0F155E70D74B}" = CP_Panorama1Config
"{266959FA-0AEE-41D0-A88E-F1EAC10A7C14}" = 1400
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 11
"{2C5D07FB-31A2-4F2D-9FDA-0B24ACD42BD0}" = HP Deskjet Printer Preload
"{2CADCEAB-D5DA-44D6-B5FC-7DEE87AB3C0C}" = Unload
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{30C19FF2-7FBA-4d09-B9DE-1659977F64F6}" = TrayApp
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{32BDCCB8-9DC8-496d-9DB1-F77510775BDB}" = InstantShareDevices
"{33D6CC28-9F75-4d1b-A11D-98895B3A3729}" = HP Photosmart 330,380,420,470,7800,8000,8200 Series
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3571A4C6-E0C6-47A7-B587-845CE2A6DEB0}" = Acronis Migrate Easy
"{36E47DA1-10E1-45d9-8B19-14D19607CDCF}" = CP_CalendarTemplates1
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{3912A629-0020-0005-3757-2FBA74D4DF0A}" = InterVideo WinDVD Player
"{516200E0-2043-4603-B9E7-CD87B71B6DF4}" = True Image 2013 Plus Pack
"{523E6F2A-2D59-4D91-90E8-6C49931C9F50}" = iTunes
"{54E3707F-808E-4fd4-95C9-15D1AB077E5D}" = NewCopy
"{56EE8B17-8274-418d-89AC-C057C5DB251E}" = RandMap
"{56F8AFC3-FA98-4ff1-9673-8A026CBF85BE}" = WebReg
"{5A01C58E-B0EC-49b9-AD71-7C0468688087}" = CP_Package_Basic1
"{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}" = HP PSC & OfficeJet 5.3.B
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{66BA8C26-AFE4-4408-807B-43E76B57EF53}" = SkinsHP1
"{6BB6627C-694F-4FDC-A3E5-C7F4BED4C724}" = DocProc
"{755EC5E3-FD51-46bd-A57F-7A2D56FBF061}" = PSTAPlugin
"{769A295C-DCF4-41d6-AFBA-7D9394B23AFE}" = PSPrinters08
"{7850A6D2-CBEA-4728-9877-F1BEDEA9F619}" = AiOSoftware
"{7A7B0BF3-2F00-4F03-8A9B-6ABCC07B90C6}" = Windows Live installer
"{7C03270C-4FAB-4F5C-B10D-52FEDA190790}" = DocumentViewerQFolder
"{7C9B95B7-B598-4398-B30F-7F6827192E6C}" = ProductContext
"{7E27304E-BAA2-4d90-A34E-76641FAFABB4}" = CP_AtenaShokunin1Config
"{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Einfache Internetanmeldung
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{8EFB7927-48AD-4E6D-91B7-6B2BD6C3F380}" = Acronis Disk Director 11 Home
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD Player
"{923A7F5A-1E8C-4FBE-8DF6-85940A60A79F}" = Readme
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A195B13E-A5E3-4BAF-A995-7F70F445CD06}" = ScannerCopy
"{A3455242-DAE0-4523-8242-FD82706ABF4B}" = CameraDrivers
"{A5BB5365-EFB4-44c3-A7E2-EB59B7EFD23D}" = CueTour
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AB61A692-5543-4C48-979B-8CEA1C52FE9C}" = PC-Doctor 5 for Windows
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic RecordNow Audio
"{AC76BA86-7AD7-1031-7B44-A70000000000}" = Adobe Reader 7.0 - Deutsch
"{ADAEEC53-24AF-4A49-B872-75FCBDA59916}" = True Image 2013
"{ADAEEC53-24AF-4A49-B872-75FCBDA59916}Visible" = True Image 2013
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy
"{B26E3B0D-C2FA-4370-B068-7C476766F029}" = Microsoft Works
"{B4D279F1-4309-49cc-A4B5-3A0D2E59C7B5}" = PanoStandAlone
"{B824B5C9-849F-4b9e-9EA7-6FD8CD8116DA}" = CP_Package_Variety2
"{B996AE66-10DB-4ac5-B151-E8B4BFBC42FC}" = BufferChm
"{BF6CF460-40C3-49BA-800A-4B934B6498B1}" = Scan Assistant
"{C506A18C-1469-4678-B094-F4EC9DAE6DB7}" = Scan
"{C510CA36-98D6-4F07-8AFF-81E7399A075B}" = 1400Trb
"{C83A12B9-B31B-461A-BBD4-CE9B988094F1}" = HP Photosmart Kameras 5.0
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE24344F-DFD8-40C8-8FD8-C9740B5F25AC}" = Fax
"{D30A4BAB-A3DF-47F4-8497-98BAFDE27763}" = SnapAPI
"{D518592A-0F1E-40ca-BECB-3D3F026C6B0D}" = CameraDrivers
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{E3F90083-80D4-4b5a-87C7-E97E12F5516D}" = HPProductAssistant
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{EA103B64-C0E4-4C0E-A506-751590E1653D}" = SolutionCenter
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F4C2E5F5-2970-45f4-ABD3-C180C4D961C4}" = Status
"{FE57DE70-95DE-4B64-9266-84DA811053DB}" = HP Update
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Aldi Suisse Foto Service" = Aldi Suisse Foto Service 4.12.1
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira Antivirus Premium
"HP Document Viewer" = HP Document Viewer 5.3
"HP Imaging Device Functions" = HP Imaging Device Functions 5.3
"HP Photo & Imaging" = HP Image Zone 5.3
"HP Solution Center & Imaging Support Tools" = HP Solution Center & Imaging Support Tools 5.3
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"InstallShield_{523E6F2A-2D59-4D91-90E8-6C49931C9F50}" = iTunes
"InstallShield_{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Einfache Internetanmeldung
"InstallShield_{AB61A692-5543-4C48-979B-8CEA1C52FE9C}" = PC-Doctor 5 for Windows
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox 17.0.1 (x86 de)" = Mozilla Firefox 17.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PS2" = PS2
"Python 2.2.3" = Python 2.2.3
"pywin32-py2.2" = Python 2.2 pywin32 extensions (build 203)
"Quick Help" = Quick Help
"QuickTime" = QuickTime
"Samsung SCX-3200 Series" = Samsung SCX-3200 Series
"TeamViewer 8" = TeamViewer 8
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR 4.10 (32-Bit)

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 16.12.2012 07:05:07 | Computer Name = NAME-CD5FDA878D | Source = ESENT | ID = 490
Description = svchost (908) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.

Error - 16.12.2012 10:19:01 | Computer Name = NAME-CD5FDA878D | Source = Winferno Subscription Service | ID = 262144
Description =

Error - 16.12.2012 11:52:22 | Computer Name = NAME-CD5FDA878D | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung trueimage.exe, Version 16.0.0.5551, fehlgeschlagenes
Modul ti_managers.dll, Version 16.0.0.5551, Fehleradresse 0x004124ae.

Error - 16.12.2012 12:00:37 | Computer Name = NAME-CD5FDA878D | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung , Version 0.0.0.0, fehlgeschlagenes Modul
unknown, Version 0.0.0.0, Fehleradresse 0x00000000.

Error - 16.12.2012 12:30:40 | Computer Name = NAME-CD5FDA878D | Source = Winferno Subscription Service | ID = 262144
Description =

Error - 20.12.2012 11:15:37 | Computer Name = NAME-CD5FDA878D | Source = Winferno Subscription Service | ID = 262144
Description =

Error - 20.12.2012 11:48:05 | Computer Name = NAME-CD5FDA878D | Source = Winferno Subscription Service | ID = 262144
Description =

Error - 20.12.2012 14:09:40 | Computer Name = NAME-CD5FDA878D | Source = Winferno Subscription Service | ID = 262144
Description =

Error - 20.12.2012 14:32:58 | Computer Name = NAME-CD5FDA878D | Source = Winferno Subscription Service | ID = 262144
Description =

Error - 20.12.2012 14:37:08 | Computer Name = NAME-CD5FDA878D | Source = Winferno Subscription Service | ID = 262144
Description =

[ System Events ]
Error - 20.12.2012 14:09:53 | Computer Name = NAME-CD5FDA878D | Source = System Error | ID = 1003
Description = Fehlercode 00000019, 1. Parameter 00000020, 2. Parameter e3c99108,
3. Parameter e3c99128, 4. Parameter 0c040201.

Error - 20.12.2012 14:31:55 | Computer Name = NAME-CD5FDA878D | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 20.12.2012 14:31:55 | Computer Name = NAME-CD5FDA878D | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 20.12.2012 14:33:04 | Computer Name = NAME-CD5FDA878D | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 20.12.2012 14:33:33 | Computer Name = NAME-CD5FDA878D | Source = System Error | ID = 1003
Description = Fehlercode 00000019, 1. Parameter 00000020, 2. Parameter e2f8cb70,
3. Parameter e2f8cb90, 4. Parameter 0c040205.

Error - 20.12.2012 14:34:21 | Computer Name = NAME-CD5FDA878D | Source = Service Control Manager | ID = 7034
Description = Dienst "MBAMScheduler" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.

Error - 20.12.2012 14:36:48 | Computer Name = NAME-CD5FDA878D | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 20.12.2012 14:36:48 | Computer Name = NAME-CD5FDA878D | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 20.12.2012 14:38:19 | Computer Name = NAME-CD5FDA878D | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 20.12.2012 14:38:58 | Computer Name = NAME-CD5FDA878D | Source = System Error | ID = 1003
Description = Fehlercode 00000019, 1. Parameter 00000020, 2. Parameter e2963578,
3. Parameter e2963598, 4. Parameter 0c040401.


< End of report >
**************************************************
Zu guter Letzt noch GMER gestartet
Gmer.txt
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-12-20 23:56:10
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 rev.
Running: 0vvsed79.exe; Driver: C:\DOKUME~1\HP_BES~1\LOKALE~1\Temp\kxtcifoc.sys


---- System - GMER 1.0.15 ----

SSDT BA6714C4 ZwClose
SSDT BA67147E ZwCreateKey
SSDT BA6714CE ZwCreateSection
SSDT BA6714A6 ZwCreateSymbolicLinkObject
SSDT BA671474 ZwCreateThread
SSDT BA671483 ZwDeleteKey
SSDT BA67148D ZwDeleteValueKey
SSDT BA6714BF ZwDuplicateObject
SSDT BA6714AB ZwLoadDriver
SSDT BA671492 ZwLoadKey
SSDT BA671460 ZwOpenProcess
SSDT BA6714A1 ZwOpenSection
SSDT BA671465 ZwOpenThread
SSDT BA6714E7 ZwQueryValueKey
SSDT BA67149C ZwReplaceKey
SSDT BA6714D8 ZwRequestWaitReplyPort
SSDT BA671497 ZwRestoreKey
SSDT BA6714D3 ZwSetContextThread
SSDT BA6714DD ZwSetSecurityObject
SSDT BA6714B0 ZwSetSystemInformation
SSDT BA671488 ZwSetValueKey
SSDT BA6714E2 ZwSystemDebugControl
SSDT BA67146F ZwTerminateProcess
SSDT BA67146A ZwWriteVirtualMemory

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs tdrpman.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

Device \Driver\snapman \Device\snapman fltsrv.sys (Acronis Storage Filter Management Driver/Acronis)
Device \Driver\Ftdisk \Device\HarddiskVolume1 fltsrv.sys (Acronis Storage Filter Management Driver/Acronis)
Device \Driver\Ftdisk \Device\HarddiskVolume2 fltsrv.sys (Acronis Storage Filter Management Driver/Acronis)
Device \Driver\Disk \Device\Harddisk0\DR0 fltsrv.sys (Acronis Storage Filter Management Driver/Acronis)
Device \Driver\Disk \Device\Harddisk1\DR5 fltsrv.sys (Acronis Storage Filter Management Driver/Acronis)
Device \Driver\Disk \Device\Harddisk1\DP(1)0-0+6 fltsrv.sys (Acronis Storage Filter Management Driver/Acronis)
Device \Driver\Ftdisk \Device\FtControl fltsrv.sys (Acronis Storage Filter Management Driver/Acronis)

AttachedDevice \FileSystem\Fastfat \Fat tdrpman.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

---- EOF - GMER 1.0.15 ----