Google leitet mich auf falsche Webseiten + Microsoft Security Essentials lässt sich nicht mehr starten

bueb1983

Seit gestern leitet mich Google beim Klick auf die Suchergebnisse auf andere Webseiten weiter (mir unbekannte Suchmaschinen, dubiose Shops, etc.). Außerdem ist Microsoft Security Essentials geschlossen und lässt sich nicht mehr starten. Spybot-Search & Destroy hat mehrere Fehler gefunden und behoben, diese haben allerdings nichts an der Situation geändert. Hier im Forum bin ich auf Norton Power Eraser gestoßen, dies hat ebenfalls nicht zum Erfolg geführt. Nun bin ich ratlos und würde mich freuen, wenn mir jemand von euch weiter helfen könnte. Die Angaben von OTL und GMER habe ich angehängt. Vielen Dank im Vorraus.

Liebe Grüße
Manuel

OTL:
OTL logfile created on: 23.01.2013 17:21:52 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\MBuehler\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,98 Gb Total Physical Memory | 2,39 Gb Available Physical Memory | 79,95% Memory free
4,29 Gb Paging File | 3,92 Gb Available in Paging File | 91,29% Paging File free
Paging file location(s): C:\pagefile.sys 1500 3000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 59,08 Gb Total Space | 17,44 Gb Free Space | 29,51% Space Free | Partition Type: NTFS
Drive D: | 8,01 Gb Total Space | 6,22 Gb Free Space | 77,75% Space Free | Partition Type: NTFS
Drive E: | 7,35 Gb Total Space | 6,13 Gb Free Space | 83,45% Space Free | Partition Type: NTFS
Drive H: | 149,04 Gb Total Space | 80,32 Gb Free Space | 53,89% Space Free | Partition Type: NTFS
Drive K: | 109,87 Gb Total Space | 103,56 Gb Free Space | 94,26% Space Free | Partition Type: NTFS
Drive L: | 109,87 Gb Total Space | 103,56 Gb Free Space | 94,26% Space Free | Partition Type: NTFS
Drive N: | 149,04 Gb Total Space | 80,32 Gb Free Space | 53,89% Space Free | Partition Type: NTFS
Drive P: | 368,07 Gb Total Space | 202,86 Gb Free Space | 55,12% Space Free | Partition Type: NTFS
Drive R: | 109,87 Gb Total Space | 103,56 Gb Free Space | 94,26% Space Free | Partition Type: NTFS
Drive S: | 149,04 Gb Total Space | 80,32 Gb Free Space | 53,89% Space Free | Partition Type: NTFS

Computer Name: IBB-10 | User Name: MBuehler | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013.01.23 14:18:17 | 000,365,568 | ---- | M] () -- C:\Dokumente und Einstellungen\MBuehler\Desktop\gmer-2.0.18444.exe
PRC - [2013.01.23 14:15:04 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\MBuehler\Desktop\OTL.exe
PRC - [2012.11.13 14:08:12 | 003,487,240 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDUpdate.exe
PRC - [2012.11.13 14:07:20 | 001,369,624 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDUpdSvc.exe
PRC - [2012.11.13 14:07:16 | 001,103,392 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDFSSvc.exe
PRC - [2012.11.12 11:45:18 | 000,309,688 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\Kies\KiesTrayAgent.exe
PRC - [2012.11.12 11:45:14 | 000,968,120 | ---- | M] (Samsung) -- C:\Programme\Samsung\Kies\Kies.exe
PRC - [2012.11.01 13:16:42 | 000,577,536 | ---- | M] (Samsung Electronics) -- C:\Programme\Samsung\Kies\KiesAirMessage.exe
PRC - [2010.07.04 20:51:26 | 000,017,408 | ---- | M] () -- C:\Programme\Unlocker\UnlockerAssistant.exe
PRC - [2009.01.21 22:25:15 | 002,309,120 | R--- | M] (Xerox Corporation) -- C:\Programme\xerox\Scan_Utility\xrxzipui.exe
PRC - [2008.12.16 20:03:22 | 000,095,744 | R--- | M] () -- C:\WINDOWS\system32\xGOAKbgnd.exe
PRC - [2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.07.25 12:46:22 | 000,098,304 | ---- | M] (Intel) -- C:\Programme\Intel\AMT\LMS.exe
PRC - [2005.05.27 11:24:52 | 000,310,272 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe
PRC - [2003.06.19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE


========== Modules (No Company Name) ==========

MOD - [2013.01.23 14:18:17 | 000,365,568 | ---- | M] () -- C:\Dokumente und Einstellungen\MBuehler\Desktop\gmer-2.0.18444.exe
MOD - [2013.01.10 17:08:44 | 012,621,824 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Theme\ac8efe59a037ffeb38513bdea352da28\Kies.Theme.ni.dll
MOD - [2013.01.10 17:08:43 | 000,608,768 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\DevicePodcast\0db48c71e3b8468f1ce057d9d31d79b5\DevicePodcast.ni.dll
MOD - [2013.01.10 17:08:41 | 000,293,888 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\DeviceVideo\6305a413f9855fae0d8e42321cc9b96c\DeviceVideo.ni.dll
MOD - [2013.01.10 17:08:40 | 000,371,712 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\DevicePhoto\a97aafceb0f5beb615417aa1123db4c9\DevicePhoto.ni.dll
MOD - [2013.01.10 17:08:39 | 000,471,040 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\VideoManager\d818a0562e80f3b40608f2b3a80ea854\VideoManager.ni.dll
MOD - [2013.01.10 17:08:39 | 000,303,104 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\DeviceMusic\2627837c5c63eec62c462c9749cca36c\DeviceMusic.ni.dll
MOD - [2013.01.10 17:08:37 | 001,491,968 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PodcastService\5940fe91edc04566cf597cbc8eea770c\PodcastService.ni.dll
MOD - [2013.01.10 17:08:36 | 000,621,568 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PhotoManager\38bbb92c9f480e35af0d127e71de6605\PhotoManager.ni.dll
MOD - [2013.01.10 17:08:34 | 001,114,624 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Podcaster\bda3cea1f0a89311e1433f2f1ec3aea8\Podcaster.ni.dll
MOD - [2013.01.10 17:08:15 | 000,036,864 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\0a9aa8a20cf2f935e03e948e5fe7a476\Kies.Common.DeviceServiceLib.FirmwareUpdate.Firmw areUpdateAgentHelper.ni.dll
MOD - [2013.01.10 17:08:13 | 006,242,304 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\DeviceHost\f92fd9afd82cc7881eb688495f21682f\DeviceHost.ni.dll
MOD - [2013.01.10 17:07:59 | 001,879,040 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Phonebook\b663e0c3830ce275aa2f991e5e31566b\Phonebook.ni.dll
MOD - [2013.01.10 17:07:51 | 001,008,640 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\CPKTMusicPlugin\000e793ee28448952d65a4d3187b8d1c\CPKTMusicPlugin.ni.dll
MOD - [2013.01.10 17:07:46 | 000,941,568 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\MusicManager\89abac0136eb0e6d40dc888691494014\MusicManager.ni.dll
MOD - [2013.01.10 17:07:45 | 000,396,800 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\BATPlugin\81ca8f5fd5566c0c27bab98005f516cf\BATPlugin.ni.dll
MOD - [2013.01.10 17:07:40 | 000,029,184 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.StoreMa#\34da4bec626fd6331c6702365be50f28\Kies.Common.StoreManager.ni.dll
MOD - [2013.01.10 17:07:39 | 000,507,392 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.MediaDB\72efa72431de7c2d9506ad9d1cd4f029\Kies.Common.MediaDB.ni.dll
MOD - [2013.01.10 17:07:38 | 000,232,960 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\ASF_cSharpAPI\779a065e9d217d3a3aeeb354f9fce387\ASF_cSharpAPI.ni.dll
MOD - [2013.01.10 17:07:38 | 000,064,000 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.AllShare\9346d089b702dbd0c8c8dce673ecacc8\Kies.Common.AllShare.ni.dll
MOD - [2013.01.10 17:07:37 | 000,283,136 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\1dbec2edbb5ffa6cfdfec3fdb3a234fa\Kies.Common.DeviceServiceLib.FirmwareUpdate.Commo n.ni.dll
MOD - [2013.01.10 17:07:36 | 000,189,440 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\7504b4d1e0c4f84827a869844fa75ffd\Kies.Common.DeviceServiceLib.FirmwareUpdate.Downl oader.ni.dll
MOD - [2013.01.10 17:07:36 | 000,175,616 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Interop.DevFileServ#\9a9a70b72df9ca4a018ffeb43208fac0\Interop.DevFileServiceLib.ni.dll
MOD - [2013.01.10 17:07:35 | 000,569,856 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\03cacceef5569588b39c92af8352faaa\Kies.Common.DeviceServiceLib.FileService.ni.dll
MOD - [2013.01.10 17:07:34 | 000,621,056 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\3a6caad5fa7775417d33b3d9d8683e23\Kies.Common.DeviceServiceLib.DeviceDataService.ni .dll
MOD - [2013.01.10 17:07:31 | 000,915,456 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\e9cac4c5136a235afeeacd26312ba1ab\Kies.Common.DeviceServiceLib.DeviceManagement.ni. dll
MOD - [2013.01.10 17:07:31 | 000,184,832 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\c35f66934441c52d7c6f60347751059f\Kies.Common.DeviceServiceLib.Interface.ni.dll
MOD - [2013.01.10 17:07:29 | 001,057,280 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\d412755da5e9841c365fc57dfbbda3c0\Kies.Common.DeviceService.ni.dll
MOD - [2013.01.10 17:07:27 | 000,032,256 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Interop.OGGFileInfo#\b2c7788a3e89dfe8758d6184bac1b663\Interop.OGGFileInfoCOMLib.ni.dll
MOD - [2013.01.10 17:07:26 | 000,171,520 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Interop.P3MPINTERFA#\111be4cc197cabb6340170eeb54ae535\Interop.P3MPINTERFACECTRLLib.ni.dll
MOD - [2013.01.10 17:07:26 | 000,052,224 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Interop.MP3FileInfo#\5f0b67eb5313c092d5b8b56426dd30e2\Interop.MP3FileInfoCOMLib.ni.dll
MOD - [2013.01.10 17:07:26 | 000,030,720 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Interop.PRPLAYERCOR#\0e99d29839b75154cac69d87c6857da7\Interop.PRPLAYERCORELib.ni.dll
MOD - [2013.01.10 17:07:23 | 002,196,992 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.Multime#\faf32168cfd1b422788bdff9332d1b0a\Kies.Common.Multimedia.ni.dll
MOD - [2013.01.10 17:07:19 | 000,200,704 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.MainUI\207f9e336015968fcd0441a7dde3c4b9\Kies.Common.MainUI.ni.dll
MOD - [2013.01.10 17:07:17 | 000,395,776 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\CabLib\af22e5bb6307e2882abe5fbdb3c00c8e\CabLib.ni.dll
MOD - [2013.01.10 17:07:17 | 000,066,560 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.DBManag#\39cdecd22058226927384b95c2cb4941\Kies.Common.DBManager.ni.dll
MOD - [2013.01.10 17:07:12 | 000,743,424 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\ICSharpCode.SharpZi#\78c73ae3f99d95d788e3690a561a7701\ICSharpCode.SharpZipLib.ni.dll
MOD - [2013.01.10 17:07:11 | 000,273,408 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Common.Util\3c5a77dc69c3c37416b25930f940ed98\Kies.Common.Util.ni.dll
MOD - [2013.01.10 17:07:10 | 000,052,224 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Interop.DeviceSearc#\4f4243b3bc2e4cdf0ec6e7ad5559aa20\Interop.DeviceSearchLib.ni.dll
MOD - [2013.01.10 17:07:09 | 001,499,136 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Locale\570e33cc3bc3f82ffc64c06efd1e90d6\Kies.Locale.ni.dll
MOD - [2013.01.10 17:07:09 | 000,078,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.MVVM\495e94c8e04436b65dcb695c969d0d4e\Kies.MVVM.ni.dll
MOD - [2013.01.10 17:07:08 | 001,874,944 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.UI\5286148f11659dda7d85336dccc7e52f\Kies.UI.ni.dll
MOD - [2013.01.10 17:07:03 | 000,119,296 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\GongSolutions.Wpf.D#\6a27c70ba8a92f6625caec0e6bab1cb4\GongSolutions.Wpf.DragDrop.ni.dll
MOD - [2013.01.10 17:07:00 | 001,211,392 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies.Interface\27da96bdaf851b82eb91b24a5e08c37a\Kies.Interface.ni.dll
MOD - [2013.01.10 17:06:29 | 000,221,696 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\0cefa2c17df1d033e69ed47b0b660ce5\System.ServiceProcess.ni.dll
MOD - [2013.01.10 17:06:01 | 000,771,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\1818a0dcd8e00ef24981eb52acf3f6bd\System.Runtime.Remoting.ni.dll
MOD - [2013.01.10 17:05:51 | 001,812,480 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\25732130189e8f468a7d98647edffe8e\System.Xaml.ni.dll
MOD - [2013.01.10 17:05:48 | 001,691,648 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Kies\2f399be40dc308c089850fd5241dc7e1\Kies.ni.exe
MOD - [2013.01.10 13:21:08 | 018,019,328 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\7de7ccd4d0e5a6fda2187aff3d5c4ee8\PresentationFramework.ni.dll
MOD - [2013.01.10 13:20:47 | 011,522,560 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationCore\608b2aa3ab5dfc3986285304a95a6dbf\PresentationCore.ni.dll
MOD - [2013.01.10 13:20:33 | 003,880,960 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\WindowsBase\639dacb8fc8d07719bdb5742940b4c33\WindowsBase.ni.dll
MOD - [2013.01.10 13:19:08 | 000,980,480 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\947b4fe468a1a03516ee26d9b3f4240a\System.Configuration.ni.dll
MOD - [2013.01.10 13:19:05 | 005,618,176 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\a23c39d504467a0024e5f20c0f962f3f\System.Xml.ni.dll
MOD - [2013.01.10 13:18:59 | 007,053,824 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\e773b94cc3f3fc25509904acb76cfe08\System.Core.ni.dll
MOD - [2013.01.10 13:18:47 | 009,094,656 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\5f79b00e1aaeafcc07907aa61fd3599e\System.ni.dll
MOD - [2013.01.10 13:18:37 | 014,416,896 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\6a1ccc1e1a79ce267d3d1808af382cd6\mscorlib.ni.dll
MOD - [2012.11.13 14:06:32 | 000,158,624 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\snlFileFormats150.bpl
MOD - [2012.11.13 14:06:30 | 000,108,960 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\snlThirdParty150.bpl
MOD - [2012.11.13 14:06:28 | 000,554,400 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl
MOD - [2012.11.13 14:06:28 | 000,528,288 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\JSDialogPack150.bpl
MOD - [2012.11.13 14:06:28 | 000,416,160 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\DEC150.bpl
MOD - [2012.08.23 09:38:24 | 000,574,840 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\sqlite3.dll
MOD - [2010.07.04 22:32:36 | 000,004,608 | ---- | M] () -- C:\Programme\Unlocker\UnlockerHook.dll
MOD - [2010.07.04 20:51:26 | 000,017,408 | ---- | M] () -- C:\Programme\Unlocker\UnlockerAssistant.exe
MOD - [2008.12.16 20:03:22 | 000,095,744 | R--- | M] () -- C:\WINDOWS\system32\xGOAKbgnd.exe
MOD - [2008.09.04 12:30:35 | 000,286,720 | R--- | M] () -- C:\WINDOWS\system32\xiputil.dll
MOD - [2008.09.04 12:30:33 | 000,364,544 | R--- | M] () -- C:\WINDOWS\system32\xipinterp.dll
MOD - [2008.09.04 12:30:32 | 000,155,648 | R--- | M] () -- C:\WINDOWS\system32\xesup.dll
MOD - [2008.09.04 12:30:29 | 001,388,544 | R--- | M] () -- C:\WINDOWS\system32\xeext.dll
MOD - [2005.01.06 18:33:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\redmonnt.dll


========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Programme\Spybot -- (SDWSCService)
SRV - File not found [Auto | Running] -- C:\Programme\Spybot -- (SDUpdateService)
SRV - File not found [Auto | Running] -- C:\Programme\Spybot -- (SDScannerService)
SRV - File not found [On_Demand | Stopped] -- C:\Programme\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2012.09.12 16:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012.05.25 10:45:34 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2009.01.07 18:20:28 | 000,026,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\system32\spupdsvc.exe -- (spupdsvc)
SRV - [2007.04.11 12:50:19 | 000,077,944 | ---- | M] (Autodesk) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe -- (Autodesk Licensing Service)
SRV - [2006.08.12 06:51:40 | 000,902,760 | ---- | M] (Autodesk, Inc.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskNetSrv.exe -- (Autodesk Network Licensing Service)
SRV - [2006.07.25 12:46:22 | 000,098,304 | ---- | M] (Intel) [Auto | Running] -- C:\Programme\Intel\AMT\LMS.exe -- (LMS)
SRV - [2005.11.14 00:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2003.07.28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2003.06.19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\DOKUME~1\MBuehler\LOKALE~1\Temp\pwtdrpog.sys -- (pwtdrpog)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2013.01.23 13:47:33 | 000,097,440 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\SMR311.SYS -- (SMR311)
DRV - [2013.01.23 10:29:01 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2013.01.23 08:23:38 | 000,013,560 | ---- | M] (GFI Software) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\gfibto.sys -- (gfibto)
DRV - [2012.09.20 05:35:36 | 000,181,344 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssudmdm.sys -- (ssudmdm)
DRV - [2012.09.20 05:35:36 | 000,083,168 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssudbus.sys -- (dg_ssudbus)
DRV - [2010.07.04 20:51:26 | 000,004,096 | ---- | M] () [Kernel | Unavailable | Unknown] -- C:\Programme\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)
DRV - [2010.06.21 23:07:39 | 000,091,496 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvhda32.sys -- (NVHDA)
DRV - [2006.11.30 13:58:42 | 000,090,800 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se44unic.sys -- (se44unic)
DRV - [2006.11.30 13:58:34 | 000,086,432 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se44obex.sys -- (se44obex)
DRV - [2006.11.30 13:58:32 | 000,018,704 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se44nd5.sys -- (se44nd5)
DRV - [2006.11.30 13:58:30 | 000,088,624 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se44mgmt.sys -- (se44mgmt)
DRV - [2006.11.30 13:58:26 | 000,097,088 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se44mdm.sys -- (se44mdm)
DRV - [2006.11.30 13:58:24 | 000,009,360 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se44mdfl.sys -- (se44mdfl)
DRV - [2006.11.30 13:58:18 | 000,061,536 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se44bus.sys -- (se44bus)
DRV - [2006.07.25 12:46:24 | 000,043,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HECI.sys -- (HECI)
DRV - [2006.07.04 18:29:18 | 004,306,944 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService)
DRV - [2006.06.05 03:39:56 | 000,024,064 | ---- | M] (Intel Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\iqvw32.sys -- (NAL)
DRV - [2006.05.07 06:30:00 | 000,090,688 | ---- | M] (SafeNet, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\sentinel.sys -- (Sentinel)
DRV - [2006.04.25 17:26:08 | 000,036,608 | ---- | M] (Infineon Technologies AG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ifxtpm.sys -- (IFXTPM)
DRV - [2004.08.03 17:29:50 | 000,019,455 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wVchNTxx.sys -- (iAimFP4)
DRV - [2004.08.03 17:29:48 | 000,012,063 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wSiINTxx.sys -- (iAimFP3)
DRV - [2004.08.03 17:29:46 | 000,025,471 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV10nt.sys -- (iAimTV5)
DRV - [2004.08.03 17:29:46 | 000,023,615 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wCh7xxNT.sys -- (iAimTV4)
DRV - [2004.08.03 17:29:46 | 000,022,271 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV06nt.sys -- (iAimTV6)
DRV - [2004.08.03 17:29:44 | 000,033,599 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV04nt.sys -- (iAimTV3)
DRV - [2004.08.03 17:29:44 | 000,019,551 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV02NT.sys -- (iAimTV1)
DRV - [2004.08.03 17:29:42 | 000,029,311 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV01nt.sys -- (iAimTV0)
DRV - [2004.08.03 17:29:42 | 000,011,871 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV09NT.sys -- (iAimFP7)
DRV - [2004.08.03 17:29:40 | 000,011,807 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV07nt.sys -- (iAimFP5)
DRV - [2004.08.03 17:29:40 | 000,011,295 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV08NT.sys -- (iAimFP6)
DRV - [2004.08.03 17:29:38 | 000,161,020 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\i81xnt5.sys -- (i81x)
DRV - [2004.08.03 17:29:38 | 000,012,415 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV01nt.sys -- (iAimFP0)
DRV - [2004.08.03 17:29:38 | 000,012,127 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV02NT.sys -- (iAimFP1)
DRV - [2004.08.03 17:29:38 | 000,011,775 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV05NT.sys -- (iAimFP2)
DRV - [2004.07.14 11:54:42 | 000,676,864 | ---- | M] (Aladdin Knowledge Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock)
DRV - [2002.04.04 06:32:06 | 000,028,416 | R--- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\symmpi.sys -- (Symmpi)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\..\SearchScopes,DefaultScope = {89055512-301C-43F5-B9E1-22F1A88EDB47}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{89055512-301C-43F5-B9E1-22F1A88EDB47}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/DownloadManager,version=1.1: C:\WINDOWS\ [2013.01.23 13:57:40 | 000,000,000 | ---D | M]
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2013.01.23 08:23:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2013.01.23 11:45:10 | 000,000,000 | ---D | M]

[2012.07.09 07:13:07 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\MBuehler\Anwendungsdaten\Mozilla\Extensions
[2013.01.23 08:23:15 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\MBuehler\Anwendungsdaten\Mozilla\Firefox\Profiles\ez107xpz.default\extensions
[2013.01.23 08:23:15 | 000,000,000 | ---D | M] (Lavasoft Search Plugin) -- C:\Dokumente und Einstellungen\MBuehler\Anwendungsdaten\Mozilla\Firefox\Profiles\ez107xpz.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
[2012.09.27 10:16:04 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.05.25 10:45:35 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2011.02.21 19:54:16 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2012.03.21 20:45:12 | 000,258,560 | ---- | M] (Dassault Systèmes SolidWorks Corp.) -- C:\Programme\mozilla firefox\plugins\npEModelPlugin.dll
[2012.05.25 10:45:32 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.05.25 10:45:32 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.05.25 10:45:32 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.05.25 10:45:32 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.05.25 10:45:32 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.05.25 10:45:32 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2006.02.28 03:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [MSC] c:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SDTray] C:\Programme\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [SetRefresh] C:\Programme\Compaq\SetRefresh\SetRefresh.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Programme\Unlocker\UnlockerAssistant.exe ()
O4 - HKLM..\Run: [XeroxEndeavorBackgroundTask] C:\WINDOWS\System32\xGOAKbgnd.exe ()
O4 - HKLM..\Run: [XeroxScanUtility] C:\Programme\Xerox\Scan_Utility\xrxzipui.exe (Xerox Corporation)
O4 - HKCU..\Run: [KiesAirMessage] C:\Programme\Samsung\Kies\KiesAirMessage.exe (Samsung Electronics)
O4 - HKCU..\Run: [KiesPreload] C:\Programme\Samsung\Kies\Kies.exe (Samsung)
O4 - HKCU..\Run: [Spybot-S&D Cleaning] C:\Programme\Spybot - Search & Destroy 2\SDCleaner.exe (Safer-Networking Ltd.)
O4 - HKCU..\RunOnce: [*NPE[1]] C:\Dokumente und Einstellungen\MBuehler\Lokale Einstellungen\Temporary Internet Files\Content.IE5\FWW14PV0\NPE[1].exe (Symantec Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\AutoCAD-Startbeschleuniger.lnk = C:\Programme\Gemeinsame Dateien\Autodesk Shared\acstart17.exe (Autodesk, Inc)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1341422160289 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1341422208754 (MUWebControl Class)
O16 - DPF: {B479199A-1242-4E3C-AD81-7F0DF801B4AE} hxxp://download.microsoft.com/download/C/9/C/C9C3D86D-84AC-4AF0-8584-842756A66467/MicrosoftDownloadManager.cab (Microsoft Download Manager ActiveX control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 192.168.0.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = IBBuehler.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{479EDB95-9AFA-4B81-A36D-C95A08B1796F}: DhcpNameServer = 192.168.0.1 192.168.0.2
O18 - Protocol\Handler\brx {9C160F90-74D1-11D3-AB60-0060977C1F29} - C:\Programme\Bricsys\Bricscad V10\BrxProtIE.dll (BricsCad)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.04.30 17:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013.01.23 14:15:01 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\MBuehler\Desktop\OTL.exe
[2013.01.23 13:47:33 | 000,097,440 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SMR311.SYS
[2013.01.23 13:47:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\MBuehler\Lokale Einstellungen\Anwendungsdaten\NPE
[2013.01.23 13:47:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton
[2013.01.23 11:40:13 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\MBuehler\Recent
[2013.01.23 11:39:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\CCleaner
[2013.01.23 11:02:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\MBuehler\Eigene Dateien\ProcAlyzer Dumps
[2013.01.23 10:33:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
[2013.01.23 10:33:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Spybot - Search & Destroy 2
[2013.01.23 10:32:51 | 000,015,224 | ---- | C] (Safer Networking Limited) -- C:\WINDOWS\System32\sdnclean.exe
[2013.01.23 10:32:32 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy 2
[2013.01.23 10:29:01 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2013.01.23 09:19:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\MBuehler\Anwendungsdaten\Malwarebytes
[2013.01.23 09:19:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2013.01.23 08:28:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\MBuehler\Anwendungsdaten\LavasoftStatistics
[2013.01.23 08:23:39 | 000,044,424 | ---- | C] (GFI Software) -- C:\WINDOWS\System32\sbbd.exe
[2013.01.23 08:23:39 | 000,013,560 | ---- | C] (GFI Software) -- C:\WINDOWS\System32\drivers\gfibto.sys
[2013.01.23 08:23:15 | 000,000,000 | ---D | C] -- C:\Programme\Toolbar Cleaner
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013.01.23 14:18:17 | 000,365,568 | ---- | M] () -- C:\Dokumente und Einstellungen\MBuehler\Desktop\gmer-2.0.18444.exe
[2013.01.23 14:15:04 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\MBuehler\Desktop\OTL.exe
[2013.01.23 13:57:26 | 000,000,245 | ---- | M] () -- C:\boot.ini
[2013.01.23 13:55:50 | 000,000,370 | ---- | M] () -- C:\WINDOWS\System32\drivers\SMR311.dat
[2013.01.23 13:49:19 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013.01.23 13:49:09 | 000,000,612 | ---- | M] () -- C:\WINDOWS\tasks\Check for updates (Spybot - Search & Destroy).job
[2013.01.23 13:48:57 | 000,000,308 | ---- | M] () -- C:\WINDOWS\tasks\enem.job
[2013.01.23 13:48:50 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013.01.23 13:47:33 | 000,097,440 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SMR311.SYS
[2013.01.23 12:22:35 | 128,374,706 | ---- | M] () -- C:\Dokumente und Einstellungen\MBuehler\Desktop\aaa_aaa.reg
[2013.01.23 11:50:56 | 000,530,882 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2013.01.23 11:50:56 | 000,505,302 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013.01.23 11:50:56 | 000,106,362 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2013.01.23 11:50:56 | 000,088,766 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013.01.23 11:39:09 | 000,000,660 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk
[2013.01.23 11:36:38 | 000,002,407 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2013.01.23 10:33:20 | 000,000,608 | ---- | M] () -- C:\WINDOWS\tasks\Refresh immunization (Spybot - Search & Destroy).job
[2013.01.23 10:33:10 | 000,001,806 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Spybot-S&D Start Center.lnk
[2013.01.23 10:29:01 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2013.01.23 08:23:38 | 000,044,424 | ---- | M] (GFI Software) -- C:\WINDOWS\System32\sbbd.exe
[2013.01.23 08:23:38 | 000,013,560 | ---- | M] (GFI Software) -- C:\WINDOWS\System32\drivers\gfibto.sys
[2013.01.22 17:30:12 | 000,126,976 | RHS- | M] () -- C:\WINDOWS\System32\newdev7.dll
[2013.01.22 16:40:12 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2013.01.21 08:26:25 | 000,897,653 | ---- | M] () -- C:\Dokumente und Einstellungen\MBuehler\Desktop\21082606.zip
[2013.01.17 17:12:09 | 000,090,259 | ---- | M] () -- C:\Dokumente und Einstellungen\MBuehler\Desktop\Drossel.pdf
[2013.01.17 12:17:00 | 000,002,537 | ---- | M] () -- C:\Dokumente und Einstellungen\MBuehler\Desktop\Microsoft Office Excel 2003.lnk
[2013.01.17 09:29:54 | 000,027,594 | ---- | M] () -- C:\Dokumente und Einstellungen\MBuehler\tab.ini
[2013.01.16 15:36:45 | 000,000,049 | ---- | M] () -- C:\WINDOWS\VDI3805.INI
[2013.01.15 06:22:00 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013.01.09 15:53:38 | 000,291,202 | ---- | M] () -- C:\Dokumente und Einstellungen\MBuehler\Desktop\sdds4.intermaps.com.pdf
[2013.01.08 09:47:05 | 000,416,378 | ---- | M] () -- C:\Dokumente und Einstellungen\MBuehler\Desktop\Skizzen Sockel und Dachdurchführungen.pdf
[2013.01.06 06:33:34 | 006,009,856 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2012.12.24 22:41:05 | 000,365,712 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013.01.23 14:17:45 | 000,365,568 | ---- | C] () -- C:\Dokumente und Einstellungen\MBuehler\Desktop\gmer-2.0.18444.exe
[2013.01.23 13:55:48 | 000,000,370 | ---- | C] () -- C:\WINDOWS\System32\drivers\SMR311.dat
[2013.01.23 12:22:25 | 128,374,706 | ---- | C] () -- C:\Dokumente und Einstellungen\MBuehler\Desktop\aaa_aaa.reg
[2013.01.23 11:39:09 | 000,000,660 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk
[2013.01.23 10:57:19 | 000,002,407 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2013.01.23 10:33:19 | 000,000,612 | ---- | C] () -- C:\WINDOWS\tasks\Check for updates (Spybot - Search & Destroy).job
[2013.01.23 10:33:19 | 000,000,608 | ---- | C] () -- C:\WINDOWS\tasks\Refresh immunization (Spybot - Search & Destroy).job
[2013.01.23 10:33:10 | 000,001,812 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Spybot-S&D Start Center.lnk
[2013.01.23 10:33:10 | 000,001,806 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Spybot-S&D Start Center.lnk
[2013.01.22 17:30:12 | 000,126,976 | RHS- | C] () -- C:\WINDOWS\System32\newdev7.dll
[2013.01.22 17:30:12 | 000,000,308 | ---- | C] () -- C:\WINDOWS\tasks\enem.job
[2013.01.21 08:26:23 | 000,897,653 | ---- | C] () -- C:\Dokumente und Einstellungen\MBuehler\Desktop\21082606.zip
[2013.01.17 17:11:58 | 000,090,259 | ---- | C] () -- C:\Dokumente und Einstellungen\MBuehler\Desktop\Drossel.pdf
[2013.01.17 09:29:54 | 000,027,594 | ---- | C] () -- C:\Dokumente und Einstellungen\MBuehler\tab.ini
[2013.01.16 15:36:45 | 000,000,049 | ---- | C] () -- C:\WINDOWS\VDI3805.INI
[2013.01.09 15:49:40 | 000,291,202 | ---- | C] () -- C:\Dokumente und Einstellungen\MBuehler\Desktop\sdds4.intermaps.com.pdf
[2013.01.08 09:47:05 | 000,416,378 | ---- | C] () -- C:\Dokumente und Einstellungen\MBuehler\Desktop\Skizzen Sockel und Dachdurchführungen.pdf
[2012.12.13 14:12:52 | 000,690,038 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-2762484156-1379572731-2174639338-1137-0.dat
[2012.12.13 14:12:51 | 000,329,494 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2012.11.12 14:38:11 | 000,197,294 | ---- | C] () -- C:\Dokumente und Einstellungen\MBuehler\Unbekannt.~ko
[2012.11.12 14:23:11 | 000,196,037 | ---- | C] () -- C:\Dokumente und Einstellungen\MBuehler\Unbekannt.kko
[2012.10.29 12:09:28 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll
[2012.10.29 12:09:28 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2012.10.29 12:09:28 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2012.10.29 12:09:28 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll
[2012.10.29 12:09:28 | 000,030,568 | ---- | C] () -- C:\WINDOWS\MusiccityDownload.exe
[2012.07.28 14:51:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Vitodesk Browser.INI
[2012.07.13 11:37:03 | 000,000,126 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft.SqlServer.Compact.351.32.bc
[2012.07.03 17:21:07 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.04.24 11:53:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\eDrawingOfficeAutomator.INI
[2011.07.29 06:45:12 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2011.05.13 06:36:33 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.02.21 20:37:29 | 000,434,176 | R--- | C] () -- C:\WINDOWS\System32\xipxmlsec.dll
[2011.02.21 20:37:29 | 000,167,936 | R--- | C] () -- C:\WINDOWS\System32\xrx_xslt.dll
[2011.02.21 20:37:29 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\xrx_exslt.dll
[2011.02.21 20:37:29 | 000,008,192 | R--- | C] () -- C:\WINDOWS\System32\xiplibxml.dll
[2011.02.21 20:37:28 | 003,104,768 | R--- | C] () -- C:\WINDOWS\System32\xeng.dll
[2011.02.21 20:37:28 | 001,388,544 | R--- | C] () -- C:\WINDOWS\System32\xeext.dll
[2011.02.21 20:37:28 | 000,909,312 | R--- | C] () -- C:\WINDOWS\System32\xrx_xml2.dll
[2011.02.21 20:37:28 | 000,364,544 | R--- | C] () -- C:\WINDOWS\System32\xipinterp.dll
[2011.02.21 20:37:28 | 000,286,720 | R--- | C] () -- C:\WINDOWS\System32\xiputil.dll
[2011.02.21 20:37:28 | 000,225,280 | R--- | C] () -- C:\WINDOWS\System32\documentio.dll
[2011.02.21 20:37:28 | 000,188,416 | R--- | C] () -- C:\WINDOWS\System32\xipsup.dll
[2011.02.21 20:37:28 | 000,167,936 | R--- | C] () -- C:\WINDOWS\System32\lcms.dll
[2011.02.21 20:37:28 | 000,155,648 | R--- | C] () -- C:\WINDOWS\System32\xi.dll
[2011.02.21 20:37:28 | 000,155,648 | R--- | C] () -- C:\WINDOWS\System32\xesup.dll
[2011.02.21 20:37:28 | 000,025,088 | R--- | C] () -- C:\WINDOWS\System32\xipxml.dll
[2011.02.21 20:37:27 | 000,831,488 | R--- | C] () -- C:\WINDOWS\System32\xlibeay.dll
[2011.02.21 20:37:27 | 000,095,744 | R--- | C] () -- C:\WINDOWS\System32\xGOAKbgnd.exe
[2011.02.21 20:37:27 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\diotifffx.dll
[2011.02.21 19:08:31 | 000,000,017 | ---- | C] () -- C:\WINDOWS\System32\nvModes.dat
[2011.02.21 19:02:32 | 000,232,968 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2011.02.21 19:02:29 | 000,232,968 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2011.02.21 19:02:29 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2011.02.21 17:18:51 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2007.09.07 08:17:59 | 000,000,080 | ---- | C] () -- C:\Programme\Gemeinsame Dateien\Commonfiles.REG
[2007.09.06 11:14:41 | 000,024,576 | ---- | C] () -- C:\Programme\Gemeinsame Dateien\liNearInstallGuard.exe
[2007.03.14 16:01:27 | 000,001,751 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache
[2007.03.14 15:37:53 | 000,000,141 | ---- | C] () -- C:\Dokumente und Einstellungen\MBuehler\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2007.03.14 14:01:07 | 000,003,032 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\ntuser.pol

========== ZeroAccess Check ==========

[2007.02.07 20:12:13 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2010.12.20 23:14:52 | 001,510,400 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 11:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 03:22:32 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

GMER:
GMER 2.0.18444 - hxxp://www.gmer.net
Rootkit scan 2013-01-23 17:21:38
Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-12 WDC_WD800JD-60LSA5 rev.10.01E03 74,53GB
Running: gmer-2.0.18444.exe; Driver: C:\DOKUME~1\MBuehler\LOKALE~1\Temp\pwtdrpog.sys


---- Kernel code sections - GMER 2.0 ----

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB6A093A0, 0x5A0025, 0xE8000020]
.text C:\WINDOWS\system32\drivers\hardlock.sys section is writeable [0xB3B39400, 0x82482, 0xE8000020]
.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xB3BD9420] C:\WINDOWS\system32\drivers\hardlock.sys entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xB3BD9420]
.protectÿÿÿÿhardlockunknown last code section [0xB3BD9200, 0x5105, 0xE0000020] C:\WINDOWS\system32\drivers\hardlock.sys unknown last code section [0xB3BD9200, 0x5105, 0xE0000020]

---- User code sections - GMER 2.0 ----

.text C:\WINDOWS\Explorer.EXE[628] SHELL32.dll!SHFileOperationW 7E720984 5 Bytes JMP 10001102 C:\Programme\Unlocker\UnlockerHook.dll

---- Files - GMER 2.0 ----

File C:\Dokumente und Einstellungen\MBuehler\Lokale Einstellungen\Temporary Internet Files\Content.IE5\BMDK7YWH\clients[1].txt 0 bytes

---- EOF - GMER 2.0 ----