Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Windows XP startet auch nicht im abgesichtern Modus

Windows XP startet auch nicht im abgesichtern Modus


Log-Analyse und Auswertung: Windows XP startet auch nicht im abgesichtern Modus

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 29.01.2013, 19:04   #1
paulibins
 
Windows XP startet auch nicht im abgesichtern Modus - Standard

Windows XP startet auch nicht im abgesichtern Modus


Guten Abend
ich habe mich hier angemeldet, weil Windows XP nicht mehr startet *auch nicht im abesicherten Modus. Gestern ging noch alles, es kam beimSzstemstart nur so eine komische Aufforderung ingendetwas upzudaten, die ich weggeklickt habe. Ich bin nach Euren Vorschlaegen vorgegangen und habbe die div. Scans gemacht. Das Malwareprogramm laeuft allerdings nicht: es bricht mit einer Fehlermeldung ab:Fehler acces is denied.Ich versuche die logs otl.txt, extras.txt und defrogger einzubinden. Bitte habt Nachsicht mit mir, denn ich bin kein grosser Kenner der Materie und auch schon etwas angejahrt
Danke fuer Eure Hilfe

Gruss Christian
Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:44 on 29/01/2013 (%username%)

Checking for autostart values...
HKCU\~\Run values retrieved.
Unable to open HKLM\~\Run key (2)
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
Code:
ATTFilter
OTL Extras logfile created on: 1/29/2013 4:36:34 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 82.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): C:\pagefile.sys 3070 3070 [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Programme
Drive D: | 135.01 Gb Total Space | 109.44 Gb Free Space | 81.06% Space Free | Partition Type: NTFS
Drive E: | 410.15 Gb Total Space | 311.89 Gb Free Space | 76.04% Space Free | Partition Type: NTFS
Drive F: | 404.17 Gb Total Space | 273.50 Gb Free Space | 67.67% Space Free | Partition Type: NTFS
Drive G: | 99.96 Gb Total Space | 81.88 Gb Free Space | 81.91% Space Free | Partition Type: NTFS
Drive H: | 100.73 Gb Total Space | 35.54 Gb Free Space | 35.28% Space Free | Partition Type: NTFS
Drive I: | 130.07 Gb Total Space | 26.45 Gb Free Space | 20.34% Space Free | Partition Type: NTFS
Drive K: | 31.23 Gb Total Space | 31.18 Gb Free Space | 99.84% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet005
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- D:\MOZILLA\MOZILL~2\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1"
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Programme\Internet Explorer\iexplore.exe" -nohome
htmlfile [opennew] -- "C:\Programme\Internet Explorer\iexplore.exe" %1
http [open] -- D:\MOZILLA\MOZILL~2\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1"
https [open] -- D:\MOZILLA\MOZILL~2\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1"
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1"
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1"
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Programme\Internet Explorer\iexplore.exe" %1
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Programme\Internet Explorer\iexplore.exe"
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\System32\ZoneLabs\vsmon.exe" = C:\WINDOWS\System32\ZoneLabs\vsmon.exe:*:Enabled:TrueVector Service -- (Zone Labs, LLC)
"C:\Programme\Sony Ericsson\Update Service\ma3platform.exe" = C:\Programme\Sony Ericsson\Update Service\ma3platform.exe:*:Enabled:ma3platform
"C:\WINDOWS\System32\dpvsetup.exe" = C:\WINDOWS\System32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"D:\Programme\Active sync\wcescomm.exe" = D:\Programme\Active sync\wcescomm.exe:*:Enabled:ActiveSync Connection Manager
"C:\WINDOWS\Temp\KD_installer.exe" = C:\WINDOWS\Temp\KD_installer.exe:*:Enabled:Kabel Deutschland Installer -- (mquadr.at software engineering, hxxp://www.mquadr.at)
"C:\Programme\VideoLAN\VLC\vlc.exe" = C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player
"D:\Mozilla\Mozilla Firefox(2)\Mozilla Firefox\firefox.exe" = D:\Mozilla\Mozilla Firefox(2)\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03A70F27-D80E-4A22-A1B4-1C878FC6056A}" = Sony Ericsson Mobile Networking Wizard
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{123D40B5-66EF-4F41-A2BA-0B74D0D1C8B3}" = Steuer 2006
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1E04F83B-2AB9-4301-9EF7-E86307F79C72}" = Google Earth
"{1E5007FA-DA5E-4EDD-BDE5-14D128D66887}" = PowerQuest PartitionMagic 7.0
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{238B8820-011B-11D6-9C28-0080C85A0C2D}" = Transparency Adaptor Calibrator
"{2C4A5877-21D1-4A15-9D20-24BA54A24093}" = Playlist tool
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer
"{345C90FB-FA10-11D5-9C2A-0080C85A0C2D}" = ABBYY FineReader OCR Engine
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3A33D692-8679-4142-94C7-0BB784B9B3A3}" = DMX 6fire 24/96 ControlPanel
"{3B7458C7-3F03-4415-AC39-D51EDEACDCCC}" = Steuer 2007
"{4BC211DD-2BBC-4CDF-AB43-3B93444617E0}" = Steuer 2006
"{4D400407-6332-4101-8C78-506C85813506}" = Sony Ericsson OCS
"{53480520-7555-470E-8C69-750B0472B4BB}" = O&O Defrag Professional Edition
"{544FB392-069D-4BA5-9DC7-FFD47230AEE5}" = Photohands 1.0G
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{59C95D15-5F24-435E-898D-3806961FC79D}" = Steuer 2006
"{5E8C42DD-7E43-462C-84CC-99E5BBE3E101}" = Steuer 2007
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{70B45586-B51E-4947-A258-A895596C5CED}" = Photo Loader 2.3G
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{757AD3D4-036B-42FA-B0A4-96BD6F4605A0}" = Ulead VideoStudio 7 SE DVD
"{7AA828F3-BD67-495E-9742-BD9C3F196E78}" = PC Suite
"{81A60A13-224D-4637-8203-3EAC03B121A4}" = Maxtor*MaxBlast
"{8FBC9407-713D-4B8A-98D2-57210DA56049}" = MSN Toolbar
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9075FCA2-7B7E-46A3-841A-52519270C1B2}" = PowerQuest Drive Image 5.0
"{909B62B0-8ACA-4061-A83B-09CAEF609619}" = MSXML 6.0 Parser
"{95E0E6DC-C308-4C96-BEDB-68C75A32FAF8}_is1" = Tetris
"{97A4D873-47B9-454A-A567-8AFF41C07155}" = EasyRecovery DataRecovery
"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows
"{A074DE55-29EB-459C-99C9-3F26C5669ECB}" = EasyRecovery DataRecovery Trial
"{A0E2CD91-BC77-411F-BD5D-5ABCA8C7C5B8}" = Sony Ericsson Mobile Phone Monitor
"{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}" = Brother MFL-Pro Suite
"{AC76BA86-1033-F400-7760-000000000002}" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch
"{B08D262E-D902-11D5-9C28-0080C85A0C2D}" = ScanWizard 5
"{B754B683-E23C-4583-9312-50AD86836B42}" = Steuer Hilfesammlung
"{C00FAC7F-DAF5-4FD8-83E7-5959C882A811}" = Sony Ericsson File Manager
"{CBA04F21-D46C-46FC-9A8A-A5360F58CF94}" = Sony Ericsson Sync Station
"{D777130E-86A9-428C-B7E6-9EFBCAB4E4CC}" = Steuer Hilfesammlung
"{E03EE3F8-F081-4EF5-BE18-CC849459B070}" = Sony Ericsson Capability Manager
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{EA9FAF16-0E5C-42C4-9742-9AF8D5F6D69B}" = ATI Catalyst Control Center
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA}" = Pinnacle TVCenter Pro
"{FDDC37C3-B2FC-4B5E-A854-1E69B2FFCA71}" = Steuer Update 14.01
"Ad-Aware SE Personal" = Ad-Aware SE Personal
"Adobe Acrobat 7.0 Professional - EFG" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"All ATI Software" = ATI - Software Uninstall Utility
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal – Free Antivirus
"AsusUpdate" = AsusUpdate
"ATI Display Driver" = ATI Display Driver
"BetaPlayer" = BetaPlayer
"Digital Image Recovery_is1" = Digital Image Recovery 1.47
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"FFMPEG" = FFMPEG
"FLAC" = FLAC
"FTDICOMM" = SEMC DSS SyncStation Driver
"Google Updater" = Google Updater
"Hard Disk Low Level Format Tool_is1" = Hard Disk Low Level Format Tool 2.36 build 1181
"HijackThis" = HijackThis 1.99.1
"ImTOO 3GP Video Converter" = ImTOO 3GP Video Converter
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"InstallShield_{97A4D873-47B9-454A-A567-8AFF41C07155}" = EasyRecovery DataRecovery
"InstallShield_{A074DE55-29EB-459C-99C9-3F26C5669ECB}" = EasyRecovery DataRecovery Trial
"KlickTel99" = klickTel Mai 99 - 32-Bit
"KLiteCodecPack_is1" = K-Lite Codec Pack 3.8.0 Full
"Language pack for Ad-Aware SE" = Language pack for Ad-Aware SE
"MAGIX Fotos auf CD & DVD 7 deluxe D" = MAGIX Fotos auf CD & DVD 7 deluxe 7.0.2.0 (D)
"MediaCoder" = MediaCoder 0.6.2
"MediaInfo" = MediaInfo 0.7.6.1BETA
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox (2.0.0.12)" = Mozilla Firefox (2.0.0.12)
"Need For Speed III" = Need For Speed III
"OEMaster-Daten-ExportfürOutlookExpress" = OEMaster - DBX-Reader und Daten-Export für Outlook Express
"ProtectDisc Driver 10" = ProtectDisc Helper Driver 10
"S4Uninst" = Die Siedler IV
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"ST6UNST #1" = Outlook Express Quick Backup
"VLC media player" = VLC media player 0.9.6
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinRAR archiver" = WinRAR Archivierer
"ZoneAlarm" = ZoneAlarm
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\gast_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dr. Hardware 2008_is1" = Dr. Hardware 2008 9.0.0d
"JAP" = JAP
"Mozilla Firefox (2.0)" = Mozilla Firefox (2.0)
"Stellar Phoenix DMR_is1" = Stellar Phoenix DMR 1.0
 
< End of report >
Code:
ATTFilter
OTL logfile created on: 1/29/2013 4:36:27 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 82.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): C:\pagefile.sys 3070 3070 [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Programme
Drive D: | 135.01 Gb Total Space | 109.44 Gb Free Space | 81.06% Space Free | Partition Type: NTFS
Drive E: | 410.15 Gb Total Space | 311.89 Gb Free Space | 76.04% Space Free | Partition Type: NTFS
Drive F: | 404.17 Gb Total Space | 273.50 Gb Free Space | 67.67% Space Free | Partition Type: NTFS
Drive G: | 99.96 Gb Total Space | 81.88 Gb Free Space | 81.91% Space Free | Partition Type: NTFS
Drive H: | 100.73 Gb Total Space | 35.54 Gb Free Space | 35.28% Space Free | Partition Type: NTFS
Drive I: | 130.07 Gb Total Space | 26.45 Gb Free Space | 20.34% Space Free | Partition Type: NTFS
Drive K: | 31.23 Gb Total Space | 31.18 Gb Free Space | 99.84% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet005
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled] --  -- (FirebirdServerMAGIXInstance)
SRV - [2008/04/15 10:15:24 | 000,147,201 | ---- | M] (Avira GmbH) [Disabled] -- D:\Programme\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService)
SRV - [2008/04/15 10:15:24 | 000,068,865 | ---- | M] (Avira GmbH) [Disabled] -- D:\Programme\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler)
SRV - [2007/08/23 07:52:50 | 000,410,904 | ---- | M] (Acronis) [Disabled] -- D:\Programme\Gemeinsame Dateien\Maxtor\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2007/03/08 17:01:58 | 000,075,568 | ---- | M] (Zone Labs, LLC) [Auto] -- D:\WINDOWS\System32\ZONELABS\vsmon.exe -- (vsmon)
SRV - [2006/09/20 12:44:10 | 000,069,632 | ---- | M] (Adobe Systems) [On_Demand] -- D:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2006/02/28 19:10:20 | 000,069,632 | ---- | M] (CrypKey (Canada) Ltd.) [Disabled] -- D:\WINDOWS\System32\Crypserv.exe -- (Crypkey License)
SRV - [2004/10/21 19:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [Disabled] -- D:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/05/17 07:57:00 | 000,184,320 | ---- | M] (O&O Software GmbH) [Auto] -- D:\WINDOWS\system32\oodag.exe -- (O&O Defrag)
SRV - [2003/07/28 05:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [Disabled] -- D:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2001/08/08 19:01:00 | 000,090,112 | ---- | M] (SEIKO EPSON CORPORATION) [Disabled] -- D:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe -- (EPSONStatusAgent2)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WINFOXIO)
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (TSMPacket)
DRV - File not found [Kernel | On_Demand] --  -- (SANDRA)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand] --  -- (MEMSWEEP2)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | On_Demand] --  -- (CrystalSysInfo)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2008/11/20 12:49:04 | 000,400,864 | ---- | M] (Acronis) [Kernel | Boot] -- D:\WINDOWS\system32\drivers\timntr.sys -- (timounter)
DRV - [2008/11/20 12:49:04 | 000,032,768 | ---- | M] (Acronis) [File_System | Auto] -- D:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter)
DRV - [2008/11/20 12:48:54 | 000,120,992 | ---- | M] (Acronis) [Kernel | Boot] -- D:\WINDOWS\system32\drivers\snapman.sys -- (snapman)
DRV - [2008/04/15 10:15:24 | 000,079,424 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2008/04/15 10:15:24 | 000,049,472 | ---- | M] (Avira GmbH) [File_System | On_Demand] -- D:\Programme\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt)
DRV - [2008/04/15 10:15:24 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2007/10/28 10:35:14 | 000,583,128 | ---- | M] (Protect Software GmbH) [Kernel | Auto] -- D:\WINDOWS\system32\drivers\ACEDRV10.sys -- (acedrv10)
DRV - [2007/10/26 08:53:46 | 000,250,560 | ---- | M] (Protect Software GmbH) [Kernel | Auto] -- D:\WINDOWS\system32\drivers\acehlp10.sys -- (acehlp10)
DRV - [2007/08/31 15:07:50 | 000,407,328 | ---- | M] (Sensaura) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\dmxsens.sys -- (dmxsens)
DRV - [2007/08/31 15:07:40 | 000,099,680 | ---- | M] (Terratec Electronic GmbH) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\dmx6fire.sys -- (dmxfire)
DRV - [2007/08/21 21:07:40 | 002,417,664 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2007/06/14 06:41:00 | 000,466,048 | R--- | M] (LITEON) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\Ltn_stk7070P.sys -- (Ltn_stk7070P)
DRV - [2007/06/13 11:30:20 | 000,013,440 | R--- | M] (LITEON) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\Ltn_stkrc.sys -- (Ltn_stkrc)
DRV - [2007/04/22 02:06:36 | 000,011,840 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Programme\AntiVir PersonalEdition Classic\avgio.sys -- (avgio)
DRV - [2007/03/08 17:02:10 | 000,394,192 | ---- | M] (Zone Labs, LLC) [Kernel | System] -- D:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2007/03/01 04:27:26 | 004,484,608 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/01/17 22:39:20 | 000,050,416 | ---- | M] (Zone Labs, LLC) [Kernel | Boot] -- D:\WINDOWS\system32\ZoneLabs\srescan.sys -- (srescan)
DRV - [2006/10/17 07:22:26 | 000,009,216 | R--- | M] (VIA Technologies, Inc.) [Kernel | Boot] -- D:\WINDOWS\system32\drivers\videX32.sys -- (videX32)
DRV - [2006/10/11 07:10:30 | 000,008,864 | ---- | M] () [Kernel | Auto] -- D:\WINDOWS\system32\drivers\CDAC15BA.SYS -- (CdaC15BA)
DRV - [2006/01/25 09:14:06 | 000,472,644 | ---- | M] (Hauppauge Computer Works) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\HCWBT8xx.sys -- (HCWBT8XX)
DRV - [2006/01/09 20:47:28 | 000,031,846 | ---- | M] () [Kernel | System] -- D:\WINDOWS\system32\ckldrv.sys -- (NetworkX)
DRV - [2004/08/03 20:08:36 | 000,013,824 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\atinmdxx.sys -- (MVDCODEC)
DRV - [2004/08/03 20:08:30 | 000,105,984 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\atinrvxx.sys -- (atinrvxx)
DRV - [2004/08/03 16:10:14 | 000,015,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\MPE.sys -- (MPE)
DRV - [2004/08/03 16:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2004/08/03 16:07:46 | 000,223,616 | ---- | M] (Microsoft Corporation) [Kernel | System] -- D:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2004/08/03 15:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)
DRV - [2004/03/22 09:40:38 | 000,040,448 | R--- | M] (Susteen Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\SUSCOM.SYS -- (SUSCOM)
DRV - [2003/09/16 04:00:10 | 000,019,153 | R--- | M] (FTDI Ltd.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ftdibus.sys -- (FTDIBUS)
DRV - [2003/09/16 04:00:02 | 000,006,828 | R--- | M] (FTDI Ltd.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ftlund.sys -- (FTLUND)
DRV - [2003/09/16 03:59:54 | 000,050,396 | R--- | M] (FTDI Ltd.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ftser2k.sys -- (FTSER2K)
DRV - [2003/09/05 10:30:32 | 000,011,776 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\Dokumente und Einstellungen\All Users\Dokumente\Eigene Bilder\ATI BIOS\WinFlash\ATIXPGAA.SYS -- (ATIXPGAA)
DRV - [2002/08/13 08:27:22 | 000,074,338 | ---- | M] (3Com Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\el90Xbc5.SYS -- (EL90Xbc)
DRV - [2001/08/17 07:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)
DRV - [2001/08/17 06:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\irsir.sys -- (irsir)
DRV - [2001/08/10 00:00:00 | 000,003,252 | ---- | M] () [Kernel | System] -- D:\WINDOWS\System32\drivers\PQNTDRV.SYS -- (PQNTDrv)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\gast_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\ich_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\ich_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\LocalService_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\NetworkService_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\systemprofile_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: D:\Programme\Google\Google Updater\2.4.1399.3742\npCIDetect13.dll (Google)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 2.0\extensions\\Components: D:\Mozilla\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 2.0\extensions\\Plugins: D:\Mozilla\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 2.0.0.12\extensions\\Components: D:\MOZILLA\MOZILL~2\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 2.0.0.12\extensions\\Plugins: D:\MOZILLA\MOZILL~2\Mozilla Firefox\plugins
 
[2006/06/22 06:44:58 | 002,078,344 | ---- | M] () -- D:\Programme\mozilla firefox\plugins\NPSWF32.dll
 
O1 HOSTS File: ([2001/09/04 10:34:58 | 000,000,820 | ---- | M]) - D:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -  File not found
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -  File not found
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} -  File not found
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Programme\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - D:\Programme\MSN\Toolbar\3.0.0744.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - D:\Programme\MSN\Toolbar\3.0.0744.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  File not found
O3 - HKU\ich_ON_D\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  File not found
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\gast_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\ich_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95
O7 - HKU\LocalService_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\systemprofile_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -  File not found
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -  File not found
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 83.169.184.161 83.169.184.225
O18 - Protocol\Handler\haufereader - No CLSID value found
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - D:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - D:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O30 - LSA: Authentication Packages - (relog_ap) - D:\WINDOWS\System32\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/08/26 07:04:08 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (OODBS) - D:\WINDOWS\System32\OODBS.exe (O&O Software GmbH)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/01/29 13:02:44 | 000,000,000 | ---D | C] -- D:\_OTL
[2008/03/14 09:18:02 | 000,089,680 | ---- | C] (Microsoft Corporation) -- D:\Dokumente und Einstellungen\ich\MSSSerif120.fon
[4 D:\WINDOWS\System32\*.tmp files -> D:\WINDOWS\System32\*.tmp -> ]
[3 D:\WINDOWS\*.tmp files -> D:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[4 D:\WINDOWS\System32\*.tmp files -> D:\WINDOWS\System32\*.tmp -> ]
[3 D:\WINDOWS\*.tmp files -> D:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2008/12/23 13:01:33 | 000,502,784 | ---- | C] () -- D:\WINDOWS\x2.64.exe
[2008/12/23 13:01:33 | 000,240,128 | ---- | C] () -- D:\WINDOWS\System32\x.264.exe
[2008/12/23 13:01:33 | 000,217,073 | ---- | C] () -- D:\WINDOWS\meta4.exe
[2008/12/23 13:01:33 | 000,066,560 | ---- | C] () -- D:\WINDOWS\MOTA113.exe
[2008/12/23 13:01:33 | 000,027,648 | ---- | C] () -- D:\WINDOWS\System32\AVSredirect.dll
[2008/12/10 11:19:18 | 000,000,109 | ---- | C] () -- D:\WINDOWS\oodcnt.INI
[2008/12/10 10:49:55 | 000,000,223 | ---- | C] () -- D:\Dokumente und Einstellungen\ich\Goya.ini
[2008/12/10 10:49:23 | 000,000,046 | ---- | C] () -- D:\WINDOWS\Goya.INI
[2008/11/19 12:33:50 | 000,000,164 | ---- | C] () -- D:\WINDOWS\RECMGRUN.INI
[2008/11/19 12:32:53 | 000,003,455 | ---- | C] () -- D:\WINDOWS\RECVCALL.INI
[2008/11/18 11:53:32 | 000,000,004 | ---- | C] () -- D:\WINDOWS\vx86036.dat
[2008/11/18 11:53:23 | 000,000,067 | ---- | C] () -- D:\WINDOWS\Crypkey.ini
[2008/11/18 11:53:20 | 000,031,846 | ---- | C] () -- D:\WINDOWS\System32\Ckldrv.sys
[2008/11/18 11:53:20 | 000,027,648 | R--- | C] () -- D:\WINDOWS\Setup_ck.exe
[2008/11/18 11:53:20 | 000,018,432 | ---- | C] () -- D:\WINDOWS\Setup_ck.dll
[2008/11/18 11:53:20 | 000,011,776 | ---- | C] () -- D:\WINDOWS\Ckrfresh.exe
[2008/11/16 04:02:14 | 000,000,425 | ---- | C] () -- D:\WINDOWS\BRWMARK.INI
[2008/11/16 04:02:14 | 000,000,027 | ---- | C] () -- D:\WINDOWS\BRPP2KA.INI
[2008/11/16 03:59:10 | 000,000,050 | ---- | C] () -- D:\WINDOWS\System32\bridf07a.dat
[2008/11/16 03:58:08 | 000,106,496 | ---- | C] () -- D:\WINDOWS\System32\BrMuSNMP.dll
[2008/05/17 10:49:05 | 000,077,460 | ---- | C] () -- D:\WINDOWS\DIHELP.DAT
[2008/05/17 10:49:05 | 000,038,450 | ---- | C] () -- D:\WINDOWS\PQDI.exe
[2008/05/12 13:39:53 | 000,120,200 | ---- | C] () -- D:\WINDOWS\System32\DLLDEV32i.dll
[2008/05/12 13:38:22 | 000,006,768 | ---- | C] () -- D:\WINDOWS\mgxoschk.ini
[2008/05/04 11:08:49 | 000,020,480 | ---- | C] () -- D:\WINDOWS\System32\CPUINFO2.DLL
[2008/04/19 04:24:24 | 000,049,152 | R--- | C] () -- D:\WINDOWS\System32\ChCfg.exe
[2008/04/11 11:00:16 | 000,036,864 | ---- | C] () -- D:\WINDOWS\Algoui.exe
[2008/04/10 12:14:51 | 000,049,152 | RH-- | C] () -- D:\WINDOWS\System32\CoInst.dll
[2008/03/15 02:50:36 | 000,164,352 | ---- | C] () -- D:\WINDOWS\System32\unrar.dll
[2008/03/15 02:50:35 | 000,755,027 | ---- | C] () -- D:\WINDOWS\System32\xvidcore.dll
[2008/03/15 02:50:34 | 000,159,839 | ---- | C] () -- D:\WINDOWS\System32\xvidvfw.dll
[2008/03/15 02:50:33 | 000,007,680 | ---- | C] () -- D:\WINDOWS\System32\ff_vfw.dll
[2008/02/16 10:56:28 | 000,000,038 | ---- | C] () -- D:\WINDOWS\AviSplitter.INI
[2008/02/10 11:54:09 | 000,035,328 | ---- | C] () -- D:\WINDOWS\System32\cygz.dll
[2008/02/10 11:54:09 | 000,035,328 | ---- | C] () -- D:\WINDOWS\cygz.dll
[2007/12/24 04:43:11 | 000,363,520 | ---- | C] () -- D:\WINDOWS\System32\PsisDecd.dll
[2007/10/27 12:45:03 | 001,284,280 | ---- | C] () -- D:\WINDOWS\System32\XMNT2001.EXE
[2007/10/27 12:45:03 | 000,003,252 | ---- | C] () -- D:\WINDOWS\System32\drivers\PQNTDRV.SYS
[2007/10/16 11:26:41 | 000,069,632 | R--- | C] () -- D:\WINDOWS\System32\xmltok.dll
[2007/10/16 11:26:41 | 000,036,864 | R--- | C] () -- D:\WINDOWS\System32\xmlparse.dll
[2007/10/05 10:54:38 | 000,000,245 | ---- | C] () -- D:\WINDOWS\System32\regupdate.ini
[2007/09/18 20:21:28 | 000,009,384 | ---- | C] () -- D:\WINDOWS\Irremote.ini
[2007/09/18 19:50:55 | 000,593,920 | ---- | C] () -- D:\WINDOWS\System32\ati2sgag.exe
[2007/08/21 20:35:20 | 003,107,788 | ---- | C] () -- D:\WINDOWS\System32\ativvaxx.dat
[2007/08/21 20:35:20 | 003,107,788 | ---- | C] () -- D:\WINDOWS\System32\ativva5x.dat
[2007/08/21 20:35:20 | 000,972,072 | ---- | C] () -- D:\WINDOWS\System32\ativva6x.dat
[2007/08/03 05:28:35 | 000,002,508 | ---- | C] () -- D:\Dokumente und Einstellungen\gast\Anwendungsdaten\$_hpcst$.hpc
[2007/08/02 11:29:36 | 000,002,508 | ---- | C] () -- D:\Dokumente und Einstellungen\ich\Anwendungsdaten\$_hpcst$.hpc
[2007/07/05 10:48:35 | 000,000,092 | R--- | C] () -- D:\WINDOWS\System32\ftdiun2k.ini
[2007/06/07 14:10:48 | 000,020,480 | ---- | C] () -- D:\WINDOWS\System32\ac3config.exe
[2007/05/06 06:01:21 | 000,003,133 | ---- | C] () -- D:\WINDOWS\tm.ini
[2007/03/31 03:20:28 | 000,022,168 | ---- | C] () -- D:\WINDOWS\System32\imsinstall_loc0407.dll
[2007/03/31 03:20:28 | 000,018,072 | ---- | C] () -- D:\WINDOWS\System32\imslsp_install_loc0407.dll
[2007/02/14 12:21:26 | 000,796,584 | ---- | C] () -- D:\WINDOWS\System32\libeay32_0.9.6l.dll
[2007/02/13 10:00:56 | 000,233,868 | ---- | C] () -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\firstlsp.reg.dat
[2007/02/07 06:30:09 | 000,000,161 | ---- | C] () -- D:\WINDOWS\wininit.ini
[2007/01/29 09:20:32 | 001,048,576 | ---- | C] () -- D:\WINDOWS\System32\SFMAN.DAT
[2006/12/19 03:50:26 | 002,244,084 | ---- | C] () -- D:\Dokumente und Einstellungen\gast\Gaggia Bedienungsanleitung.pdf
[2006/11/02 10:10:16 | 000,080,912 | ---- | C] () -- D:\WINDOWS\System32\sherlock2.exe
[2006/11/01 08:11:21 | 000,689,280 | ---- | C] () -- D:\WINDOWS\System32\aswBoot.exe
[2006/10/30 11:15:03 | 000,006,067 | ---- | C] () -- D:\WINDOWS\Unwise32.ini
[2006/10/30 11:15:02 | 000,148,992 | ---- | C] () -- D:\WINDOWS\Unwise32.exe
[2006/10/30 11:12:57 | 000,369,152 | ---- | C] () -- D:\Programme\Rufid.exe
[2006/10/30 11:12:01 | 000,000,092 | ---- | C] () -- D:\WINDOWS\KTEL.INI
[2006/10/11 07:10:29 | 000,008,864 | ---- | C] () -- D:\WINDOWS\System32\drivers\CDAC15BA.SYS
[2006/10/11 06:46:55 | 000,000,070 | ---- | C] () -- D:\WINDOWS\Ulead32.INI
[2006/09/20 03:19:12 | 000,000,116 | ---- | C] () -- D:\WINDOWS\NeroDigital.ini
[2006/09/07 07:34:16 | 000,154,624 | ---- | C] () -- D:\Dokumente und Einstellungen\ich\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/09/07 07:32:07 | 000,000,305 | ---- | C] () -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2006/09/04 13:29:45 | 000,000,514 | ---- | C] () -- D:\WINDOWS\ODBC.INI
[2006/08/31 06:04:05 | 000,005,824 | ---- | C] () -- D:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2006/08/31 04:15:11 | 000,000,407 | ---- | C] () -- D:\Programme\Verknüpfung (2) mit Outlook Express.lnk
[2006/08/31 04:14:36 | 000,000,407 | ---- | C] () -- D:\Programme\Verknüpfung mit Outlook Express.lnk
[2006/08/30 12:36:08 | 000,285,216 | ---- | C] () -- D:\WINDOWS\System32\drivers\Onsio.sys
[2006/08/30 12:36:08 | 000,007,680 | ---- | C] () -- D:\WINDOWS\System32\drivers\Onsreged.sys
[2006/08/28 14:33:53 | 000,004,212 | -H-- | C] () -- D:\WINDOWS\System32\zllictbl.dat
[2006/08/28 12:12:04 | 000,081,920 | ---- | C] () -- D:\WINDOWS\System32\ieencode.dll
[2006/08/26 13:05:53 | 000,000,552 | ---- | C] () -- D:\WINDOWS\System32\d3d8caps.dat
[2006/08/26 12:21:25 | 000,000,000 | ---- | C] () -- D:\WINDOWS\nsreg.dat
[2006/08/26 12:21:16 | 000,003,418 | ---- | C] () -- D:\WINDOWS\mozver.dat
[2006/08/26 11:08:52 | 000,004,831 | ---- | C] () -- D:\WINDOWS\Ascd_tmp.ini
[2006/08/26 07:07:34 | 000,002,048 | --S- | C] () -- D:\WINDOWS\bootstat.dat
[2006/08/26 07:00:51 | 000,021,740 | ---- | C] () -- D:\WINDOWS\System32\emptyregdb.dat
[2006/08/26 06:50:42 | 000,004,161 | ---- | C] () -- D:\WINDOWS\ODBCINST.INI
[2006/08/26 06:49:46 | 000,286,112 | ---- | C] () -- D:\WINDOWS\System32\FNTCACHE.DAT
[2006/06/01 10:22:00 | 001,662,976 | ---- | C] () -- D:\WINDOWS\System32\nvwdmcpl.dll
[2006/06/01 10:22:00 | 001,519,616 | ---- | C] () -- D:\WINDOWS\System32\nwiz.exe
[2006/06/01 10:22:00 | 001,466,368 | ---- | C] () -- D:\WINDOWS\System32\nview.dll
[2006/06/01 10:22:00 | 001,339,392 | ---- | C] () -- D:\WINDOWS\System32\nvdspsch.exe
[2006/06/01 10:22:00 | 001,019,904 | ---- | C] () -- D:\WINDOWS\System32\nvwimg.dll
[2006/06/01 10:22:00 | 000,581,632 | ---- | C] () -- D:\WINDOWS\System32\nvhwvid.dll
[2006/06/01 10:22:00 | 000,466,944 | ---- | C] () -- D:\WINDOWS\System32\nvShell.dll
[2006/06/01 10:22:00 | 000,442,368 | ---- | C] () -- D:\WINDOWS\System32\nvAppBar.exe
[2006/06/01 10:22:00 | 000,425,984 | ---- | C] () -- D:\WINDOWS\System32\keystone.exe
[2006/06/01 10:22:00 | 000,286,720 | ---- | C] () -- D:\WINDOWS\System32\nvnt4cpl.dll
[2006/06/01 10:22:00 | 000,196,608 | ---- | C] () -- D:\WINDOWS\System32\NVAPI.DLL
[2006/04/28 15:05:14 | 000,156,671 | ---- | C] () -- D:\WINDOWS\System32\atiicdxx.dat
[2004/08/02 07:20:40 | 000,004,569 | ---- | C] () -- D:\WINDOWS\System32\secupd.dat
[2003/02/20 10:53:42 | 000,005,702 | ---- | C] () -- D:\WINDOWS\System32\OUTLPERF.INI
[2001/10/10 01:57:58 | 000,073,786 | ---- | C] () -- D:\WINDOWS\System32\dntvmc23.dll
[2001/10/10 01:57:58 | 000,061,497 | ---- | C] () -- D:\WINDOWS\System32\dntvm23.dll
[2001/09/04 10:35:46 | 000,027,440 | ---- | C] () -- D:\WINDOWS\System32\drivers\secdrv.sys
[2001/09/04 10:35:36 | 000,408,618 | ---- | C] () -- D:\WINDOWS\System32\perfh007.dat
[2001/09/04 10:35:36 | 000,395,200 | ---- | C] () -- D:\WINDOWS\System32\perfh009.dat
[2001/09/04 10:35:36 | 000,272,128 | ---- | C] () -- D:\WINDOWS\System32\perfi009.dat
[2001/09/04 10:35:36 | 000,269,480 | ---- | C] () -- D:\WINDOWS\System32\perfi007.dat
[2001/09/04 10:35:36 | 000,034,478 | ---- | C] () -- D:\WINDOWS\System32\perfd007.dat
[2001/09/04 10:35:36 | 000,028,626 | ---- | C] () -- D:\WINDOWS\System32\perfd009.dat
[2001/09/04 10:35:35 | 000,071,598 | ---- | C] () -- D:\WINDOWS\System32\perfc007.dat
[2001/09/04 10:35:35 | 000,059,440 | ---- | C] () -- D:\WINDOWS\System32\perfc009.dat
[2001/09/04 10:35:33 | 013,107,200 | ---- | C] () -- D:\WINDOWS\System32\oembios.bin
[2001/09/04 10:35:33 | 000,004,463 | ---- | C] () -- D:\WINDOWS\System32\oembios.dat
[2001/09/04 10:35:26 | 000,000,741 | ---- | C] () -- D:\WINDOWS\System32\noise.dat
[2001/09/04 10:35:09 | 000,673,088 | ---- | C] () -- D:\WINDOWS\System32\mlang.dat
[2001/09/04 10:35:08 | 000,046,258 | ---- | C] () -- D:\WINDOWS\System32\mib.bin
[2001/09/04 10:34:48 | 000,218,003 | ---- | C] () -- D:\WINDOWS\System32\dssec.dat
[2001/09/04 10:34:21 | 000,001,788 | ---- | C] () -- D:\WINDOWS\System32\Dcache.bin
[2001/03/07 01:02:30 | 000,229,431 | ---- | C] () -- D:\WINDOWS\System32\dnt23.dll
[2000/09/13 19:03:00 | 000,000,145 | ---- | C] () -- D:\WINDOWS\System32\EBPPORT.DAT
 
========== LOP Check ==========
 
[2007/02/14 13:22:50 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic
[2008/12/06 11:49:02 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ashampoo
[2006/12/02 02:57:24 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avg7
[2007/04/20 01:57:10 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BTrieve
[2007/04/20 01:55:44 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Haufe
[2007/04/20 01:57:02 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lexware
[2008/05/12 13:45:42 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2008/11/20 12:53:04 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Maxtor
[2007/03/31 02:56:00 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\My Pictures
[2007/12/24 04:49:28 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pinnacle
[2006/08/27 07:18:54 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-DSL SpeedManager
[2008/11/19 11:37:10 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2006/09/02 05:44:10 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ulead Systems
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
Smileys[2008/11/19 11:07:44 | 000,000,000 | ---D | M](D:\WINDOWS\System32\??????????) -- D:\WINDOWS\System32\粑۰粒??۫粒⁃睌
*[Weitere] BeitragssymboleSie könn[2008/11/19 11:07:43 | 000,000,000 | ---D | C](D:\WINDOWS\System32\??????????) -- D:\WINDOWS\System32\粑۰粒??۫粒⁃睌
< End of report >
en aus
Geändert von paulibins (29.01.2013 um 19:11 Uhr)

Alt 29.01.2013, 19:08   #2
markusg
/// Malware-holic
 
Windows XP startet auch nicht im abgesichtern Modus - Standard

Windows XP startet auch nicht im abgesichtern Modus


hi
das nächste mal ein thema erstellen, wenn alle logs bereit sind zum posten, sonst antwortest du dir selbst, und das thema wird dann logischerweise als in arbeit angezeigt.
falls otl logs zu groß, datei anhängen, evtl. packen mit winrar oder zip
__________________

__________________
Alt 29.01.2013, 19:27   #3
markusg
/// Malware-holic
 
Windows XP startet auch nicht im abgesichtern Modus - Standard

Windows XP startet auch nicht im abgesichtern Modus


hmm, führe otl noch mal aus.
• Dein System sollte jetzt einen REATOGO-X-PE Desktop anzeigen.
• Mache einen doppel Klick auf das OTLPE Icon.
• Wenn du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
• Wenn du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
• entferne den haken bei "Automatically Load All Remaining Users" wenn er gesetzt ist.

• OTL sollte nun starten.
Kopiere nun den Inhalt in die
Textbox.
Code:
ATTFilter
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
• Drücke Run Scan um den Scan zu starten.
• Wenn er fertig ist werden die Dateien in C:\otl.txt gesichert
• Kopiere diesen Ordner auf deinen USB-Stick wenn du keine Internetverbindung auf diesem System hast.
poste beide logs
__________________
__________________
Alt 30.01.2013, 11:41   #4
paulibins
 
Windows XP startet auch nicht im abgesichtern Modus - Standard

Windows XP startet auch nicht im abgesichtern Modus


Hallo, danke f[r die schnellle Antwort. Bin so vorgegangen wie beschrieben.
Es kam aber nur otl.txt als logfile heraus.
Code:
ATTFilter
OTL logfile created on: 1/30/2013 10:22:37 AM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 86.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 95.00% Paging File free
Paging file location(s): C:\pagefile.sys 3070 3070 [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Programme
Drive D: | 135.01 Gb Total Space | 109.44 Gb Free Space | 81.06% Space Free | Partition Type: NTFS
Drive E: | 410.15 Gb Total Space | 311.89 Gb Free Space | 76.04% Space Free | Partition Type: NTFS
Drive F: | 404.17 Gb Total Space | 273.50 Gb Free Space | 67.67% Space Free | Partition Type: NTFS
Drive G: | 99.96 Gb Total Space | 81.88 Gb Free Space | 81.91% Space Free | Partition Type: NTFS
Drive H: | 100.73 Gb Total Space | 35.54 Gb Free Space | 35.28% Space Free | Partition Type: NTFS
Drive I: | 130.07 Gb Total Space | 26.45 Gb Free Space | 20.34% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet005
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled] --  -- (FirebirdServerMAGIXInstance)
SRV - [2008/04/15 10:15:24 | 000,147,201 | ---- | M] (Avira GmbH) [Disabled] -- D:\Programme\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService)
SRV - [2008/04/15 10:15:24 | 000,068,865 | ---- | M] (Avira GmbH) [Disabled] -- D:\Programme\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler)
SRV - [2007/08/23 07:52:50 | 000,410,904 | ---- | M] (Acronis) [Disabled] -- D:\Programme\Gemeinsame Dateien\Maxtor\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2007/03/08 17:01:58 | 000,075,568 | ---- | M] (Zone Labs, LLC) [Auto] -- D:\WINDOWS\System32\ZONELABS\vsmon.exe -- (vsmon)
SRV - [2006/09/20 12:44:10 | 000,069,632 | ---- | M] (Adobe Systems) [On_Demand] -- D:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2006/02/28 19:10:20 | 000,069,632 | ---- | M] (CrypKey (Canada) Ltd.) [Disabled] -- D:\WINDOWS\System32\Crypserv.exe -- (Crypkey License)
SRV - [2004/10/21 19:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [Disabled] -- D:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/05/17 07:57:00 | 000,184,320 | ---- | M] (O&O Software GmbH) [Auto] -- D:\WINDOWS\system32\oodag.exe -- (O&O Defrag)
SRV - [2003/07/28 05:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [Disabled] -- D:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2001/08/08 19:01:00 | 000,090,112 | ---- | M] (SEIKO EPSON CORPORATION) [Disabled] -- D:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe -- (EPSONStatusAgent2)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WINFOXIO)
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (TSMPacket)
DRV - File not found [Kernel | On_Demand] --  -- (SANDRA)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand] --  -- (MEMSWEEP2)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | On_Demand] --  -- (CrystalSysInfo)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2008/11/20 12:49:04 | 000,400,864 | ---- | M] (Acronis) [Kernel | Boot] -- D:\WINDOWS\system32\drivers\timntr.sys -- (timounter)
DRV - [2008/11/20 12:49:04 | 000,032,768 | ---- | M] (Acronis) [File_System | Auto] -- D:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter)
DRV - [2008/11/20 12:48:54 | 000,120,992 | ---- | M] (Acronis) [Kernel | Boot] -- D:\WINDOWS\system32\drivers\snapman.sys -- (snapman)
DRV - [2008/04/15 10:15:24 | 000,079,424 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2008/04/15 10:15:24 | 000,049,472 | ---- | M] (Avira GmbH) [File_System | On_Demand] -- D:\Programme\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt)
DRV - [2008/04/15 10:15:24 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2007/10/28 10:35:14 | 000,583,128 | ---- | M] (Protect Software GmbH) [Kernel | Auto] -- D:\WINDOWS\system32\drivers\ACEDRV10.sys -- (acedrv10)
DRV - [2007/10/26 08:53:46 | 000,250,560 | ---- | M] (Protect Software GmbH) [Kernel | Auto] -- D:\WINDOWS\system32\drivers\acehlp10.sys -- (acehlp10)
DRV - [2007/08/31 15:07:50 | 000,407,328 | ---- | M] (Sensaura) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\dmxsens.sys -- (dmxsens)
DRV - [2007/08/31 15:07:40 | 000,099,680 | ---- | M] (Terratec Electronic GmbH) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\dmx6fire.sys -- (dmxfire)
DRV - [2007/08/21 21:07:40 | 002,417,664 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2007/06/14 06:41:00 | 000,466,048 | R--- | M] (LITEON) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\Ltn_stk7070P.sys -- (Ltn_stk7070P)
DRV - [2007/06/13 11:30:20 | 000,013,440 | R--- | M] (LITEON) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\Ltn_stkrc.sys -- (Ltn_stkrc)
DRV - [2007/04/22 02:06:36 | 000,011,840 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Programme\AntiVir PersonalEdition Classic\avgio.sys -- (avgio)
DRV - [2007/03/08 17:02:10 | 000,394,192 | ---- | M] (Zone Labs, LLC) [Kernel | System] -- D:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2007/03/01 04:27:26 | 004,484,608 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/01/17 22:39:20 | 000,050,416 | ---- | M] (Zone Labs, LLC) [Kernel | Boot] -- D:\WINDOWS\system32\ZoneLabs\srescan.sys -- (srescan)
DRV - [2006/10/17 07:22:26 | 000,009,216 | R--- | M] (VIA Technologies, Inc.) [Kernel | Boot] -- D:\WINDOWS\system32\drivers\videX32.sys -- (videX32)
DRV - [2006/10/11 07:10:30 | 000,008,864 | ---- | M] () [Kernel | Auto] -- D:\WINDOWS\system32\drivers\CDAC15BA.SYS -- (CdaC15BA)
DRV - [2006/01/25 09:14:06 | 000,472,644 | ---- | M] (Hauppauge Computer Works) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\HCWBT8xx.sys -- (HCWBT8XX)
DRV - [2006/01/09 20:47:28 | 000,031,846 | ---- | M] () [Kernel | System] -- D:\WINDOWS\system32\ckldrv.sys -- (NetworkX)
DRV - [2004/08/03 20:08:36 | 000,013,824 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\atinmdxx.sys -- (MVDCODEC)
DRV - [2004/08/03 20:08:30 | 000,105,984 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\atinrvxx.sys -- (atinrvxx)
DRV - [2004/08/03 16:10:14 | 000,015,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\MPE.sys -- (MPE)
DRV - [2004/08/03 16:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2004/08/03 16:07:46 | 000,223,616 | ---- | M] (Microsoft Corporation) [Kernel | System] -- D:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2004/08/03 15:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)
DRV - [2004/03/22 09:40:38 | 000,040,448 | R--- | M] (Susteen Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\SUSCOM.SYS -- (SUSCOM)
DRV - [2003/09/16 04:00:10 | 000,019,153 | R--- | M] (FTDI Ltd.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ftdibus.sys -- (FTDIBUS)
DRV - [2003/09/16 04:00:02 | 000,006,828 | R--- | M] (FTDI Ltd.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ftlund.sys -- (FTLUND)
DRV - [2003/09/16 03:59:54 | 000,050,396 | R--- | M] (FTDI Ltd.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ftser2k.sys -- (FTSER2K)
DRV - [2003/09/05 10:30:32 | 000,011,776 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\Dokumente und Einstellungen\All Users\Dokumente\Eigene Bilder\ATI BIOS\WinFlash\ATIXPGAA.SYS -- (ATIXPGAA)
DRV - [2002/08/13 08:27:22 | 000,074,338 | ---- | M] (3Com Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\el90Xbc5.SYS -- (EL90Xbc)
DRV - [2001/08/17 07:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)
DRV - [2001/08/17 06:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\irsir.sys -- (irsir)
DRV - [2001/08/10 00:00:00 | 000,003,252 | ---- | M] () [Kernel | System] -- D:\WINDOWS\System32\drivers\PQNTDRV.SYS -- (PQNTDrv)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\gast_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\ich_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\ich_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\LocalService_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\NetworkService_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\systemprofile_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: de-DE@dictionaries.addons.mozilla.org:1.0.1
FF - prefs.js..extensions.enabledItems: {e968fc70-8f95-4ab9-9e79-304de2a71ee1}:0.6.11
FF - prefs.js..network.proxy.type: 4
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: D:\Programme\Google\Google Updater\2.4.1399.3742\npCIDetect13.dll (Google)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 2.0\extensions\\Components: D:\Mozilla\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 2.0\extensions\\Plugins: D:\Mozilla\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 2.0.0.12\extensions\\Components: D:\MOZILLA\MOZILL~2\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 2.0.0.12\extensions\\Plugins: D:\MOZILLA\MOZILL~2\Mozilla Firefox\plugins
 
[2008/12/06 08:20:02 | 000,000,000 | ---D | M] (No name found) -- D:\Dokumente und Einstellungen\gast\Anwendungsdaten\mozilla\Extensions
[2006/09/05 09:38:44 | 000,000,000 | ---D | M] (No name found) -- D:\Dokumente und Einstellungen\gast\Anwendungsdaten\mozilla\Firefox\Profiles\tm5x48yj.default\extensions
[2008/12/03 10:29:10 | 000,000,000 | ---D | M] (Adblock Plus) -- D:\Dokumente und Einstellungen\gast\Anwendungsdaten\mozilla\Firefox\Profiles\tm5x48yj.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2008/03/21 08:30:14 | 000,000,000 | ---D | M] (User Agent Switcher) -- D:\Dokumente und Einstellungen\gast\Anwendungsdaten\mozilla\Firefox\Profiles\tm5x48yj.default\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}
[2006/12/21 02:28:28 | 000,000,000 | ---D | M] ("Deutsches Wörterbuch">) -- D:\Dokumente und Einstellungen\gast\Anwendungsdaten\mozilla\Firefox\Profiles\tm5x48yj.default\extensions\de-DE@dictionaries.addons.mozilla.org
[2006/06/22 06:44:58 | 002,078,344 | ---- | M] () -- D:\Programme\mozilla firefox\plugins\NPSWF32.dll
 
O1 HOSTS File: ([2001/09/04 10:34:58 | 000,000,820 | ---- | M]) - D:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -  File not found
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -  File not found
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} -  File not found
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Programme\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - D:\Programme\MSN\Toolbar\3.0.0744.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - D:\Programme\MSN\Toolbar\3.0.0744.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  File not found
O3 - HKU\ich_ON_D\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  File not found
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\gast_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\ich_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95
O7 - HKU\LocalService_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\systemprofile_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -  File not found
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -  File not found
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 83.169.184.161 83.169.184.225
O18 - Protocol\Handler\haufereader - No CLSID value found
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - D:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - D:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O30 - LSA: Authentication Packages - (relog_ap) - D:\WINDOWS\System32\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/08/26 07:04:08 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (OODBS) - D:\WINDOWS\System32\OODBS.exe (O&O Software GmbH)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.1.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.1.4
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {77996B2F-590F-662C-C8BF-264CDE6215B1} - Browseranpassungen
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player 9 ActiveX
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - Services: "ose"
MsConfig - Services: "IDriverT"
MsConfig - Services: "EPSONStatusAgent2"
MsConfig - Services: "vsmon"
MsConfig - Services: "NVSvc"
MsConfig - Services: "gusvc"
MsConfig - Services: "FirebirdServerMAGIXInstance"
MsConfig - Services: "Crypkey License"
MsConfig - Services: "ATI Smart"
MsConfig - Services: "Ati HotKey Poller"
MsConfig - Services: "AntiVirService"
MsConfig - Services: "AntiVirScheduler"
MsConfig - Services: "Adobe LM Service"
MsConfig - Services: "AcrSch2Svc"
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Acrobat - Schnellstart.lnk - D:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe - ()
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Gamma Loader.lnk -  - File not found
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^DMX 6fire 2496 ControlPanel.lnk -  - File not found
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^EPSON Status Monitor 3 Environment Check(2).lnk -  - File not found
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Google Updater.lnk - D:\Programme\Google\Google Updater\GoogleUpdater.exe - (Google)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Photo Loader resident.lnk -  - File not found
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Scanner Finder.lnk - D:\Programme\ScanWizard 5\ScannerFinder.exe - ()
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Ulead Kalendar Checker 4.0 SE.lnk -  - File not found
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^ich^Startmenü^Programme^Autostart^Iomega Product Registration.lnk -  - File not found
MsConfig - StartUpReg: Acrobat Assistant 7.0 - hkey= - key= -  File not found
MsConfig - StartUpReg: Acronis Scheduler2 Service - hkey= - key= - D:\Programme\Gemeinsame Dateien\Maxtor\Schedule2\schedhlp.exe (Acronis)
MsConfig - StartUpReg: AcronisTimounterMonitor - hkey= - key= - D:\Programme\Maxtor\MaxBlast\TimounterMonitor.exe (Acronis)
MsConfig - StartUpReg: Alcmtr - hkey= - key= - D:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
MsConfig - StartUpReg: ATICCC - hkey= - key= - D:\Programme\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
MsConfig - StartUpReg: avast! - hkey= - key= -  File not found
MsConfig - StartUpReg: avgnt - hkey= - key= - D:\Programme\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
MsConfig - StartUpReg: BrMfcWnd - hkey= - key= - D:\Programme\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
MsConfig - StartUpReg: ControlCenter3 - hkey= - key= - D:\Programme\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
MsConfig - StartUpReg: CTFMON.EXE - hkey= - key= -  File not found
MsConfig - StartUpReg: H/PC Connection Agent - hkey= - key= -  File not found
MsConfig - StartUpReg: KernelFaultCheck - hkey= - key= -  File not found
MsConfig - StartUpReg: MaxBlastMonitor.exe - hkey= - key= - D:\Programme\Maxtor\MaxBlast\MaxBlastMonitor.exe (Maxtor)
MsConfig - StartUpReg: MSMSGS - hkey= - key= - D:\Programme\Messenger\msmsgs.exe (Microsoft Corporation)
MsConfig - StartUpReg: NBJ - hkey= - key= -  File not found
MsConfig - StartUpReg: NeroFilterCheck - hkey= - key= -  File not found
MsConfig - StartUpReg: nForce Tray Options - hkey= - key= -  File not found
MsConfig - StartUpReg: NvCplDaemon - hkey= - key= -  File not found
MsConfig - StartUpReg: NvMediaCenter - hkey= - key= -  File not found
MsConfig - StartUpReg: nwiz - hkey= - key= -  File not found
MsConfig - StartUpReg: PMCLoader - hkey= - key= -  File not found
MsConfig - StartUpReg: RTHDCPL - hkey= - key= - D:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)
MsConfig - StartUpReg: SkyTel - hkey= - key= - D:\WINDOWS\SkyTel.exe (Realtek Semiconductor Corp.)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= -  File not found
MsConfig - StartUpReg: T-DSL SpeedMgr - hkey= - key= -  File not found
MsConfig - StartUpReg: TkBellExe - hkey= - key= -  File not found
MsConfig - StartUpReg: WMC_AutoUpdate - hkey= - key= -  File not found
MsConfig - StartUpReg: ZoneAlarm Client - hkey= - key= -  File not found
MsConfig - State: "system.ini" - 1
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 1
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/01/29 13:02:44 | 000,000,000 | ---D | C] -- D:\_OTL
[2008/03/14 09:18:02 | 000,089,680 | ---- | C] (Microsoft Corporation) -- D:\Dokumente und Einstellungen\ich\MSSSerif120.fon
[4 D:\WINDOWS\System32\*.tmp files -> D:\WINDOWS\System32\*.tmp -> ]
[3 D:\WINDOWS\*.tmp files -> D:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[4 D:\WINDOWS\System32\*.tmp files -> D:\WINDOWS\System32\*.tmp -> ]
[3 D:\WINDOWS\*.tmp files -> D:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2008/12/23 13:01:33 | 000,502,784 | ---- | C] () -- D:\WINDOWS\x2.64.exe
[2008/12/23 13:01:33 | 000,240,128 | ---- | C] () -- D:\WINDOWS\System32\x.264.exe
[2008/12/23 13:01:33 | 000,217,073 | ---- | C] () -- D:\WINDOWS\meta4.exe
[2008/12/23 13:01:33 | 000,066,560 | ---- | C] () -- D:\WINDOWS\MOTA113.exe
[2008/12/23 13:01:33 | 000,027,648 | ---- | C] () -- D:\WINDOWS\System32\AVSredirect.dll
[2008/12/10 11:19:18 | 000,000,109 | ---- | C] () -- D:\WINDOWS\oodcnt.INI
[2008/12/10 10:49:55 | 000,000,223 | ---- | C] () -- D:\Dokumente und Einstellungen\ich\Goya.ini
[2008/12/10 10:49:23 | 000,000,046 | ---- | C] () -- D:\WINDOWS\Goya.INI
[2008/11/19 12:33:50 | 000,000,164 | ---- | C] () -- D:\WINDOWS\RECMGRUN.INI
[2008/11/19 12:32:53 | 000,003,455 | ---- | C] () -- D:\WINDOWS\RECVCALL.INI
[2008/11/18 11:53:32 | 000,000,004 | ---- | C] () -- D:\WINDOWS\vx86036.dat
[2008/11/18 11:53:23 | 000,000,067 | ---- | C] () -- D:\WINDOWS\Crypkey.ini
[2008/11/18 11:53:20 | 000,031,846 | ---- | C] () -- D:\WINDOWS\System32\Ckldrv.sys
[2008/11/18 11:53:20 | 000,027,648 | R--- | C] () -- D:\WINDOWS\Setup_ck.exe
[2008/11/18 11:53:20 | 000,018,432 | ---- | C] () -- D:\WINDOWS\Setup_ck.dll
[2008/11/18 11:53:20 | 000,011,776 | ---- | C] () -- D:\WINDOWS\Ckrfresh.exe
[2008/11/16 04:02:14 | 000,000,425 | ---- | C] () -- D:\WINDOWS\BRWMARK.INI
[2008/11/16 04:02:14 | 000,000,027 | ---- | C] () -- D:\WINDOWS\BRPP2KA.INI
[2008/11/16 03:59:10 | 000,000,050 | ---- | C] () -- D:\WINDOWS\System32\bridf07a.dat
[2008/11/16 03:58:08 | 000,106,496 | ---- | C] () -- D:\WINDOWS\System32\BrMuSNMP.dll
[2008/05/17 10:49:05 | 000,077,460 | ---- | C] () -- D:\WINDOWS\DIHELP.DAT
[2008/05/17 10:49:05 | 000,038,450 | ---- | C] () -- D:\WINDOWS\PQDI.exe
[2008/05/12 13:39:53 | 000,120,200 | ---- | C] () -- D:\WINDOWS\System32\DLLDEV32i.dll
[2008/05/12 13:38:22 | 000,006,768 | ---- | C] () -- D:\WINDOWS\mgxoschk.ini
[2008/05/04 11:08:49 | 000,020,480 | ---- | C] () -- D:\WINDOWS\System32\CPUINFO2.DLL
[2008/04/19 04:24:24 | 000,049,152 | R--- | C] () -- D:\WINDOWS\System32\ChCfg.exe
[2008/04/11 11:00:16 | 000,036,864 | ---- | C] () -- D:\WINDOWS\Algoui.exe
[2008/04/10 12:14:51 | 000,049,152 | RH-- | C] () -- D:\WINDOWS\System32\CoInst.dll
[2008/03/15 02:50:36 | 000,164,352 | ---- | C] () -- D:\WINDOWS\System32\unrar.dll
[2008/03/15 02:50:35 | 000,755,027 | ---- | C] () -- D:\WINDOWS\System32\xvidcore.dll
[2008/03/15 02:50:34 | 000,159,839 | ---- | C] () -- D:\WINDOWS\System32\xvidvfw.dll
[2008/03/15 02:50:33 | 000,007,680 | ---- | C] () -- D:\WINDOWS\System32\ff_vfw.dll
[2008/02/16 10:56:28 | 000,000,038 | ---- | C] () -- D:\WINDOWS\AviSplitter.INI
[2008/02/10 11:54:09 | 000,035,328 | ---- | C] () -- D:\WINDOWS\System32\cygz.dll
[2008/02/10 11:54:09 | 000,035,328 | ---- | C] () -- D:\WINDOWS\cygz.dll
[2007/12/24 04:43:11 | 000,363,520 | ---- | C] () -- D:\WINDOWS\System32\PsisDecd.dll
[2007/10/27 12:45:03 | 001,284,280 | ---- | C] () -- D:\WINDOWS\System32\XMNT2001.EXE
[2007/10/27 12:45:03 | 000,003,252 | ---- | C] () -- D:\WINDOWS\System32\drivers\PQNTDRV.SYS
[2007/10/16 11:26:41 | 000,069,632 | R--- | C] () -- D:\WINDOWS\System32\xmltok.dll
[2007/10/16 11:26:41 | 000,036,864 | R--- | C] () -- D:\WINDOWS\System32\xmlparse.dll
[2007/10/05 10:54:38 | 000,000,245 | ---- | C] () -- D:\WINDOWS\System32\regupdate.ini
[2007/09/18 20:21:28 | 000,009,384 | ---- | C] () -- D:\WINDOWS\Irremote.ini
[2007/09/18 19:50:55 | 000,593,920 | ---- | C] () -- D:\WINDOWS\System32\ati2sgag.exe
[2007/08/21 20:35:20 | 003,107,788 | ---- | C] () -- D:\WINDOWS\System32\ativvaxx.dat
[2007/08/21 20:35:20 | 003,107,788 | ---- | C] () -- D:\WINDOWS\System32\ativva5x.dat
[2007/08/21 20:35:20 | 000,972,072 | ---- | C] () -- D:\WINDOWS\System32\ativva6x.dat
[2007/08/03 05:28:35 | 000,002,508 | ---- | C] () -- D:\Dokumente und Einstellungen\gast\Anwendungsdaten\$_hpcst$.hpc
[2007/08/02 11:29:36 | 000,002,508 | ---- | C] () -- D:\Dokumente und Einstellungen\ich\Anwendungsdaten\$_hpcst$.hpc
[2007/07/05 10:48:35 | 000,000,092 | R--- | C] () -- D:\WINDOWS\System32\ftdiun2k.ini
[2007/06/07 14:10:48 | 000,020,480 | ---- | C] () -- D:\WINDOWS\System32\ac3config.exe
[2007/05/06 06:01:21 | 000,003,133 | ---- | C] () -- D:\WINDOWS\tm.ini
[2007/03/31 03:20:28 | 000,022,168 | ---- | C] () -- D:\WINDOWS\System32\imsinstall_loc0407.dll
[2007/03/31 03:20:28 | 000,018,072 | ---- | C] () -- D:\WINDOWS\System32\imslsp_install_loc0407.dll
[2007/02/14 12:21:26 | 000,796,584 | ---- | C] () -- D:\WINDOWS\System32\libeay32_0.9.6l.dll
[2007/02/13 10:00:56 | 000,233,868 | ---- | C] () -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\firstlsp.reg.dat
[2007/02/07 06:30:09 | 000,000,161 | ---- | C] () -- D:\WINDOWS\wininit.ini
[2007/01/29 09:20:32 | 001,048,576 | ---- | C] () -- D:\WINDOWS\System32\SFMAN.DAT
[2006/12/19 03:50:26 | 002,244,084 | ---- | C] () -- D:\Dokumente und Einstellungen\gast\Gaggia Bedienungsanleitung.pdf
[2006/11/02 10:10:16 | 000,080,912 | ---- | C] () -- D:\WINDOWS\System32\sherlock2.exe
[2006/11/01 08:11:21 | 000,689,280 | ---- | C] () -- D:\WINDOWS\System32\aswBoot.exe
[2006/10/30 11:15:03 | 000,006,067 | ---- | C] () -- D:\WINDOWS\Unwise32.ini
[2006/10/30 11:15:02 | 000,148,992 | ---- | C] () -- D:\WINDOWS\Unwise32.exe
[2006/10/30 11:12:57 | 000,369,152 | ---- | C] () -- D:\Programme\Rufid.exe
[2006/10/30 11:12:01 | 000,000,092 | ---- | C] () -- D:\WINDOWS\KTEL.INI
[2006/10/11 07:10:29 | 000,008,864 | ---- | C] () -- D:\WINDOWS\System32\drivers\CDAC15BA.SYS
[2006/10/11 06:46:55 | 000,000,070 | ---- | C] () -- D:\WINDOWS\Ulead32.INI
[2006/09/20 03:19:12 | 000,000,116 | ---- | C] () -- D:\WINDOWS\NeroDigital.ini
[2006/09/07 07:34:16 | 000,154,624 | ---- | C] () -- D:\Dokumente und Einstellungen\ich\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/09/07 07:32:07 | 000,000,305 | ---- | C] () -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2006/09/04 13:29:45 | 000,000,514 | ---- | C] () -- D:\WINDOWS\ODBC.INI
[2006/08/31 06:04:05 | 000,005,824 | ---- | C] () -- D:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2006/08/31 04:15:11 | 000,000,407 | ---- | C] () -- D:\Programme\Verknüpfung (2) mit Outlook Express.lnk
[2006/08/31 04:14:36 | 000,000,407 | ---- | C] () -- D:\Programme\Verknüpfung mit Outlook Express.lnk
[2006/08/30 12:36:08 | 000,285,216 | ---- | C] () -- D:\WINDOWS\System32\drivers\Onsio.sys
[2006/08/30 12:36:08 | 000,007,680 | ---- | C] () -- D:\WINDOWS\System32\drivers\Onsreged.sys
[2006/08/28 14:33:53 | 000,004,212 | -H-- | C] () -- D:\WINDOWS\System32\zllictbl.dat
[2006/08/28 12:12:04 | 000,081,920 | ---- | C] () -- D:\WINDOWS\System32\ieencode.dll
[2006/08/26 13:05:53 | 000,000,552 | ---- | C] () -- D:\WINDOWS\System32\d3d8caps.dat
[2006/08/26 12:21:25 | 000,000,000 | ---- | C] () -- D:\WINDOWS\nsreg.dat
[2006/08/26 12:21:16 | 000,003,418 | ---- | C] () -- D:\WINDOWS\mozver.dat
[2006/08/26 11:08:52 | 000,004,831 | ---- | C] () -- D:\WINDOWS\Ascd_tmp.ini
[2006/08/26 07:07:34 | 000,002,048 | --S- | C] () -- D:\WINDOWS\bootstat.dat
[2006/08/26 07:00:51 | 000,021,740 | ---- | C] () -- D:\WINDOWS\System32\emptyregdb.dat
[2006/08/26 06:50:42 | 000,004,161 | ---- | C] () -- D:\WINDOWS\ODBCINST.INI
[2006/08/26 06:49:46 | 000,286,112 | ---- | C] () -- D:\WINDOWS\System32\FNTCACHE.DAT
[2006/06/01 10:22:00 | 001,662,976 | ---- | C] () -- D:\WINDOWS\System32\nvwdmcpl.dll
[2006/06/01 10:22:00 | 001,519,616 | ---- | C] () -- D:\WINDOWS\System32\nwiz.exe
[2006/06/01 10:22:00 | 001,466,368 | ---- | C] () -- D:\WINDOWS\System32\nview.dll
[2006/06/01 10:22:00 | 001,339,392 | ---- | C] () -- D:\WINDOWS\System32\nvdspsch.exe
[2006/06/01 10:22:00 | 001,019,904 | ---- | C] () -- D:\WINDOWS\System32\nvwimg.dll
[2006/06/01 10:22:00 | 000,581,632 | ---- | C] () -- D:\WINDOWS\System32\nvhwvid.dll
[2006/06/01 10:22:00 | 000,466,944 | ---- | C] () -- D:\WINDOWS\System32\nvShell.dll
[2006/06/01 10:22:00 | 000,442,368 | ---- | C] () -- D:\WINDOWS\System32\nvAppBar.exe
[2006/06/01 10:22:00 | 000,425,984 | ---- | C] () -- D:\WINDOWS\System32\keystone.exe
[2006/06/01 10:22:00 | 000,286,720 | ---- | C] () -- D:\WINDOWS\System32\nvnt4cpl.dll
[2006/06/01 10:22:00 | 000,196,608 | ---- | C] () -- D:\WINDOWS\System32\NVAPI.DLL
[2006/04/28 15:05:14 | 000,156,671 | ---- | C] () -- D:\WINDOWS\System32\atiicdxx.dat
[2004/08/02 07:20:40 | 000,004,569 | ---- | C] () -- D:\WINDOWS\System32\secupd.dat
[2003/02/20 10:53:42 | 000,005,702 | ---- | C] () -- D:\WINDOWS\System32\OUTLPERF.INI
[2001/10/10 01:57:58 | 000,073,786 | ---- | C] () -- D:\WINDOWS\System32\dntvmc23.dll
[2001/10/10 01:57:58 | 000,061,497 | ---- | C] () -- D:\WINDOWS\System32\dntvm23.dll
[2001/09/04 10:35:46 | 000,027,440 | ---- | C] () -- D:\WINDOWS\System32\drivers\secdrv.sys
[2001/09/04 10:35:36 | 000,408,618 | ---- | C] () -- D:\WINDOWS\System32\perfh007.dat
[2001/09/04 10:35:36 | 000,395,200 | ---- | C] () -- D:\WINDOWS\System32\perfh009.dat
[2001/09/04 10:35:36 | 000,272,128 | ---- | C] () -- D:\WINDOWS\System32\perfi009.dat
[2001/09/04 10:35:36 | 000,269,480 | ---- | C] () -- D:\WINDOWS\System32\perfi007.dat
[2001/09/04 10:35:36 | 000,034,478 | ---- | C] () -- D:\WINDOWS\System32\perfd007.dat
[2001/09/04 10:35:36 | 000,028,626 | ---- | C] () -- D:\WINDOWS\System32\perfd009.dat
[2001/09/04 10:35:35 | 000,071,598 | ---- | C] () -- D:\WINDOWS\System32\perfc007.dat
[2001/09/04 10:35:35 | 000,059,440 | ---- | C] () -- D:\WINDOWS\System32\perfc009.dat
[2001/09/04 10:35:33 | 013,107,200 | ---- | C] () -- D:\WINDOWS\System32\oembios.bin
[2001/09/04 10:35:33 | 000,004,463 | ---- | C] () -- D:\WINDOWS\System32\oembios.dat
[2001/09/04 10:35:26 | 000,000,741 | ---- | C] () -- D:\WINDOWS\System32\noise.dat
[2001/09/04 10:35:09 | 000,673,088 | ---- | C] () -- D:\WINDOWS\System32\mlang.dat
[2001/09/04 10:35:08 | 000,046,258 | ---- | C] () -- D:\WINDOWS\System32\mib.bin
[2001/09/04 10:34:48 | 000,218,003 | ---- | C] () -- D:\WINDOWS\System32\dssec.dat
[2001/09/04 10:34:21 | 000,001,788 | ---- | C] () -- D:\WINDOWS\System32\Dcache.bin
[2001/03/07 01:02:30 | 000,229,431 | ---- | C] () -- D:\WINDOWS\System32\dnt23.dll
[2000/09/13 19:03:00 | 000,000,145 | ---- | C] () -- D:\WINDOWS\System32\EBPPORT.DAT
 
========== LOP Check ==========
 
[2007/02/14 13:22:50 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic
[2008/12/06 11:49:02 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ashampoo
[2006/12/02 02:57:24 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avg7
[2007/04/20 01:57:10 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BTrieve
[2007/04/20 01:55:44 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Haufe
[2007/04/20 01:57:02 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lexware
[2008/05/12 13:45:42 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2008/11/20 12:53:04 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Maxtor
[2007/03/31 02:56:00 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\My Pictures
[2007/12/24 04:49:28 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pinnacle
[2006/08/27 07:18:54 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-DSL SpeedManager
[2008/11/19 11:37:10 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2006/09/02 05:44:10 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ulead Systems
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2010/10/01 10:39:52 | 000,000,000 | -HSD | M] -- D:\$RECYCLE.BIN
[2007/10/11 12:00:08 | 000,000,000 | ---D | M] -- D:\ATI
[2011/03/07 15:01:28 | 000,000,000 | ---D | M] -- D:\bd_logs
[2008/11/16 03:58:06 | 000,000,000 | ---D | M] -- D:\Brother
[2007/02/12 11:37:46 | 000,000,000 | ---D | M] -- D:\Config.Msi
[2006/08/26 06:49:48 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen
[2006/08/27 03:34:56 | 000,000,000 | ---D | M] -- D:\Kpcms
[2006/12/06 04:20:40 | 000,000,000 | ---D | M] -- D:\Lang
[2006/08/26 12:57:10 | 000,000,000 | ---D | M] -- D:\MyVideos
[2008/12/07 03:59:52 | 000,000,000 | ---D | M] -- D:\OpenCandy
[2006/11/28 08:23:26 | 000,000,000 | ---D | M] -- D:\pentax
[2006/08/27 02:52:34 | 000,000,000 | ---D | M] -- D:\PerfLogs
[2006/12/06 04:20:40 | 000,000,000 | ---D | M] -- D:\Plugins
[2010/12/28 05:41:25 | 000,000,000 | ---D | M] -- D:\Program Files
[2012/05/19 09:10:43 | 000,000,000 | R--D | M] -- D:\Programme
[2008/11/19 12:43:24 | 000,000,000 | ---D | M] -- D:\Recover
[2006/08/26 11:24:22 | 000,000,000 | -HSD | M] -- D:\Recycled
[2013/01/29 12:57:49 | 000,000,000 | -HSD | M] -- D:\RECYCLER
[2010/04/02 11:41:39 | 000,000,000 | -HSD | M] -- D:\System Volume Information
[2007/06/18 10:54:46 | 000,000,000 | ---D | M] -- D:\Temp
[2006/08/26 06:45:20 | 000,000,000 | ---D | M] -- D:\WINDOWS
[2013/01/29 13:02:44 | 000,000,000 | ---D | M] -- D:\_OTL
 
< %PROGRAMFILES%\*.exe >
[1999/06/05 12:18:30 | 000,369,152 | ---- | M] () -- D:\Programme\Rufid.exe
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2004/08/03 18:10:00 | 018,782,319 | ---- | M] () .cab file -- D:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2004/08/03 18:10:00 | 018,782,319 | ---- | M] () .cab file -- D:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2004/08/03 16:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- D:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2004/08/03 16:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- D:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004/08/03 18:10:00 | 018,782,319 | ---- | M] () .cab file -- D:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2004/08/03 18:10:00 | 018,782,319 | ---- | M] () .cab file -- D:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2001/08/17 06:51:56 | 000,086,656 | ---- | M] (Microsoft Corporation) MD5=A64013E98426E1877CB653685C5C0009 -- D:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/03 15:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- D:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2004/08/03 15:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- D:\WINDOWS\system32\dllcache\atapi.sys
[2004/08/03 15:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- D:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 15:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- D:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2004/08/03 17:57:20 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- D:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2004/08/03 17:57:20 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- D:\WINDOWS\system32\eventlog.dll
[2001/09/04 10:34:52 | 000,047,616 | ---- | M] (Microsoft Corporation) MD5=D9D9F2CC2AE17FDE1858F43CD93140C0 -- D:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2004/08/03 17:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- D:\WINDOWS\explorer.exe
[2004/08/03 17:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- D:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2001/09/04 10:34:52 | 001,004,032 | ---- | M] (Microsoft Corporation) MD5=D1A32C0C43F7CB53050042FD631020D9 -- D:\WINDOWS\$NtServicePackUninstall$\explorer.exe
 
< MD5 for: NETLOGON.DLL  >
[2001/09/04 10:35:24 | 000,397,824 | ---- | M] (Microsoft Corporation) MD5=3DBBB866B1E7287E899DA9BC20E9F129 -- D:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2004/08/03 17:57:32 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- D:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2004/08/03 17:57:32 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- D:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2004/08/03 17:57:34 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- D:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2004/08/03 17:57:34 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- D:\WINDOWS\system32\scecli.dll
[2001/09/04 10:35:46 | 000,180,736 | ---- | M] (Microsoft Corporation) MD5=8AF9B2782330AF8BD46B30239E455E77 -- D:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2004/08/03 17:57:38 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- D:\WINDOWS\ServicePackFiles\i386\user32.dll
[2004/08/03 17:57:38 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- D:\WINDOWS\system32\user32.dll
[2001/09/04 10:36:08 | 000,562,688 | ---- | M] (Microsoft Corporation) MD5=6873D38E021EAC4E0B508D1822157C1D -- D:\WINDOWS\$NtServicePackUninstall$\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2001/09/04 10:36:08 | 000,022,016 | ---- | M] (Microsoft Corporation) MD5=292F283D9E2D49A91DF039C1076ACD18 -- D:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2004/08/03 17:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- D:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2004/08/03 17:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- D:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004/08/03 17:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- D:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2004/08/03 17:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- D:\WINDOWS\system32\winlogon.exe
[2001/09/04 10:36:16 | 000,435,200 | ---- | M] (Microsoft Corporation) MD5=5DAC883C68D261D406489F3F990D8DDF -- D:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2001/09/04 10:36:20 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- D:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2001/09/04 10:36:20 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- D:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006/08/26 06:48:56 | 000,094,208 | ---- | M] () -- D:\WINDOWS\System32\config\default.sav
[2006/08/26 06:48:56 | 000,634,880 | ---- | M] () -- D:\WINDOWS\System32\config\software.sav
[2006/08/26 06:48:56 | 000,409,600 | ---- | M] () -- D:\WINDOWS\System32\config\system.sav
 
< %systemroot%\system32\*.dll /lockedfiles >
[2004/08/03 17:57:34 | 008,424,960 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- D:\WINDOWS\system32\shell32.dll
[4 D:\WINDOWS\system32\*.tmp files -> D:\WINDOWS\system32\*.tmp -> ]
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
 
<          • Drücke Run Scan um den Scan zu starten. >
 
< • Wenn er fertig ist werden die Dateien in C:\otl.txt gesichert >
 
< • Kopiere diesen Ordner auf deinen USB-Stick wenn  >
 
========== Files - Unicode (All) ==========
Smileys[2008/11/19 11:07:44 | 000,000,000 | ---D | M](D:\WINDOWS\System32\??????????) -- D:\WINDOWS\System32\粑۰粒??۫粒⁃睌
*[Weitere] Trackback:Send Trackbacks to ([2008/11/19 11:07:43 | 000,000,000 | ---D | C](D:\WINDOWS\System32\??????????) -- D:\WINDOWS\System32\粑۰粒??۫粒⁃睌
< End of report >
Separat

hoffe das es so gut ist.
Danke an Euch fuer Eure Muehe mit mir

Gruss Christian

Hallo
habe die Angaben ins Textfeld von OTL eingegeben und auf RUN FIX gedrueckt. Hier das Ergebnis
Code:
ATTFilter
Error: Unable to interpret <%SYSTEMDRIVE%\*.> in the current context!
Error: Unable to interpret <%PROGRAMFILES%\*.exe> in the current context!
Error: Unable to interpret <%LOCALAPPDATA%\*.exe> in the current context!
Error: Unable to interpret <%systemroot%\*. /mp /s> in the current context!
Error: Unable to interpret </md5start> in the current context!
Error: Unable to interpret <userinit.exe> in the current context!
Error: Unable to interpret <eventlog.dll> in the current context!
Error: Unable to interpret <scecli.dll> in the current context!
Error: Unable to interpret <netlogon.dll> in the current context!
Error: Unable to interpret <cngaudit.dll> in the current context!
Error: Unable to interpret <ws2ifsl.sys> in the current context!
Error: Unable to interpret <sceclt.dll> in the current context!
Error: Unable to interpret <ntelogon.dll> in the current context!
Error: Unable to interpret <winlogon.exe> in the current context!
Error: Unable to interpret <logevent.dll> in the current context!
Error: Unable to interpret <user32.DLL> in the current context!
Error: Unable to interpret <explorer.exe> in the current context!
Error: Unable to interpret <iaStor.sys> in the current context!
Error: Unable to interpret <nvstor.sys> in the current context!
Error: Unable to interpret <atapi.sys> in the current context!
Error: Unable to interpret <IdeChnDr.sys> in the current context!
Error: Unable to interpret <viasraid.sys> in the current context!
Error: Unable to interpret <AGP440.sys> in the current context!
Error: Unable to interpret <vaxscsi.sys> in the current context!
Error: Unable to interpret <nvatabus.sys> in the current context!
Error: Unable to interpret <viamraid.sys> in the current context!
Error: Unable to interpret <nvata.sys> in the current context!
Error: Unable to interpret <nvgts.sys> in the current context!
Error: Unable to interpret <iastorv.sys> in the current context!
Error: Unable to interpret <ViPrt.sys> in the current context!
Error: Unable to interpret <eNetHook.dll> in the current context!
Error: Unable to interpret <ahcix86.sys> in the current context!
Error: Unable to interpret <KR10N.sys> in the current context!
Error: Unable to interpret <nvstor32.sys> in the current context!
Error: Unable to interpret <ahcix86s.sys> in the current context!
Error: Unable to interpret </md5stop> in the current context!
Error: Unable to interpret <%systemroot%\system32\drivers\*.sys /lockedfiles> in the current context!
Error: Unable to interpret <%systemroot%\System32\config\*.sav> in the current context!
Error: Unable to interpret <%systemroot%\system32\*.dll /lockedfiles> in the current context!
Error: Unable to interpret <%USERPROFILE%\*.*> in the current context!
Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.exe> in the current context!
Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.dll> in the current context!
Error: Unable to interpret <%USERPROFILE%\Application Data\*.exe> in the current context!
Error: Unable to interpret <         • Drücke Run Scan um den Scan zu starten.> in the current context!
Error: Unable to interpret <• Wenn er fertig ist werden die Dateien in C:\otl.txt gesichert> in the current context!
Error: Unable to interpret <• Kopiere diesen Ordner auf deinen USB-Stick wenn > in the current context!
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 01302013_163055
Gruss Christian

Hallo
noch eine vielleicht wichtige info: Auf dem Arbeitsplatz vom OTL System wird die Platte C:zwar angezeigt, aber ohne Kapazitaetsangabe wie die anderen Platten. Ein Zugriff ist auch nicht moeglich. Die mbam.exe m;chte sich immer auf laufwerk x: installieren, aber das hat 0 Byte. Installation auf einem anderen Laufwerk ist nicht m;glich: es kommt die Meldung, Windows Version zu alt SP 3 noetig.

gruss Christian

Alt 31.01.2013, 18:59   #5
markusg
/// Malware-holic
 
Windows XP startet auch nicht im abgesichtern Modus - Standard

Windows XP startet auch nicht im abgesichtern Modus


auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:
Code:
ATTFilter
:OTL
:Files
:Commands
[EMPTYFLASH] 
[emptytemp]


dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 31.01.2013, 19:57   #6
paulibins
 
Windows XP startet auch nicht im abgesichtern Modus - Standard

Windows XP startet auch nicht im abgesichtern Modus


Hallo
danke f[r den fix.
Hab ihn eingegeben und auf run fix gedrueckt. PC ist nicht neu gestartet und hat auch kein OTL.txt ausgegeben sondern nur dies
Code:
ATTFilter
========== OTL ==========
========== FILES ==========
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: Administrator
->Temporary Internet Files folder emptied: 120499 bytes
 
User: Administrator.PAUL
->Temporary Internet Files folder emptied: 32768 bytes
 
User: Administrator.PAUL.000
->Temporary Internet Files folder emptied: 32768 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 83 bytes
 
User: gast
->Temp folder emptied: 1884769975 bytes
->Temporary Internet Files folder emptied: 430060305 bytes
->FireFox cache emptied: 40872929 bytes
->Flash cache emptied: 1518400 bytes
 
User: ich
->Temp folder emptied: 2087759412 bytes
->Temporary Internet Files folder emptied: 116571220 bytes
->Java cache emptied: 206448 bytes
->FireFox cache emptied: 4176520 bytes
->Flash cache emptied: 1810 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes
 
Total Flash Files Cleaned = 4,355.00 mb
 
 
[EMPTYTEMP]
 
User: Administrator
->Temporary Internet Files folder emptied: 0 bytes
 
User: Administrator.PAUL
->Temporary Internet Files folder emptied: 0 bytes
 
User: Administrator.PAUL.000
->Temporary Internet Files folder emptied: 0 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: gast
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: ich
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1099811 bytes
%systemroot%\System32 .tmp files removed: 1922352 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 13205232 bytes
 
Total Files Cleaned = 15.00 mb
 
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 01312013_195046
Gruss
Christian

Alt 02.02.2013, 21:57   #7
paulibins
 
Windows XP startet auch nicht im abgesichtern Modus - Standard

Windows XP startet auch nicht im abgesichtern Modus


Hallo
habe noch folgende Logs die vielleicht weiterhelfen. MBR und Kaspersky laufen leider nicht.
Code:
ATTFilter
OTL logfile created on: 2/1/2013 1:52:37 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 84.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 95.00% Paging File free
Paging file location(s): C:\pagefile.sys 3070 3070 [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Programme
Drive D: | 135.01 Gb Total Space | 113.71 Gb Free Space | 84.23% Space Free | Partition Type: NTFS
Drive E: | 410.15 Gb Total Space | 311.89 Gb Free Space | 76.04% Space Free | Partition Type: NTFS
Drive F: | 404.17 Gb Total Space | 273.50 Gb Free Space | 67.67% Space Free | Partition Type: NTFS
Drive G: | 99.96 Gb Total Space | 81.87 Gb Free Space | 81.90% Space Free | Partition Type: NTFS
Drive H: | 100.73 Gb Total Space | 35.54 Gb Free Space | 35.28% Space Free | Partition Type: NTFS
Drive I: | 130.07 Gb Total Space | 26.45 Gb Free Space | 20.34% Space Free | Partition Type: NTFS
Drive K: | 31.23 Gb Total Space | 31.18 Gb Free Space | 99.82% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet005
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled] --  -- (FirebirdServerMAGIXInstance)
SRV - [2008/04/15 10:15:24 | 000,147,201 | ---- | M] (Avira GmbH) [Disabled] -- D:\Programme\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService)
SRV - [2008/04/15 10:15:24 | 000,068,865 | ---- | M] (Avira GmbH) [Disabled] -- D:\Programme\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler)
SRV - [2007/08/23 07:52:50 | 000,410,904 | ---- | M] (Acronis) [Disabled] -- D:\Programme\Gemeinsame Dateien\Maxtor\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2007/03/08 17:01:58 | 000,075,568 | ---- | M] (Zone Labs, LLC) [Auto] -- D:\WINDOWS\System32\ZONELABS\vsmon.exe -- (vsmon)
SRV - [2006/09/20 12:44:10 | 000,069,632 | ---- | M] (Adobe Systems) [On_Demand] -- D:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2006/02/28 19:10:20 | 000,069,632 | ---- | M] (CrypKey (Canada) Ltd.) [Disabled] -- D:\WINDOWS\System32\Crypserv.exe -- (Crypkey License)
SRV - [2004/10/21 19:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [Disabled] -- D:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/05/17 07:57:00 | 000,184,320 | ---- | M] (O&O Software GmbH) [Auto] -- D:\WINDOWS\system32\oodag.exe -- (O&O Defrag)
SRV - [2003/07/28 05:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [Disabled] -- D:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2001/08/08 19:01:00 | 000,090,112 | ---- | M] (SEIKO EPSON CORPORATION) [Disabled] -- D:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe -- (EPSONStatusAgent2)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WINFOXIO)
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (TSMPacket)
DRV - File not found [Kernel | On_Demand] --  -- (SANDRA)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand] --  -- (MEMSWEEP2)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | On_Demand] --  -- (CrystalSysInfo)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2008/11/20 12:49:04 | 000,400,864 | ---- | M] (Acronis) [Kernel | Boot] -- D:\WINDOWS\system32\drivers\timntr.sys -- (timounter)
DRV - [2008/11/20 12:49:04 | 000,032,768 | ---- | M] (Acronis) [File_System | Auto] -- D:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter)
DRV - [2008/11/20 12:48:54 | 000,120,992 | ---- | M] (Acronis) [Kernel | Boot] -- D:\WINDOWS\system32\drivers\snapman.sys -- (snapman)
DRV - [2008/04/15 10:15:24 | 000,079,424 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2008/04/15 10:15:24 | 000,049,472 | ---- | M] (Avira GmbH) [File_System | On_Demand] -- D:\Programme\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt)
DRV - [2008/04/15 10:15:24 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2007/10/28 10:35:14 | 000,583,128 | ---- | M] (Protect Software GmbH) [Kernel | Auto] -- D:\WINDOWS\system32\drivers\ACEDRV10.sys -- (acedrv10)
DRV - [2007/10/26 08:53:46 | 000,250,560 | ---- | M] (Protect Software GmbH) [Kernel | Auto] -- D:\WINDOWS\system32\drivers\acehlp10.sys -- (acehlp10)
DRV - [2007/08/31 15:07:50 | 000,407,328 | ---- | M] (Sensaura) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\dmxsens.sys -- (dmxsens)
DRV - [2007/08/31 15:07:40 | 000,099,680 | ---- | M] (Terratec Electronic GmbH) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\dmx6fire.sys -- (dmxfire)
DRV - [2007/08/21 21:07:40 | 002,417,664 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2007/06/14 06:41:00 | 000,466,048 | R--- | M] (LITEON) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\Ltn_stk7070P.sys -- (Ltn_stk7070P)
DRV - [2007/06/13 11:30:20 | 000,013,440 | R--- | M] (LITEON) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\Ltn_stkrc.sys -- (Ltn_stkrc)
DRV - [2007/04/22 02:06:36 | 000,011,840 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Programme\AntiVir PersonalEdition Classic\avgio.sys -- (avgio)
DRV - [2007/03/08 17:02:10 | 000,394,192 | ---- | M] (Zone Labs, LLC) [Kernel | System] -- D:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2007/03/01 04:27:26 | 004,484,608 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/01/17 22:39:20 | 000,050,416 | ---- | M] (Zone Labs, LLC) [Kernel | Boot] -- D:\WINDOWS\system32\ZoneLabs\srescan.sys -- (srescan)
DRV - [2006/10/17 07:22:26 | 000,009,216 | R--- | M] (VIA Technologies, Inc.) [Kernel | Boot] -- D:\WINDOWS\system32\drivers\videX32.sys -- (videX32)
DRV - [2006/10/11 07:10:30 | 000,008,864 | ---- | M] () [Kernel | Auto] -- D:\WINDOWS\system32\drivers\CDAC15BA.SYS -- (CdaC15BA)
DRV - [2006/01/25 09:14:06 | 000,472,644 | ---- | M] (Hauppauge Computer Works) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\HCWBT8xx.sys -- (HCWBT8XX)
DRV - [2006/01/09 20:47:28 | 000,031,846 | ---- | M] () [Kernel | System] -- D:\WINDOWS\system32\ckldrv.sys -- (NetworkX)
DRV - [2004/08/03 20:08:36 | 000,013,824 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\atinmdxx.sys -- (MVDCODEC)
DRV - [2004/08/03 20:08:30 | 000,105,984 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\atinrvxx.sys -- (atinrvxx)
DRV - [2004/08/03 16:10:14 | 000,015,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\MPE.sys -- (MPE)
DRV - [2004/08/03 16:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2004/08/03 16:07:46 | 000,223,616 | ---- | M] (Microsoft Corporation) [Kernel | System] -- D:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2004/08/03 15:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)
DRV - [2004/03/22 09:40:38 | 000,040,448 | R--- | M] (Susteen Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\SUSCOM.SYS -- (SUSCOM)
DRV - [2003/09/16 04:00:10 | 000,019,153 | R--- | M] (FTDI Ltd.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ftdibus.sys -- (FTDIBUS)
DRV - [2003/09/16 04:00:02 | 000,006,828 | R--- | M] (FTDI Ltd.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ftlund.sys -- (FTLUND)
DRV - [2003/09/16 03:59:54 | 000,050,396 | R--- | M] (FTDI Ltd.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ftser2k.sys -- (FTSER2K)
DRV - [2003/09/05 10:30:32 | 000,011,776 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\Dokumente und Einstellungen\All Users\Dokumente\Eigene Bilder\ATI BIOS\WinFlash\ATIXPGAA.SYS -- (ATIXPGAA)
DRV - [2002/08/13 08:27:22 | 000,074,338 | ---- | M] (3Com Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\el90Xbc5.SYS -- (EL90Xbc)
DRV - [2001/08/17 07:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)
DRV - [2001/08/17 06:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\irsir.sys -- (irsir)
DRV - [2001/08/10 00:00:00 | 000,003,252 | ---- | M] () [Kernel | System] -- D:\WINDOWS\System32\drivers\PQNTDRV.SYS -- (PQNTDrv)
 
 
========== Standard Registry (All) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
IE - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\gast_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\ich_ON_D\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\ich_ON_D\Software\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKU\ich_ON_D\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\ich_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\ich_ON_D\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - D:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation)
IE - HKU\ich_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\LocalService_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\NetworkService_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\systemprofile_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: D:\Programme\Google\Google Updater\2.4.1399.3742\npCIDetect13.dll (Google)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 2.0\extensions\\Components: D:\Mozilla\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 2.0\extensions\\Plugins: D:\Mozilla\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 2.0.0.12\extensions\\Components: D:\MOZILLA\MOZILL~2\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 2.0.0.12\extensions\\Plugins: D:\MOZILLA\MOZILL~2\Mozilla Firefox\plugins
 
[2003/07/14 15:56:52 | 000,013,888 | ---- | M] (Microsoft Corporation) -- D:\Programme\mozilla firefox\plugins\NPOFFICE.DLL
[2006/09/01 03:56:06 | 000,139,305 | ---- | M] (RealNetworks, Inc.) -- D:\Programme\mozilla firefox\plugins\nppl3260.dll
[2006/09/01 03:56:22 | 000,024,621 | ---- | M] (RealNetworks, Inc.) -- D:\Programme\mozilla firefox\plugins\nprjplug.dll
[2006/09/01 03:56:02 | 000,081,967 | ---- | M] (RealNetworks, Inc.) -- D:\Programme\mozilla firefox\plugins\nprpjplug.dll
[2006/06/22 06:44:58 | 002,078,344 | ---- | M] () -- D:\Programme\mozilla firefox\plugins\NPSWF32.dll
 
O1 HOSTS File: ([2001/09/04 10:34:58 | 000,000,820 | ---- | M]) - D:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -  File not found
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -  File not found
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} -  File not found
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Programme\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - D:\Programme\MSN\Toolbar\3.0.0744.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - D:\Programme\MSN\Toolbar\3.0.0744.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  File not found
O3 - HKU\ich_ON_D\..\Toolbar\ShellBrowser: (&Adresse) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - D:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKU\ich_ON_D\..\Toolbar\WebBrowser: (&Adresse) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - D:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKU\ich_ON_D\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - D:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O3 - HKU\ich_ON_D\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  File not found
O4 - HKU\.DEFAULT..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
O4 - HKU\gast_ON_D..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_D..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_D..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
O4 - HKU\systemprofile_ON_D..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\gast_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\ich_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95
O7 - HKU\LocalService_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\systemprofile_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -  File not found
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -  File not found
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programme\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programme\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - D:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - D:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - D:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000030 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000031 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000032 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000033 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000034 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000035 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000036 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000037 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000038 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000039 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000040 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000041 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 83.169.184.161 83.169.184.225
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - D:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\haufereader - No CLSID value found
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - D:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\lid {5C135180-9973-46D9-ABF4-148267CBB8BF} - D:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - D:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - D:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - D:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - D:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - D:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - D:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - D:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - D:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - D:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - D:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - D:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - D:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - D:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - D:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - D:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - D:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - D:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - D:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - D:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - D:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - D:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - D:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - D:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - D:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - D:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - D:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - D:\WINDOWS\system32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - D:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - D:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - D:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O24 - Desktop WallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - D:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - D:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - D:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - D:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - D:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - D:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (relog_ap) - D:\WINDOWS\System32\relog_ap.dll (Acronis)
O30 - LSA: Security Packages - (kerberos) - D:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - D:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - D:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - D:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/08/26 07:04:08 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (OODBS) - D:\WINDOWS\System32\OODBS.exe (O&O Software GmbH)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/01/29 13:02:44 | 000,000,000 | ---D | C] -- D:\_OTL
[2008/03/14 09:18:02 | 000,089,680 | ---- | C] (Microsoft Corporation) -- D:\Dokumente und Einstellungen\ich\MSSSerif120.fon
 
========== Files - Modified Within 30 Days ==========
 
 
========== Files Created - No Company Name ==========
 
[2008/12/23 13:01:33 | 000,502,784 | ---- | C] () -- D:\WINDOWS\x2.64.exe
[2008/12/23 13:01:33 | 000,240,128 | ---- | C] () -- D:\WINDOWS\System32\x.264.exe
[2008/12/23 13:01:33 | 000,217,073 | ---- | C] () -- D:\WINDOWS\meta4.exe
[2008/12/23 13:01:33 | 000,066,560 | ---- | C] () -- D:\WINDOWS\MOTA113.exe
[2008/12/23 13:01:33 | 000,027,648 | ---- | C] () -- D:\WINDOWS\System32\AVSredirect.dll
[2008/12/10 11:19:18 | 000,000,109 | ---- | C] () -- D:\WINDOWS\oodcnt.INI
[2008/12/10 10:49:55 | 000,000,223 | ---- | C] () -- D:\Dokumente und Einstellungen\ich\Goya.ini
[2008/12/10 10:49:23 | 000,000,046 | ---- | C] () -- D:\WINDOWS\Goya.INI
[2008/11/19 12:33:50 | 000,000,164 | ---- | C] () -- D:\WINDOWS\RECMGRUN.INI
[2008/11/19 12:32:53 | 000,003,455 | ---- | C] () -- D:\WINDOWS\RECVCALL.INI
[2008/11/18 11:53:32 | 000,000,004 | ---- | C] () -- D:\WINDOWS\vx86036.dat
[2008/11/18 11:53:23 | 000,000,067 | ---- | C] () -- D:\WINDOWS\Crypkey.ini
[2008/11/18 11:53:20 | 000,031,846 | ---- | C] () -- D:\WINDOWS\System32\Ckldrv.sys
[2008/11/18 11:53:20 | 000,027,648 | R--- | C] () -- D:\WINDOWS\Setup_ck.exe
[2008/11/18 11:53:20 | 000,018,432 | ---- | C] () -- D:\WINDOWS\Setup_ck.dll
[2008/11/18 11:53:20 | 000,011,776 | ---- | C] () -- D:\WINDOWS\Ckrfresh.exe
[2008/11/16 04:02:14 | 000,000,425 | ---- | C] () -- D:\WINDOWS\BRWMARK.INI
[2008/11/16 04:02:14 | 000,000,027 | ---- | C] () -- D:\WINDOWS\BRPP2KA.INI
[2008/11/16 03:59:10 | 000,000,050 | ---- | C] () -- D:\WINDOWS\System32\bridf07a.dat
[2008/11/16 03:58:08 | 000,106,496 | ---- | C] () -- D:\WINDOWS\System32\BrMuSNMP.dll
[2008/05/17 10:49:05 | 000,077,460 | ---- | C] () -- D:\WINDOWS\DIHELP.DAT
[2008/05/17 10:49:05 | 000,038,450 | ---- | C] () -- D:\WINDOWS\PQDI.exe
[2008/05/12 13:39:53 | 000,120,200 | ---- | C] () -- D:\WINDOWS\System32\DLLDEV32i.dll
[2008/05/12 13:38:22 | 000,006,768 | ---- | C] () -- D:\WINDOWS\mgxoschk.ini
[2008/05/04 11:08:49 | 000,020,480 | ---- | C] () -- D:\WINDOWS\System32\CPUINFO2.DLL
[2008/04/19 04:24:24 | 000,049,152 | R--- | C] () -- D:\WINDOWS\System32\ChCfg.exe
[2008/04/11 11:00:16 | 000,036,864 | ---- | C] () -- D:\WINDOWS\Algoui.exe
[2008/04/10 12:14:51 | 000,049,152 | RH-- | C] () -- D:\WINDOWS\System32\CoInst.dll
[2008/03/15 02:50:36 | 000,164,352 | ---- | C] () -- D:\WINDOWS\System32\unrar.dll
[2008/03/15 02:50:35 | 000,755,027 | ---- | C] () -- D:\WINDOWS\System32\xvidcore.dll
[2008/03/15 02:50:34 | 000,159,839 | ---- | C] () -- D:\WINDOWS\System32\xvidvfw.dll
[2008/03/15 02:50:33 | 000,007,680 | ---- | C] () -- D:\WINDOWS\System32\ff_vfw.dll
[2008/02/16 10:56:28 | 000,000,038 | ---- | C] () -- D:\WINDOWS\AviSplitter.INI
[2008/02/10 11:54:09 | 000,035,328 | ---- | C] () -- D:\WINDOWS\System32\cygz.dll
[2008/02/10 11:54:09 | 000,035,328 | ---- | C] () -- D:\WINDOWS\cygz.dll
[2007/12/24 04:43:11 | 000,363,520 | ---- | C] () -- D:\WINDOWS\System32\PsisDecd.dll
[2007/10/27 12:45:03 | 001,284,280 | ---- | C] () -- D:\WINDOWS\System32\XMNT2001.EXE
[2007/10/27 12:45:03 | 000,003,252 | ---- | C] () -- D:\WINDOWS\System32\drivers\PQNTDRV.SYS
[2007/10/16 11:26:41 | 000,069,632 | R--- | C] () -- D:\WINDOWS\System32\xmltok.dll
[2007/10/16 11:26:41 | 000,036,864 | R--- | C] () -- D:\WINDOWS\System32\xmlparse.dll
[2007/10/05 10:54:38 | 000,000,245 | ---- | C] () -- D:\WINDOWS\System32\regupdate.ini
[2007/09/18 20:21:28 | 000,009,384 | ---- | C] () -- D:\WINDOWS\Irremote.ini
[2007/09/18 19:50:55 | 000,593,920 | ---- | C] () -- D:\WINDOWS\System32\ati2sgag.exe
[2007/08/21 20:35:20 | 003,107,788 | ---- | C] () -- D:\WINDOWS\System32\ativvaxx.dat
[2007/08/21 20:35:20 | 003,107,788 | ---- | C] () -- D:\WINDOWS\System32\ativva5x.dat
[2007/08/21 20:35:20 | 000,972,072 | ---- | C] () -- D:\WINDOWS\System32\ativva6x.dat
[2007/08/03 05:28:35 | 000,002,508 | ---- | C] () -- D:\Dokumente und Einstellungen\gast\Anwendungsdaten\$_hpcst$.hpc
[2007/08/02 11:29:36 | 000,002,508 | ---- | C] () -- D:\Dokumente und Einstellungen\ich\Anwendungsdaten\$_hpcst$.hpc
[2007/07/05 10:48:35 | 000,000,092 | R--- | C] () -- D:\WINDOWS\System32\ftdiun2k.ini
[2007/06/07 14:10:48 | 000,020,480 | ---- | C] () -- D:\WINDOWS\System32\ac3config.exe
[2007/05/06 06:01:21 | 000,003,133 | ---- | C] () -- D:\WINDOWS\tm.ini
[2007/03/31 03:20:28 | 000,022,168 | ---- | C] () -- D:\WINDOWS\System32\imsinstall_loc0407.dll
[2007/03/31 03:20:28 | 000,018,072 | ---- | C] () -- D:\WINDOWS\System32\imslsp_install_loc0407.dll
[2007/02/14 12:21:26 | 000,796,584 | ---- | C] () -- D:\WINDOWS\System32\libeay32_0.9.6l.dll
[2007/02/13 10:00:56 | 000,233,868 | ---- | C] () -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\firstlsp.reg.dat
[2007/02/07 06:30:09 | 000,000,161 | ---- | C] () -- D:\WINDOWS\wininit.ini
[2007/01/29 09:20:32 | 001,048,576 | ---- | C] () -- D:\WINDOWS\System32\SFMAN.DAT
[2006/12/19 03:50:26 | 002,244,084 | ---- | C] () -- D:\Dokumente und Einstellungen\gast\Gaggia Bedienungsanleitung.pdf
[2006/11/02 10:10:16 | 000,080,912 | ---- | C] () -- D:\WINDOWS\System32\sherlock2.exe
[2006/11/01 08:11:21 | 000,689,280 | ---- | C] () -- D:\WINDOWS\System32\aswBoot.exe
[2006/10/30 11:15:03 | 000,006,067 | ---- | C] () -- D:\WINDOWS\Unwise32.ini
[2006/10/30 11:15:02 | 000,148,992 | ---- | C] () -- D:\WINDOWS\Unwise32.exe
[2006/10/30 11:12:57 | 000,369,152 | ---- | C] () -- D:\Programme\Rufid.exe
[2006/10/30 11:12:01 | 000,000,092 | ---- | C] () -- D:\WINDOWS\KTEL.INI
[2006/10/11 07:10:29 | 000,008,864 | ---- | C] () -- D:\WINDOWS\System32\drivers\CDAC15BA.SYS
[2006/10/11 06:46:55 | 000,000,070 | ---- | C] () -- D:\WINDOWS\Ulead32.INI
[2006/09/20 03:19:12 | 000,000,116 | ---- | C] () -- D:\WINDOWS\NeroDigital.ini
[2006/09/07 07:34:16 | 000,154,624 | ---- | C] () -- D:\Dokumente und Einstellungen\ich\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/09/07 07:32:07 | 000,000,305 | ---- | C] () -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2006/09/04 13:29:45 | 000,000,514 | ---- | C] () -- D:\WINDOWS\ODBC.INI
[2006/08/31 06:04:05 | 000,005,824 | ---- | C] () -- D:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2006/08/31 04:15:11 | 000,000,407 | ---- | C] () -- D:\Programme\Verknüpfung (2) mit Outlook Express.lnk
[2006/08/31 04:14:36 | 000,000,407 | ---- | C] () -- D:\Programme\Verknüpfung mit Outlook Express.lnk
[2006/08/30 12:36:08 | 000,285,216 | ---- | C] () -- D:\WINDOWS\System32\drivers\Onsio.sys
[2006/08/30 12:36:08 | 000,007,680 | ---- | C] () -- D:\WINDOWS\System32\drivers\Onsreged.sys
[2006/08/28 14:33:53 | 000,004,212 | -H-- | C] () -- D:\WINDOWS\System32\zllictbl.dat
[2006/08/28 12:12:04 | 000,081,920 | ---- | C] () -- D:\WINDOWS\System32\ieencode.dll
[2006/08/26 13:05:53 | 000,000,552 | ---- | C] () -- D:\WINDOWS\System32\d3d8caps.dat
[2006/08/26 12:21:25 | 000,000,000 | ---- | C] () -- D:\WINDOWS\nsreg.dat
[2006/08/26 12:21:16 | 000,003,418 | ---- | C] () -- D:\WINDOWS\mozver.dat
[2006/08/26 11:08:52 | 000,004,831 | ---- | C] () -- D:\WINDOWS\Ascd_tmp.ini
[2006/08/26 07:07:34 | 000,002,048 | --S- | C] () -- D:\WINDOWS\bootstat.dat
[2006/08/26 07:00:51 | 000,021,740 | ---- | C] () -- D:\WINDOWS\System32\emptyregdb.dat
[2006/08/26 06:50:42 | 000,004,161 | ---- | C] () -- D:\WINDOWS\ODBCINST.INI
[2006/08/26 06:49:46 | 000,286,112 | ---- | C] () -- D:\WINDOWS\System32\FNTCACHE.DAT
[2006/06/01 10:22:00 | 001,662,976 | ---- | C] () -- D:\WINDOWS\System32\nvwdmcpl.dll
[2006/06/01 10:22:00 | 001,519,616 | ---- | C] () -- D:\WINDOWS\System32\nwiz.exe
[2006/06/01 10:22:00 | 001,466,368 | ---- | C] () -- D:\WINDOWS\System32\nview.dll
[2006/06/01 10:22:00 | 001,339,392 | ---- | C] () -- D:\WINDOWS\System32\nvdspsch.exe
[2006/06/01 10:22:00 | 001,019,904 | ---- | C] () -- D:\WINDOWS\System32\nvwimg.dll
[2006/06/01 10:22:00 | 000,581,632 | ---- | C] () -- D:\WINDOWS\System32\nvhwvid.dll
[2006/06/01 10:22:00 | 000,466,944 | ---- | C] () -- D:\WINDOWS\System32\nvShell.dll
[2006/06/01 10:22:00 | 000,442,368 | ---- | C] () -- D:\WINDOWS\System32\nvAppBar.exe
[2006/06/01 10:22:00 | 000,425,984 | ---- | C] () -- D:\WINDOWS\System32\keystone.exe
[2006/06/01 10:22:00 | 000,286,720 | ---- | C] () -- D:\WINDOWS\System32\nvnt4cpl.dll
[2006/06/01 10:22:00 | 000,196,608 | ---- | C] () -- D:\WINDOWS\System32\NVAPI.DLL
[2006/04/28 15:05:14 | 000,156,671 | ---- | C] () -- D:\WINDOWS\System32\atiicdxx.dat
[2004/08/02 07:20:40 | 000,004,569 | ---- | C] () -- D:\WINDOWS\System32\secupd.dat
[2003/02/20 10:53:42 | 000,005,702 | ---- | C] () -- D:\WINDOWS\System32\OUTLPERF.INI
[2001/10/10 01:57:58 | 000,073,786 | ---- | C] () -- D:\WINDOWS\System32\dntvmc23.dll
[2001/10/10 01:57:58 | 000,061,497 | ---- | C] () -- D:\WINDOWS\System32\dntvm23.dll
[2001/09/04 10:35:46 | 000,027,440 | ---- | C] () -- D:\WINDOWS\System32\drivers\secdrv.sys
[2001/09/04 10:35:36 | 000,408,618 | ---- | C] () -- D:\WINDOWS\System32\perfh007.dat
[2001/09/04 10:35:36 | 000,395,200 | ---- | C] () -- D:\WINDOWS\System32\perfh009.dat
[2001/09/04 10:35:36 | 000,272,128 | ---- | C] () -- D:\WINDOWS\System32\perfi009.dat
[2001/09/04 10:35:36 | 000,269,480 | ---- | C] () -- D:\WINDOWS\System32\perfi007.dat
[2001/09/04 10:35:36 | 000,034,478 | ---- | C] () -- D:\WINDOWS\System32\perfd007.dat
[2001/09/04 10:35:36 | 000,028,626 | ---- | C] () -- D:\WINDOWS\System32\perfd009.dat
[2001/09/04 10:35:35 | 000,071,598 | ---- | C] () -- D:\WINDOWS\System32\perfc007.dat
[2001/09/04 10:35:35 | 000,059,440 | ---- | C] () -- D:\WINDOWS\System32\perfc009.dat
[2001/09/04 10:35:33 | 013,107,200 | ---- | C] () -- D:\WINDOWS\System32\oembios.bin
[2001/09/04 10:35:33 | 000,004,463 | ---- | C] () -- D:\WINDOWS\System32\oembios.dat
[2001/09/04 10:35:26 | 000,000,741 | ---- | C] () -- D:\WINDOWS\System32\noise.dat
[2001/09/04 10:35:09 | 000,673,088 | ---- | C] () -- D:\WINDOWS\System32\mlang.dat
[2001/09/04 10:35:08 | 000,046,258 | ---- | C] () -- D:\WINDOWS\System32\mib.bin
[2001/09/04 10:34:48 | 000,218,003 | ---- | C] () -- D:\WINDOWS\System32\dssec.dat
[2001/09/04 10:34:21 | 000,001,788 | ---- | C] () -- D:\WINDOWS\System32\Dcache.bin
[2001/03/07 01:02:30 | 000,229,431 | ---- | C] () -- D:\WINDOWS\System32\dnt23.dll
[2000/09/13 19:03:00 | 000,000,145 | ---- | C] () -- D:\WINDOWS\System32\EBPPORT.DAT
 
========== LOP Check ==========
 
[2007/02/14 13:22:50 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic
[2008/12/06 11:49:02 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ashampoo
[2006/12/02 02:57:24 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avg7
[2007/04/20 01:57:10 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BTrieve
[2007/04/20 01:55:44 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Haufe
[2007/04/20 01:57:02 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lexware
[2008/05/12 13:45:42 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2008/11/20 12:53:04 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Maxtor
[2007/03/31 02:56:00 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\My Pictures
[2007/12/24 04:49:28 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pinnacle
[2006/08/27 07:18:54 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-DSL SpeedManager
[2008/11/19 11:37:10 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2006/09/02 05:44:10 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ulead Systems
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
Smileys[2008/11/19 11:07:44 | 000,000,000 | ---D | M](D:\WINDOWS\System32\??????????) -- D:\WINDOWS\System32\粑۰粒??۫粒⁃睌
*[Weitere] Trackback:Send Trackbacks to ([2008/11/19 11:07:43 | 000,000,000 | ---D | C](D:\WINDOWS\System32\??????????) -- D:\WINDOWS\System32\粑۰粒??۫粒⁃睌
< End of report >
Separat

Code:
ATTFilter
OTL Extras logfile created on: 2/1/2013 1:52:43 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 84.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 95.00% Paging File free
Paging file location(s): C:\pagefile.sys 3070 3070 [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Programme
Drive D: | 135.01 Gb Total Space | 113.71 Gb Free Space | 84.23% Space Free | Partition Type: NTFS
Drive E: | 410.15 Gb Total Space | 311.89 Gb Free Space | 76.04% Space Free | Partition Type: NTFS
Drive F: | 404.17 Gb Total Space | 273.50 Gb Free Space | 67.67% Space Free | Partition Type: NTFS
Drive G: | 99.96 Gb Total Space | 81.87 Gb Free Space | 81.90% Space Free | Partition Type: NTFS
Drive H: | 100.73 Gb Total Space | 35.54 Gb Free Space | 35.28% Space Free | Partition Type: NTFS
Drive I: | 130.07 Gb Total Space | 26.45 Gb Free Space | 20.34% Space Free | Partition Type: NTFS
Drive K: | 31.23 Gb Total Space | 31.18 Gb Free Space | 99.82% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet005
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- D:\MOZILLA\MOZILL~2\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1"
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Programme\Internet Explorer\iexplore.exe" -nohome
htmlfile [opennew] -- "C:\Programme\Internet Explorer\iexplore.exe" %1
http [open] -- D:\MOZILLA\MOZILL~2\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1"
https [open] -- D:\MOZILLA\MOZILL~2\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1"
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1"
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1"
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Programme\Internet Explorer\iexplore.exe" %1
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Programme\Internet Explorer\iexplore.exe"
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\WINDOWS\System32\ZoneLabs\vsmon.exe" = C:\WINDOWS\System32\ZoneLabs\vsmon.exe:*:Enabled:TrueVector Service -- (Zone Labs, LLC)
"C:\Programme\Sony Ericsson\Update Service\ma3platform.exe" = C:\Programme\Sony Ericsson\Update Service\ma3platform.exe:*:Enabled:ma3platform
"C:\WINDOWS\System32\dpvsetup.exe" = C:\WINDOWS\System32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\WINDOWS\System32\RUNDLL32.EXE" = C:\WINDOWS\System32\RUNDLL32.EXE:*:Enabled:Eine DLL-Datei als Anwendung ausführen -- (Microsoft Corporation)
"D:\Programme\Active sync\wcescomm.exe" = D:\Programme\Active sync\wcescomm.exe:*:Enabled:ActiveSync Connection Manager
"C:\WINDOWS\Temp\KD_installer.exe" = C:\WINDOWS\Temp\KD_installer.exe:*:Enabled:Kabel Deutschland Installer
"C:\Programme\VideoLAN\VLC\vlc.exe" = C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player
"D:\Mozilla\Mozilla Firefox(2)\Mozilla Firefox\firefox.exe" = D:\Mozilla\Mozilla Firefox(2)\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03A70F27-D80E-4A22-A1B4-1C878FC6056A}" = Sony Ericsson Mobile Networking Wizard
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{123D40B5-66EF-4F41-A2BA-0B74D0D1C8B3}" = Steuer 2006
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1E04F83B-2AB9-4301-9EF7-E86307F79C72}" = Google Earth
"{1E5007FA-DA5E-4EDD-BDE5-14D128D66887}" = PowerQuest PartitionMagic 7.0
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{238B8820-011B-11D6-9C28-0080C85A0C2D}" = Transparency Adaptor Calibrator
"{2C4A5877-21D1-4A15-9D20-24BA54A24093}" = Playlist tool
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer
"{345C90FB-FA10-11D5-9C2A-0080C85A0C2D}" = ABBYY FineReader OCR Engine
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3A33D692-8679-4142-94C7-0BB784B9B3A3}" = DMX 6fire 24/96 ControlPanel
"{3B7458C7-3F03-4415-AC39-D51EDEACDCCC}" = Steuer 2007
"{4BC211DD-2BBC-4CDF-AB43-3B93444617E0}" = Steuer 2006
"{4D400407-6332-4101-8C78-506C85813506}" = Sony Ericsson OCS
"{53480520-7555-470E-8C69-750B0472B4BB}" = O&O Defrag Professional Edition
"{544FB392-069D-4BA5-9DC7-FFD47230AEE5}" = Photohands 1.0G
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{59C95D15-5F24-435E-898D-3806961FC79D}" = Steuer 2006
"{5E8C42DD-7E43-462C-84CC-99E5BBE3E101}" = Steuer 2007
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{70B45586-B51E-4947-A258-A895596C5CED}" = Photo Loader 2.3G
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{757AD3D4-036B-42FA-B0A4-96BD6F4605A0}" = Ulead VideoStudio 7 SE DVD
"{7AA828F3-BD67-495E-9742-BD9C3F196E78}" = PC Suite
"{81A60A13-224D-4637-8203-3EAC03B121A4}" = Maxtor*MaxBlast
"{8FBC9407-713D-4B8A-98D2-57210DA56049}" = MSN Toolbar
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9075FCA2-7B7E-46A3-841A-52519270C1B2}" = PowerQuest Drive Image 5.0
"{909B62B0-8ACA-4061-A83B-09CAEF609619}" = MSXML 6.0 Parser
"{95E0E6DC-C308-4C96-BEDB-68C75A32FAF8}_is1" = Tetris
"{97A4D873-47B9-454A-A567-8AFF41C07155}" = EasyRecovery DataRecovery
"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows
"{A074DE55-29EB-459C-99C9-3F26C5669ECB}" = EasyRecovery DataRecovery Trial
"{A0E2CD91-BC77-411F-BD5D-5ABCA8C7C5B8}" = Sony Ericsson Mobile Phone Monitor
"{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}" = Brother MFL-Pro Suite
"{AC76BA86-1033-F400-7760-000000000002}" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch
"{B08D262E-D902-11D5-9C28-0080C85A0C2D}" = ScanWizard 5
"{B754B683-E23C-4583-9312-50AD86836B42}" = Steuer Hilfesammlung
"{C00FAC7F-DAF5-4FD8-83E7-5959C882A811}" = Sony Ericsson File Manager
"{CBA04F21-D46C-46FC-9A8A-A5360F58CF94}" = Sony Ericsson Sync Station
"{D777130E-86A9-428C-B7E6-9EFBCAB4E4CC}" = Steuer Hilfesammlung
"{E03EE3F8-F081-4EF5-BE18-CC849459B070}" = Sony Ericsson Capability Manager
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{EA9FAF16-0E5C-42C4-9742-9AF8D5F6D69B}" = ATI Catalyst Control Center
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA}" = Pinnacle TVCenter Pro
"{FDDC37C3-B2FC-4B5E-A854-1E69B2FFCA71}" = Steuer Update 14.01
"Ad-Aware SE Personal" = Ad-Aware SE Personal
"Adobe Acrobat 7.0 Professional - EFG" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"All ATI Software" = ATI - Software Uninstall Utility
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal – Free Antivirus
"AsusUpdate" = AsusUpdate
"ATI Display Driver" = ATI Display Driver
"BetaPlayer" = BetaPlayer
"Digital Image Recovery_is1" = Digital Image Recovery 1.47
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"FFMPEG" = FFMPEG
"FLAC" = FLAC
"FTDICOMM" = SEMC DSS SyncStation Driver
"Google Updater" = Google Updater
"Hard Disk Low Level Format Tool_is1" = Hard Disk Low Level Format Tool 2.36 build 1181
"HijackThis" = HijackThis 1.99.1
"ImTOO 3GP Video Converter" = ImTOO 3GP Video Converter
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"InstallShield_{97A4D873-47B9-454A-A567-8AFF41C07155}" = EasyRecovery DataRecovery
"InstallShield_{A074DE55-29EB-459C-99C9-3F26C5669ECB}" = EasyRecovery DataRecovery Trial
"KlickTel99" = klickTel Mai 99 - 32-Bit
"KLiteCodecPack_is1" = K-Lite Codec Pack 3.8.0 Full
"Language pack for Ad-Aware SE" = Language pack for Ad-Aware SE
"MAGIX Fotos auf CD & DVD 7 deluxe D" = MAGIX Fotos auf CD & DVD 7 deluxe 7.0.2.0 (D)
"MediaCoder" = MediaCoder 0.6.2
"MediaInfo" = MediaInfo 0.7.6.1BETA
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox (2.0.0.12)" = Mozilla Firefox (2.0.0.12)
"Need For Speed III" = Need For Speed III
"OEMaster-Daten-ExportfürOutlookExpress" = OEMaster - DBX-Reader und Daten-Export für Outlook Express
"ProtectDisc Driver 10" = ProtectDisc Helper Driver 10
"S4Uninst" = Die Siedler IV
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"ST6UNST #1" = Outlook Express Quick Backup
"VLC media player" = VLC media player 0.9.6
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinRAR archiver" = WinRAR Archivierer
"ZoneAlarm" = ZoneAlarm
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\gast_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dr. Hardware 2008_is1" = Dr. Hardware 2008 9.0.0d
"JAP" = JAP
"Mozilla Firefox (2.0)" = Mozilla Firefox (2.0)
"Stellar Phoenix DMR_is1" = Stellar Phoenix DMR 1.0
 
< End of report >
Ich bitte um Hilfe! Danke!
Gruss Christian

Alt 04.02.2013, 12:58   #8
markusg
/// Malware-holic
 
Windows XP startet auch nicht im abgesichtern Modus - Standard

Windows XP startet auch nicht im abgesichtern Modus


hi
wenn du wieder in den normalen Modus kommst:
download tdss killer:
http://www.trojaner-board.de/82358-t...entfernen.html
Klicke auf Change parameters
• Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system
• Klick auf OK und anschließend auf Start scan
- bei funden erst mal immer skip wählen, log posten
c: öffnen, tdsskiller-datum-version.txt öffnen, Inhalt posten
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 06.02.2013, 19:30   #9
paulibins
 
Windows XP startet auch nicht im abgesichtern Modus - Standard

Windows XP startet auch nicht im abgesichtern Modus


Hallo Markus
danke für die Antwort. Leider kann ich den "Killer" nicht einsetzen, da das System jja nicht normal startet. Hier nochmal zu Erinnerung mein Problem:
Der Systemstart geht zunächst ganz normal bis die Meldung kommt Windows könne auf Grund von Änderungen....nicht gestartet werden mit der Auswahl der verschiedenen Startmodi. Gehe ich dann zB. auf den abgesicherten Modus, dann werden unten am Bildrand die Dateinamen in schneller Folge angezeigt (wie beim normalen Start) bis es plötzlich stoppt. Dann kommt ebenfalls unten die Meldung. Press ENTER to continue loading SPTD.sys. Danach wird, egal ob ich drücke der Schirm dunkel, und der Rechner startet neu.
Meine Aussage, das der Eset Scan nichts gefung´den hat, bezog sich leider nur auf die beiden Partitionen mit den mir wichtigen Datein. Ich habe nun auch die Systempartition rüberkopiert und wollte das Ganze auf meinem uralten, völlig leeren "Notrechner " mit ESET nochmal scannen. Das ging leider in die Hose. ESET läuft nicht, der Rechner ist sehr langsam, weil ihn irgendwelche Prozesse blockieren und wenn ich dann Strg Alt Entf drücke, kommt irgendwann : der Rechner wird gesperrt. Bevor ich die USB Platte ansteckte, lief er völlig normal.Ergo ist was faul. Bloß ist es mir auf dem Teil egal (läuft unter WIN 7) weil wie gesagt keinerlei Daten darauf sind und er eigentlich schon auf den Wertstoffhof sollte.

und hier nochmal die OTL Logfiles
Code:
ATTFilter
OTL logfile created on: 2/6/2013 4:12:15 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 3070 3070 [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Programme
Drive D: | 135.01 Gb Total Space | 113.71 Gb Free Space | 84.23% Space Free | Partition Type: NTFS
Drive F: | 410.15 Gb Total Space | 311.89 Gb Free Space | 76.04% Space Free | Partition Type: NTFS
Drive G: | 404.17 Gb Total Space | 273.50 Gb Free Space | 67.67% Space Free | Partition Type: NTFS
Drive H: | 99.96 Gb Total Space | 81.87 Gb Free Space | 81.90% Space Free | Partition Type: NTFS
Drive I: | 100.73 Gb Total Space | 35.54 Gb Free Space | 35.28% Space Free | Partition Type: NTFS
Drive J: | 130.07 Gb Total Space | 26.45 Gb Free Space | 20.34% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days
Using ControlSet: ControlSet005
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled] --  -- (FirebirdServerMAGIXInstance)
SRV - [2008/04/15 10:15:24 | 000,147,201 | ---- | M] (Avira GmbH) [Disabled] -- D:\Programme\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService)
SRV - [2008/04/15 10:15:24 | 000,068,865 | ---- | M] (Avira GmbH) [Disabled] -- D:\Programme\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler)
SRV - [2007/08/23 07:52:50 | 000,410,904 | ---- | M] (Acronis) [Disabled] -- D:\Programme\Gemeinsame Dateien\Maxtor\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2007/03/08 17:01:58 | 000,075,568 | ---- | M] (Zone Labs, LLC) [Auto] -- D:\WINDOWS\System32\ZONELABS\vsmon.exe -- (vsmon)
SRV - [2006/09/20 12:44:10 | 000,069,632 | ---- | M] (Adobe Systems) [On_Demand] -- D:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2006/02/28 19:10:20 | 000,069,632 | ---- | M] (CrypKey (Canada) Ltd.) [Disabled] -- D:\WINDOWS\System32\Crypserv.exe -- (Crypkey License)
SRV - [2004/10/21 19:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [Disabled] -- D:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/05/17 07:57:00 | 000,184,320 | ---- | M] (O&O Software GmbH) [Auto] -- D:\WINDOWS\system32\oodag.exe -- (O&O Defrag)
SRV - [2003/07/28 05:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [Disabled] -- D:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2001/08/08 19:01:00 | 000,090,112 | ---- | M] (SEIKO EPSON CORPORATION) [Disabled] -- D:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe -- (EPSONStatusAgent2)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WINFOXIO)
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (TSMPacket)
DRV - File not found [Kernel | On_Demand] --  -- (SANDRA)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand] --  -- (MEMSWEEP2)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | On_Demand] --  -- (CrystalSysInfo)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2008/11/20 12:49:04 | 000,400,864 | ---- | M] (Acronis) [Kernel | Boot] -- D:\WINDOWS\system32\drivers\timntr.sys -- (timounter)
DRV - [2008/11/20 12:49:04 | 000,032,768 | ---- | M] (Acronis) [File_System | Auto] -- D:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter)
DRV - [2008/11/20 12:48:54 | 000,120,992 | ---- | M] (Acronis) [Kernel | Boot] -- D:\WINDOWS\system32\drivers\snapman.sys -- (snapman)
DRV - [2008/04/15 10:15:24 | 000,079,424 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2008/04/15 10:15:24 | 000,049,472 | ---- | M] (Avira GmbH) [File_System | On_Demand] -- D:\Programme\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt)
DRV - [2008/04/15 10:15:24 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2007/10/28 10:35:14 | 000,583,128 | ---- | M] (Protect Software GmbH) [Kernel | Auto] -- D:\WINDOWS\system32\drivers\ACEDRV10.sys -- (acedrv10)
DRV - [2007/10/26 08:53:46 | 000,250,560 | ---- | M] (Protect Software GmbH) [Kernel | Auto] -- D:\WINDOWS\system32\drivers\acehlp10.sys -- (acehlp10)
DRV - [2007/08/31 15:07:50 | 000,407,328 | ---- | M] (Sensaura) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\dmxsens.sys -- (dmxsens)
DRV - [2007/08/31 15:07:40 | 000,099,680 | ---- | M] (Terratec Electronic GmbH) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\dmx6fire.sys -- (dmxfire)
DRV - [2007/08/21 21:07:40 | 002,417,664 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2007/06/14 06:41:00 | 000,466,048 | R--- | M] (LITEON) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\Ltn_stk7070P.sys -- (Ltn_stk7070P)
DRV - [2007/06/13 11:30:20 | 000,013,440 | R--- | M] (LITEON) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\Ltn_stkrc.sys -- (Ltn_stkrc)
DRV - [2007/04/22 02:06:36 | 000,011,840 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Programme\AntiVir PersonalEdition Classic\avgio.sys -- (avgio)
DRV - [2007/03/08 17:02:10 | 000,394,192 | ---- | M] (Zone Labs, LLC) [Kernel | System] -- D:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2007/03/01 04:27:26 | 004,484,608 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/01/17 22:39:20 | 000,050,416 | ---- | M] (Zone Labs, LLC) [Kernel | Boot] -- D:\WINDOWS\system32\ZoneLabs\srescan.sys -- (srescan)
DRV - [2006/10/17 07:22:26 | 000,009,216 | R--- | M] (VIA Technologies, Inc.) [Kernel | Boot] -- D:\WINDOWS\system32\drivers\videX32.sys -- (videX32)
DRV - [2006/10/11 07:10:30 | 000,008,864 | ---- | M] () [Kernel | Auto] -- D:\WINDOWS\system32\drivers\CDAC15BA.SYS -- (CdaC15BA)
DRV - [2006/01/25 09:14:06 | 000,472,644 | ---- | M] (Hauppauge Computer Works) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\HCWBT8xx.sys -- (HCWBT8XX)
DRV - [2006/01/09 20:47:28 | 000,031,846 | ---- | M] () [Kernel | System] -- D:\WINDOWS\system32\ckldrv.sys -- (NetworkX)
DRV - [2004/08/03 20:08:36 | 000,013,824 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\atinmdxx.sys -- (MVDCODEC)
DRV - [2004/08/03 20:08:30 | 000,105,984 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\atinrvxx.sys -- (atinrvxx)
DRV - [2004/08/03 16:10:14 | 000,015,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\MPE.sys -- (MPE)
DRV - [2004/08/03 16:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2004/08/03 16:07:46 | 000,223,616 | ---- | M] (Microsoft Corporation) [Kernel | System] -- D:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2004/08/03 15:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)
DRV - [2004/03/22 09:40:38 | 000,040,448 | R--- | M] (Susteen Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\SUSCOM.SYS -- (SUSCOM)
DRV - [2003/09/16 04:00:10 | 000,019,153 | R--- | M] (FTDI Ltd.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ftdibus.sys -- (FTDIBUS)
DRV - [2003/09/16 04:00:02 | 000,006,828 | R--- | M] (FTDI Ltd.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ftlund.sys -- (FTLUND)
DRV - [2003/09/16 03:59:54 | 000,050,396 | R--- | M] (FTDI Ltd.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ftser2k.sys -- (FTSER2K)
DRV - [2003/09/05 10:30:32 | 000,011,776 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\Dokumente und Einstellungen\All Users\Dokumente\Eigene Bilder\ATI BIOS\WinFlash\ATIXPGAA.SYS -- (ATIXPGAA)
DRV - [2002/08/13 08:27:22 | 000,074,338 | ---- | M] (3Com Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\el90Xbc5.SYS -- (EL90Xbc)
DRV - [2001/08/17 07:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)
DRV - [2001/08/17 06:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\irsir.sys -- (irsir)
DRV - [2001/08/10 00:00:00 | 000,003,252 | ---- | M] () [Kernel | System] -- D:\WINDOWS\System32\drivers\PQNTDRV.SYS -- (PQNTDrv)
 
 
========== Standard Registry (All) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
IE - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\gast_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\ich_ON_D\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\ich_ON_D\Software\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKU\ich_ON_D\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\ich_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\ich_ON_D\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - D:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation)
IE - HKU\ich_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\LocalService_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\NetworkService_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\systemprofile_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.kabeldeutschland.de/portal"
FF - prefs.js..network.proxy.ftp: 
FF - prefs.js..network.proxy.ftp_port: 
FF - prefs.js..network.proxy.gopher: 
FF - prefs.js..network.proxy.gopher_port: 
FF - prefs.js..network.proxy.http: 
FF - prefs.js..network.proxy.http_port: 
FF - prefs.js..network.proxy.no_proxies_on: 
FF - prefs.js..network.proxy.socks: 
FF - prefs.js..network.proxy.socks_port: 
FF - prefs.js..network.proxy.ssl: 
FF - prefs.js..network.proxy.ssl_port: 
FF - prefs.js..network.proxy.type: 0
FF - prefs.js..network.proxy.autoconfig_url: 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: D:\Programme\Google\Google Updater\2.4.1399.3742\npCIDetect13.dll (Google)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 2.0\extensions\\Components: D:\Mozilla\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 2.0\extensions\\Plugins: D:\Mozilla\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 2.0.0.12\extensions\\Components: D:\MOZILLA\MOZILL~2\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 2.0.0.12\extensions\\Plugins: D:\MOZILLA\MOZILL~2\Mozilla Firefox\plugins
 
[2008/12/26 02:06:54 | 000,000,000 | ---D | M] (No name found) -- D:\Dokumente und Einstellungen\ich\Anwendungsdaten\mozilla\Extensions
[2008/12/26 02:06:54 | 000,000,000 | ---D | M] (No name found) -- D:\Dokumente und Einstellungen\ich\Anwendungsdaten\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2006/08/26 12:21:26 | 000,000,000 | ---D | M] (No name found) -- D:\Dokumente und Einstellungen\ich\Anwendungsdaten\mozilla\Firefox\Profiles\b73q4pp9.default\extensions
[2007/02/05 07:05:08 | 000,000,000 | ---D | M] (Adblock Plus) -- D:\Dokumente und Einstellungen\ich\Anwendungsdaten\mozilla\Firefox\Profiles\b73q4pp9.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}(2)
[2003/07/14 15:56:52 | 000,013,888 | ---- | M] (Microsoft Corporation) -- D:\Programme\mozilla firefox\plugins\NPOFFICE.DLL
[2006/09/01 03:56:06 | 000,139,305 | ---- | M] (RealNetworks, Inc.) -- D:\Programme\mozilla firefox\plugins\nppl3260.dll
[2006/09/01 03:56:22 | 000,024,621 | ---- | M] (RealNetworks, Inc.) -- D:\Programme\mozilla firefox\plugins\nprjplug.dll
[2006/09/01 03:56:02 | 000,081,967 | ---- | M] (RealNetworks, Inc.) -- D:\Programme\mozilla firefox\plugins\nprpjplug.dll
[2006/06/22 06:44:58 | 002,078,344 | ---- | M] () -- D:\Programme\mozilla firefox\plugins\NPSWF32.dll
 
O1 HOSTS File: ([2001/09/04 10:34:58 | 000,000,820 | ---- | M]) - D:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -  File not found
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -  File not found
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} -  File not found
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Programme\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - D:\Programme\MSN\Toolbar\3.0.0744.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - D:\Programme\MSN\Toolbar\3.0.0744.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  File not found
O3 - HKU\ich_ON_D\..\Toolbar\ShellBrowser: (&Adresse) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - D:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKU\ich_ON_D\..\Toolbar\WebBrowser: (&Adresse) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - D:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKU\ich_ON_D\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - D:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O3 - HKU\ich_ON_D\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  File not found
O4 - HKU\.DEFAULT..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
O4 - HKU\gast_ON_D..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_D..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_D..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
O4 - HKU\systemprofile_ON_D..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\gast_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\ich_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95
O7 - HKU\LocalService_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\systemprofile_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -  File not found
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -  File not found
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programme\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programme\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - D:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - D:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - D:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000030 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000031 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000032 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000033 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000034 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000035 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000036 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000037 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000038 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000039 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000040 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000041 - D:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 83.169.184.161 83.169.184.225
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - D:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\haufereader - No CLSID value found
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - D:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\lid {5C135180-9973-46D9-ABF4-148267CBB8BF} - D:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - D:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - D:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - D:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - D:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - D:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - D:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - D:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - D:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - D:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - D:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - D:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - D:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - D:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - D:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - D:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - D:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - D:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - D:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - D:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - D:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - D:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - D:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - D:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - D:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - D:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - D:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - D:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - D:\WINDOWS\system32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - D:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - D:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - D:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: 
O24 - Desktop BackupWallPaper: 
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - D:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - D:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - D:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - D:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - D:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - D:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (relog_ap) - D:\WINDOWS\System32\relog_ap.dll (Acronis)
O30 - LSA: Security Packages - (kerberos) - D:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - D:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - D:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - D:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/08/26 07:04:08 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{47ace141-6476-11dc-a858-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{47ace141-6476-11dc-a858-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{47ace141-6476-11dc-a858-806d6172696f}\Shell\AutoRun\command - "" = H:\Bin\assetup.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (OODBS) - D:\WINDOWS\System32\OODBS.exe (O&O Software GmbH)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/01/29 13:02:44 | 000,000,000 | ---D | C] -- D:\_OTL
[2008/03/14 09:18:02 | 000,089,680 | ---- | C] (Microsoft Corporation) -- D:\Dokumente und Einstellungen\ich\MSSSerif120.fon
 
========== Files - Modified Within 30 Days ==========
 
[2013/01/31 20:08:14 | 000,786,432 | ---- | M] () -- D:\Dokumente und Einstellungen\gast\ntuser.dat
 
========== Files Created - No Company Name ==========
 
[2008/12/23 13:01:33 | 000,502,784 | ---- | C] () -- D:\WINDOWS\x2.64.exe
[2008/12/23 13:01:33 | 000,240,128 | ---- | C] () -- D:\WINDOWS\System32\x.264.exe
[2008/12/23 13:01:33 | 000,217,073 | ---- | C] () -- D:\WINDOWS\meta4.exe
[2008/12/23 13:01:33 | 000,066,560 | ---- | C] () -- D:\WINDOWS\MOTA113.exe
[2008/12/23 13:01:33 | 000,027,648 | ---- | C] () -- D:\WINDOWS\System32\AVSredirect.dll
[2008/12/10 11:19:18 | 000,000,109 | ---- | C] () -- D:\WINDOWS\oodcnt.INI
[2008/12/10 10:49:55 | 000,000,223 | ---- | C] () -- D:\Dokumente und Einstellungen\ich\Goya.ini
[2008/12/10 10:49:23 | 000,000,046 | ---- | C] () -- D:\WINDOWS\Goya.INI
[2008/12/04 10:42:18 | 006,815,744 | ---- | C] () -- D:\Dokumente und Einstellungen\ich\ntuser.dat
[2008/11/19 12:33:50 | 000,000,164 | ---- | C] () -- D:\WINDOWS\RECMGRUN.INI
[2008/11/19 12:32:53 | 000,003,455 | ---- | C] () -- D:\WINDOWS\RECVCALL.INI
[2008/11/18 11:53:32 | 000,000,004 | ---- | C] () -- D:\WINDOWS\vx86036.dat
[2008/11/18 11:53:23 | 000,000,067 | ---- | C] () -- D:\WINDOWS\Crypkey.ini
[2008/11/18 11:53:20 | 000,031,846 | ---- | C] () -- D:\WINDOWS\System32\Ckldrv.sys
[2008/11/18 11:53:20 | 000,027,648 | R--- | C] () -- D:\WINDOWS\Setup_ck.exe
[2008/11/18 11:53:20 | 000,018,432 | ---- | C] () -- D:\WINDOWS\Setup_ck.dll
[2008/11/18 11:53:20 | 000,011,776 | ---- | C] () -- D:\WINDOWS\Ckrfresh.exe
[2008/11/16 04:02:14 | 000,000,425 | ---- | C] () -- D:\WINDOWS\BRWMARK.INI
[2008/11/16 04:02:14 | 000,000,027 | ---- | C] () -- D:\WINDOWS\BRPP2KA.INI
[2008/11/16 03:59:10 | 000,000,050 | ---- | C] () -- D:\WINDOWS\System32\bridf07a.dat
[2008/11/16 03:58:08 | 000,106,496 | ---- | C] () -- D:\WINDOWS\System32\BrMuSNMP.dll
[2008/05/17 11:21:37 | 002,189,354 | -H-- | C] () -- D:\Dokumente und Einstellungen\ich\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2008/05/17 10:49:05 | 000,077,460 | ---- | C] () -- D:\WINDOWS\DIHELP.DAT
[2008/05/17 10:49:05 | 000,038,450 | ---- | C] () -- D:\WINDOWS\PQDI.exe
[2008/05/12 13:39:53 | 000,120,200 | ---- | C] () -- D:\WINDOWS\System32\DLLDEV32i.dll
[2008/05/12 13:38:22 | 000,006,768 | ---- | C] () -- D:\WINDOWS\mgxoschk.ini
[2008/05/04 11:08:49 | 000,020,480 | ---- | C] () -- D:\WINDOWS\System32\CPUINFO2.DLL
[2008/04/19 04:24:24 | 000,049,152 | R--- | C] () -- D:\WINDOWS\System32\ChCfg.exe
[2008/04/11 11:00:16 | 000,036,864 | ---- | C] () -- D:\WINDOWS\Algoui.exe
[2008/04/10 12:14:51 | 000,049,152 | RH-- | C] () -- D:\WINDOWS\System32\CoInst.dll
[2008/03/15 02:50:36 | 000,164,352 | ---- | C] () -- D:\WINDOWS\System32\unrar.dll
[2008/03/15 02:50:35 | 000,755,027 | ---- | C] () -- D:\WINDOWS\System32\xvidcore.dll
[2008/03/15 02:50:34 | 000,159,839 | ---- | C] () -- D:\WINDOWS\System32\xvidvfw.dll
[2008/03/15 02:50:33 | 000,007,680 | ---- | C] () -- D:\WINDOWS\System32\ff_vfw.dll
[2008/03/15 02:50:33 | 000,000,547 | ---- | C] () -- D:\WINDOWS\System32\ff_vfw.dll.manifest
[2008/02/16 10:56:28 | 000,000,038 | ---- | C] () -- D:\WINDOWS\AviSplitter.INI
[2008/02/10 11:54:09 | 000,035,328 | ---- | C] () -- D:\WINDOWS\System32\cygz.dll
[2008/02/10 11:54:09 | 000,035,328 | ---- | C] () -- D:\WINDOWS\cygz.dll
[2007/12/24 04:43:11 | 000,363,520 | ---- | C] () -- D:\WINDOWS\System32\PsisDecd.dll
[2007/11/16 11:46:44 | 000,786,432 | ---- | C] () -- D:\Dokumente und Einstellungen\gast\ntuser.dat
[2007/10/27 12:45:03 | 001,284,280 | ---- | C] () -- D:\WINDOWS\System32\XMNT2001.EXE
[2007/10/27 12:45:03 | 000,003,252 | ---- | C] () -- D:\WINDOWS\System32\drivers\PQNTDRV.SYS
[2007/10/16 11:26:41 | 000,069,632 | R--- | C] () -- D:\WINDOWS\System32\xmltok.dll
[2007/10/16 11:26:41 | 000,036,864 | R--- | C] () -- D:\WINDOWS\System32\xmlparse.dll
[2007/10/05 10:54:38 | 000,000,245 | ---- | C] () -- D:\WINDOWS\System32\regupdate.ini
[2007/09/18 20:21:28 | 000,009,384 | ---- | C] () -- D:\WINDOWS\Irremote.ini
[2007/09/18 19:50:55 | 000,593,920 | ---- | C] () -- D:\WINDOWS\System32\ati2sgag.exe
[2007/08/21 20:35:20 | 003,107,788 | ---- | C] () -- D:\WINDOWS\System32\ativvaxx.dat
[2007/08/21 20:35:20 | 003,107,788 | ---- | C] () -- D:\WINDOWS\System32\ativva5x.dat
[2007/08/21 20:35:20 | 000,972,072 | ---- | C] () -- D:\WINDOWS\System32\ativva6x.dat
[2007/08/03 05:28:35 | 000,002,508 | ---- | C] () -- D:\Dokumente und Einstellungen\gast\Anwendungsdaten\$_hpcst$.hpc
[2007/08/02 11:29:36 | 000,002,508 | ---- | C] () -- D:\Dokumente und Einstellungen\ich\Anwendungsdaten\$_hpcst$.hpc
[2007/07/05 10:48:35 | 000,000,092 | R--- | C] () -- D:\WINDOWS\System32\ftdiun2k.ini
[2007/06/07 14:10:48 | 000,020,480 | ---- | C] () -- D:\WINDOWS\System32\ac3config.exe
[2007/05/06 06:01:21 | 000,003,133 | ---- | C] () -- D:\WINDOWS\tm.ini
[2007/03/31 03:20:28 | 000,022,168 | ---- | C] () -- D:\WINDOWS\System32\imsinstall_loc0407.dll
[2007/03/31 03:20:28 | 000,018,072 | ---- | C] () -- D:\WINDOWS\System32\imslsp_install_loc0407.dll
[2007/02/14 12:21:26 | 000,796,584 | ---- | C] () -- D:\WINDOWS\System32\libeay32_0.9.6l.dll
[2007/02/13 10:00:56 | 000,233,868 | ---- | C] () -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\firstlsp.reg.dat
[2007/02/07 06:30:09 | 000,000,161 | ---- | C] () -- D:\WINDOWS\wininit.ini
[2007/01/29 09:20:32 | 001,048,576 | ---- | C] () -- D:\WINDOWS\System32\SFMAN.DAT
[2006/12/19 03:50:26 | 002,244,084 | ---- | C] () -- D:\Dokumente und Einstellungen\gast\Gaggia Bedienungsanleitung.pdf
[2006/11/02 10:10:16 | 000,080,912 | ---- | C] () -- D:\WINDOWS\System32\sherlock2.exe
[2006/11/01 08:11:21 | 000,689,280 | ---- | C] () -- D:\WINDOWS\System32\aswBoot.exe
[2006/10/30 11:15:03 | 000,006,067 | ---- | C] () -- D:\WINDOWS\Unwise32.ini
[2006/10/30 11:15:02 | 000,148,992 | ---- | C] () -- D:\WINDOWS\Unwise32.exe
[2006/10/30 11:12:57 | 000,369,152 | ---- | C] () -- D:\Programme\Rufid.exe
[2006/10/30 11:12:01 | 000,000,092 | ---- | C] () -- D:\WINDOWS\KTEL.INI
[2006/10/11 07:10:29 | 000,008,864 | ---- | C] () -- D:\WINDOWS\System32\drivers\CDAC15BA.SYS
[2006/10/11 06:46:55 | 000,000,070 | ---- | C] () -- D:\WINDOWS\Ulead32.INI
[2006/09/20 03:19:12 | 000,000,116 | ---- | C] () -- D:\WINDOWS\NeroDigital.ini
[2006/09/07 07:34:16 | 000,154,624 | ---- | C] () -- D:\Dokumente und Einstellungen\ich\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/09/07 07:32:07 | 000,000,305 | ---- | C] () -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2006/09/05 09:38:38 | 000,000,020 | -HS- | C] () -- D:\Dokumente und Einstellungen\gast\ntuser.ini
[2006/09/04 13:29:45 | 000,000,514 | ---- | C] () -- D:\WINDOWS\ODBC.INI
[2006/08/31 06:04:05 | 000,005,824 | ---- | C] () -- D:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2006/08/31 04:15:11 | 000,000,407 | ---- | C] () -- D:\Programme\Verknüpfung (2) mit Outlook Express.lnk
[2006/08/31 04:14:36 | 000,000,407 | ---- | C] () -- D:\Programme\Verknüpfung mit Outlook Express.lnk
[2006/08/30 12:36:08 | 000,285,216 | ---- | C] () -- D:\WINDOWS\System32\drivers\Onsio.sys
[2006/08/30 12:36:08 | 000,007,680 | ---- | C] () -- D:\WINDOWS\System32\drivers\Onsreged.sys
[2006/08/28 14:33:53 | 000,004,212 | -H-- | C] () -- D:\WINDOWS\System32\zllictbl.dat
[2006/08/28 12:19:29 | 000,069,224 | ---- | C] () -- D:\Dokumente und Einstellungen\ich\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
[2006/08/28 12:12:05 | 000,186,368 | ---- | C] () -- D:\WINDOWS\System32\encdec.dll
[2006/08/28 12:12:04 | 000,081,920 | ---- | C] () -- D:\WINDOWS\System32\ieencode.dll
[2006/08/28 12:12:02 | 000,270,848 | ---- | C] () -- D:\WINDOWS\System32\sbe.dll
[2006/08/26 13:43:41 | 000,262,144 | ---- | C] () -- D:\WINDOWS\system32\config\systemprofile\ntuser.dat
[2006/08/26 13:05:53 | 000,000,552 | ---- | C] () -- D:\WINDOWS\System32\d3d8caps.dat
[2006/08/26 12:21:25 | 000,000,000 | ---- | C] () -- D:\WINDOWS\nsreg.dat
[2006/08/26 12:21:16 | 000,003,418 | ---- | C] () -- D:\WINDOWS\mozver.dat
[2006/08/26 11:08:52 | 000,004,831 | ---- | C] () -- D:\WINDOWS\Ascd_tmp.ini
[2006/08/26 11:01:39 | 000,000,300 | -HS- | C] () -- D:\Dokumente und Einstellungen\ich\ntuser.ini
[2006/08/26 10:53:11 | 000,000,020 | -HS- | C] () -- D:\Dokumente und Einstellungen\LocalService\ntuser.ini
[2006/08/26 10:53:10 | 000,253,952 | ---- | C] () -- D:\Dokumente und Einstellungen\NetworkService\NTUSER.DAT
[2006/08/26 10:53:10 | 000,253,952 | ---- | C] () -- D:\Dokumente und Einstellungen\LocalService\NTUSER.DAT
[2006/08/26 10:53:10 | 000,000,190 | -HS- | C] () -- D:\Dokumente und Einstellungen\NetworkService\ntuser.ini
[2006/08/26 07:07:34 | 000,002,048 | --S- | C] () -- D:\WINDOWS\bootstat.dat
[2006/08/26 07:04:07 | 000,000,000 | ---- | C] () -- D:\WINDOWS\control.ini
[2006/08/26 07:02:54 | 000,000,488 | RH-- | C] () -- D:\WINDOWS\System32\logonui.exe.manifest
[2006/08/26 07:02:48 | 000,000,749 | RH-- | C] () -- D:\WINDOWS\System32\cdplayer.exe.manifest
[2006/08/26 07:00:51 | 000,021,740 | ---- | C] () -- D:\WINDOWS\System32\emptyregdb.dat
[2006/08/26 07:00:41 | 000,000,037 | ---- | C] () -- D:\WINDOWS\vbaddin.ini
[2006/08/26 07:00:41 | 000,000,036 | ---- | C] () -- D:\WINDOWS\vb.ini
[2006/08/26 06:59:56 | 000,027,055 | ---- | C] () -- D:\WINDOWS\System32\tslabels.ini
[2006/08/26 06:59:54 | 000,003,999 | ---- | C] () -- D:\WINDOWS\System32\msdtcprf.ini
[2006/08/26 06:50:43 | 000,946,822 | ---- | C] () -- D:\WINDOWS\System32\PerfStringBackup.INI
[2006/08/26 06:50:42 | 000,004,161 | ---- | C] () -- D:\WINDOWS\ODBCINST.INI
[2006/08/26 06:49:46 | 000,286,112 | ---- | C] () -- D:\WINDOWS\System32\FNTCACHE.DAT
[2006/06/01 10:22:00 | 001,662,976 | ---- | C] () -- D:\WINDOWS\System32\nvwdmcpl.dll
[2006/06/01 10:22:00 | 001,519,616 | ---- | C] () -- D:\WINDOWS\System32\nwiz.exe
[2006/06/01 10:22:00 | 001,466,368 | ---- | C] () -- D:\WINDOWS\System32\nview.dll
[2006/06/01 10:22:00 | 001,339,392 | ---- | C] () -- D:\WINDOWS\System32\nvdspsch.exe
[2006/06/01 10:22:00 | 001,019,904 | ---- | C] () -- D:\WINDOWS\System32\nvwimg.dll
[2006/06/01 10:22:00 | 000,581,632 | ---- | C] () -- D:\WINDOWS\System32\nvhwvid.dll
[2006/06/01 10:22:00 | 000,466,944 | ---- | C] () -- D:\WINDOWS\System32\nvShell.dll
[2006/06/01 10:22:00 | 000,442,368 | ---- | C] () -- D:\WINDOWS\System32\nvAppBar.exe
[2006/06/01 10:22:00 | 000,425,984 | ---- | C] () -- D:\WINDOWS\System32\keystone.exe
[2006/06/01 10:22:00 | 000,286,720 | ---- | C] () -- D:\WINDOWS\System32\nvnt4cpl.dll
[2006/06/01 10:22:00 | 000,196,608 | ---- | C] () -- D:\WINDOWS\System32\NVAPI.DLL
[2006/04/28 15:05:14 | 000,156,671 | ---- | C] () -- D:\WINDOWS\System32\atiicdxx.dat
[2004/08/02 07:20:40 | 000,004,569 | ---- | C] () -- D:\WINDOWS\System32\secupd.dat
[2003/02/20 10:53:42 | 000,005,702 | ---- | C] () -- D:\WINDOWS\System32\OUTLPERF.INI
[2001/10/10 01:57:58 | 000,073,786 | ---- | C] () -- D:\WINDOWS\System32\dntvmc23.dll
[2001/10/10 01:57:58 | 000,061,497 | ---- | C] () -- D:\WINDOWS\System32\dntvm23.dll
[2001/09/04 10:36:15 | 000,013,312 | ---- | C] () -- D:\WINDOWS\System32\win87em.dll
[2001/09/04 10:36:14 | 000,001,345 | ---- | C] () -- D:\WINDOWS\win.ini
[2001/09/04 10:36:11 | 000,001,157 | ---- | C] () -- D:\WINDOWS\System32\vwipxspx.exe
[2001/09/04 10:36:04 | 000,015,360 | ---- | C] () -- D:\WINDOWS\System32\tsd32.dll
[2001/09/04 10:36:01 | 000,053,478 | ---- | C] () -- D:\WINDOWS\System32\tcpmon.ini
[2001/09/04 10:36:00 | 000,000,327 | ---- | C] () -- D:\WINDOWS\system.ini
[2001/09/04 10:35:49 | 000,011,903 | ---- | C] () -- D:\WINDOWS\System32\setver.exe
[2001/09/04 10:35:49 | 000,000,882 | ---- | C] () -- D:\WINDOWS\System32\share.exe
[2001/09/04 10:35:46 | 000,027,440 | ---- | C] () -- D:\WINDOWS\System32\drivers\secdrv.sys
[2001/09/04 10:35:46 | 000,010,240 | ---- | C] () -- D:\WINDOWS\System32\scriptpw.dll
[2001/09/04 10:35:45 | 000,017,241 | ---- | C] () -- D:\WINDOWS\System32\rsvp.ini
[2001/09/04 10:35:44 | 000,003,358 | ---- | C] () -- D:\WINDOWS\System32\redir.exe
[2001/09/04 10:35:43 | 000,006,287 | ---- | C] () -- D:\WINDOWS\System32\rasctrs.ini
[2001/09/04 10:35:42 | 000,733,696 | ---- | C] () -- D:\WINDOWS\System32\qedwipes.dll
[2001/09/04 10:35:42 | 000,014,060 | ---- | C] () -- D:\WINDOWS\System32\pschdprf.ini
[2001/09/04 10:35:37 | 000,000,369 | ---- | C] () -- D:\WINDOWS\System32\prodspec.ini
[2001/09/04 10:35:36 | 000,408,618 | ---- | C] () -- D:\WINDOWS\System32\perfh007.dat
[2001/09/04 10:35:36 | 000,395,200 | ---- | C] () -- D:\WINDOWS\System32\perfh009.dat
[2001/09/04 10:35:36 | 000,272,128 | ---- | C] () -- D:\WINDOWS\System32\perfi009.dat
[2001/09/04 10:35:36 | 000,269,480 | ---- | C] () -- D:\WINDOWS\System32\perfi007.dat
[2001/09/04 10:35:36 | 000,034,478 | ---- | C] () -- D:\WINDOWS\System32\perfd007.dat
[2001/09/04 10:35:36 | 000,028,626 | ---- | C] () -- D:\WINDOWS\System32\perfd009.dat
[2001/09/04 10:35:36 | 000,004,438 | ---- | C] () -- D:\WINDOWS\System32\perfci.ini
[2001/09/04 10:35:36 | 000,004,233 | ---- | C] () -- D:\WINDOWS\System32\perfwci.ini
[2001/09/04 10:35:36 | 000,001,783 | ---- | C] () -- D:\WINDOWS\System32\perffilt.ini
[2001/09/04 10:35:35 | 000,071,598 | ---- | C] () -- D:\WINDOWS\System32\perfc007.dat
[2001/09/04 10:35:35 | 000,059,440 | ---- | C] () -- D:\WINDOWS\System32\perfc009.dat
[2001/09/04 10:35:33 | 013,107,200 | ---- | C] () -- D:\WINDOWS\System32\oembios.bin
[2001/09/04 10:35:33 | 000,004,463 | ---- | C] () -- D:\WINDOWS\System32\oembios.dat
[2001/09/04 10:35:30 | 000,003,262 | ---- | C] () -- D:\WINDOWS\System32\nw16.exe
[2001/09/04 10:35:28 | 000,035,648 | ---- | C] () -- D:\WINDOWS\System32\ntio411.sys
[2001/09/04 10:35:28 | 000,035,424 | ---- | C] () -- D:\WINDOWS\System32\ntio412.sys
[2001/09/04 10:35:28 | 000,034,560 | ---- | C] () -- D:\WINDOWS\System32\ntio804.sys
[2001/09/04 10:35:28 | 000,034,560 | ---- | C] () -- D:\WINDOWS\System32\ntio404.sys
[2001/09/04 10:35:28 | 000,034,032 | ---- | C] () -- D:\WINDOWS\System32\ntio.sys
[2001/09/04 10:35:27 | 000,029,370 | ---- | C] () -- D:\WINDOWS\System32\ntdos411.sys
[2001/09/04 10:35:27 | 000,029,274 | ---- | C] () -- D:\WINDOWS\System32\ntdos412.sys
[2001/09/04 10:35:27 | 000,029,146 | ---- | C] () -- D:\WINDOWS\System32\ntdos804.sys
[2001/09/04 10:35:27 | 000,029,146 | ---- | C] () -- D:\WINDOWS\System32\ntdos404.sys
[2001/09/04 10:35:27 | 000,027,914 | ---- | C] () -- D:\WINDOWS\System32\ntdos.sys
[2001/09/04 10:35:26 | 000,007,084 | ---- | C] () -- D:\WINDOWS\System32\nlsfunc.exe
[2001/09/04 10:35:26 | 000,000,741 | ---- | C] () -- D:\WINDOWS\System32\noise.dat
[2001/09/04 10:35:24 | 000,002,656 | ---- | C] () -- D:\WINDOWS\System32\netware.drv
[2001/09/04 10:35:14 | 000,094,282 | ---- | C] () -- D:\WINDOWS\System32\msencode.dll
[2001/09/04 10:35:14 | 000,014,336 | ---- | C] () -- D:\WINDOWS\System32\msdmo.dll
[2001/09/04 10:35:14 | 000,001,405 | ---- | C] () -- D:\WINDOWS\msdfmap.ini
[2001/09/04 10:35:14 | 000,000,817 | ---- | C] () -- D:\WINDOWS\System32\mscdexnt.exe
[2001/09/04 10:35:12 | 000,021,542 | ---- | C] () -- D:\WINDOWS\System32\mqperf.ini
[2001/09/04 10:35:09 | 000,673,088 | ---- | C] () -- D:\WINDOWS\System32\mlang.dat
[2001/09/04 10:35:08 | 000,046,258 | ---- | C] () -- D:\WINDOWS\System32\mib.bin
[2001/09/04 10:35:08 | 000,039,546 | ---- | C] () -- D:\WINDOWS\System32\mem.exe
[2001/09/04 10:35:06 | 000,001,273 | ---- | C] () -- D:\WINDOWS\System32\loadfix.com
[2001/09/04 10:35:04 | 000,042,809 | ---- | C] () -- D:\WINDOWS\System32\key01.sys
[2001/09/04 10:35:04 | 000,042,537 | ---- | C] () -- D:\WINDOWS\System32\keyboard.sys
[2001/09/04 10:35:03 | 000,014,816 | ---- | C] () -- D:\WINDOWS\System32\kb16.com
[2001/09/04 10:35:02 | 000,199,168 | ---- | C] () -- D:\WINDOWS\System32\ir32_32.dll
[2001/09/04 10:34:56 | 000,019,726 | ---- | C] () -- D:\WINDOWS\System32\graphics.com
[2001/09/04 10:34:56 | 000,004,992 | ---- | C] () -- D:\WINDOWS\System32\himem.sys
[2001/09/04 10:34:52 | 000,000,882 | ---- | C] () -- D:\WINDOWS\System32\fastopen.exe
[2001/09/04 10:34:51 | 000,008,584 | ---- | C] () -- D:\WINDOWS\System32\exe2bin.exe
[2001/09/04 10:34:50 | 001,015,477 | ---- | C] () -- D:\WINDOWS\System32\esentprf.ini
[2001/09/04 10:34:49 | 000,071,022 | ---- | C] () -- D:\WINDOWS\System32\edit.com
[2001/09/04 10:34:49 | 000,013,026 | ---- | C] () -- D:\WINDOWS\System32\edlin.exe
[2001/09/04 10:34:48 | 000,218,003 | ---- | C] () -- D:\WINDOWS\System32\dssec.dat
[2001/09/04 10:34:24 | 000,054,128 | ---- | C] () -- D:\WINDOWS\System32\dosx.exe
[2001/09/04 10:34:22 | 000,021,210 | ---- | C] () -- D:\WINDOWS\System32\debug.exe
[2001/09/04 10:34:21 | 000,001,788 | ---- | C] () -- D:\WINDOWS\System32\Dcache.bin
[2001/09/04 10:34:18 | 000,027,097 | ---- | C] () -- D:\WINDOWS\System32\country.sys
[2001/09/04 10:34:17 | 000,253,440 | ---- | C] () -- D:\WINDOWS\System32\compatUI.dll
[2001/09/04 10:34:17 | 000,052,777 | ---- | C] () -- D:\WINDOWS\System32\command.com
[2001/09/04 10:34:06 | 000,012,610 | ---- | C] () -- D:\WINDOWS\System32\append.exe
[2001/09/04 10:34:06 | 000,009,032 | ---- | C] () -- D:\WINDOWS\System32\ansi.sys
[2001/09/04 10:34:05 | 000,070,656 | ---- | C] () -- D:\WINDOWS\System32\amstream.dll
[2001/08/17 21:54:50 | 000,057,856 | ---- | C] () -- D:\WINDOWS\System32\dvdplay.exe
[2001/08/17 21:54:08 | 000,157,696 | ---- | C] () -- D:\WINDOWS\System32\paqsp.dll
[2001/03/07 01:02:30 | 000,229,431 | ---- | C] () -- D:\WINDOWS\System32\dnt23.dll
[2000/09/13 19:03:00 | 000,000,145 | ---- | C] () -- D:\WINDOWS\System32\EBPPORT.DAT
 
========== LOP Check ==========
 
[2007/02/14 13:22:50 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic
[2008/12/06 11:49:02 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ashampoo
[2006/12/02 02:57:24 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avg7
[2007/04/20 01:57:10 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BTrieve
[2007/04/20 01:55:44 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Haufe
[2007/04/20 01:57:02 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lexware
[2008/05/12 13:45:42 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2008/11/20 12:53:04 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Maxtor
[2007/03/31 02:56:00 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\My Pictures
[2007/12/24 04:49:28 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pinnacle
[2006/08/27 07:18:54 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-DSL SpeedManager
[2008/11/19 11:37:10 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2006/09/02 05:44:10 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ulead Systems
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2008/11/19 11:07:44 | 000,000,000 | ---D | M](D:\WINDOWS\System32\??????????) -- D:\WINDOWS\System32\粑۰粒￿￿۫粒⁃睌
[2008/11/19 11:07:43 | 000,000,000 | ---D | C](D:\WINDOWS\System32\??????????) -- D:\WINDOWS\System32\粑۰粒￿￿۫粒⁃睌
< End of report >
Code:
ATTFilter
OTL Extras logfile created on: 2/6/2013 4:12:21 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 3070 3070 [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Programme
Drive D: | 135.01 Gb Total Space | 113.71 Gb Free Space | 84.23% Space Free | Partition Type: NTFS
Drive F: | 410.15 Gb Total Space | 311.89 Gb Free Space | 76.04% Space Free | Partition Type: NTFS
Drive G: | 404.17 Gb Total Space | 273.50 Gb Free Space | 67.67% Space Free | Partition Type: NTFS
Drive H: | 99.96 Gb Total Space | 81.87 Gb Free Space | 81.90% Space Free | Partition Type: NTFS
Drive I: | 100.73 Gb Total Space | 35.54 Gb Free Space | 35.28% Space Free | Partition Type: NTFS
Drive J: | 130.07 Gb Total Space | 26.45 Gb Free Space | 20.34% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days
Using ControlSet: ControlSet005
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- D:\MOZILLA\MOZILL~2\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1"
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Programme\Internet Explorer\iexplore.exe" -nohome
htmlfile [opennew] -- "C:\Programme\Internet Explorer\iexplore.exe" %1
http [open] -- D:\MOZILLA\MOZILL~2\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1"
https [open] -- D:\MOZILLA\MOZILL~2\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1"
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1"
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1"
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Programme\Internet Explorer\iexplore.exe" %1
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Programme\Internet Explorer\iexplore.exe"
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\WINDOWS\System32\ZoneLabs\vsmon.exe" = C:\WINDOWS\System32\ZoneLabs\vsmon.exe:*:Enabled:TrueVector Service -- (Zone Labs, LLC)
"C:\Programme\Sony Ericsson\Update Service\ma3platform.exe" = C:\Programme\Sony Ericsson\Update Service\ma3platform.exe:*:Enabled:ma3platform
"C:\WINDOWS\System32\dpvsetup.exe" = C:\WINDOWS\System32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\WINDOWS\System32\RUNDLL32.EXE" = C:\WINDOWS\System32\RUNDLL32.EXE:*:Enabled:Eine DLL-Datei als Anwendung ausführen -- (Microsoft Corporation)
"D:\Programme\Active sync\wcescomm.exe" = D:\Programme\Active sync\wcescomm.exe:*:Enabled:ActiveSync Connection Manager
"C:\WINDOWS\Temp\KD_installer.exe" = C:\WINDOWS\Temp\KD_installer.exe:*:Enabled:Kabel Deutschland Installer
"C:\Programme\VideoLAN\VLC\vlc.exe" = C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player
"D:\Mozilla\Mozilla Firefox(2)\Mozilla Firefox\firefox.exe" = D:\Mozilla\Mozilla Firefox(2)\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03A70F27-D80E-4A22-A1B4-1C878FC6056A}" = Sony Ericsson Mobile Networking Wizard
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{123D40B5-66EF-4F41-A2BA-0B74D0D1C8B3}" = Steuer 2006
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1E04F83B-2AB9-4301-9EF7-E86307F79C72}" = Google Earth
"{1E5007FA-DA5E-4EDD-BDE5-14D128D66887}" = PowerQuest PartitionMagic 7.0
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{238B8820-011B-11D6-9C28-0080C85A0C2D}" = Transparency Adaptor Calibrator
"{2C4A5877-21D1-4A15-9D20-24BA54A24093}" = Playlist tool
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer
"{345C90FB-FA10-11D5-9C2A-0080C85A0C2D}" = ABBYY FineReader OCR Engine
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3A33D692-8679-4142-94C7-0BB784B9B3A3}" = DMX 6fire 24/96 ControlPanel
"{3B7458C7-3F03-4415-AC39-D51EDEACDCCC}" = Steuer 2007
"{4BC211DD-2BBC-4CDF-AB43-3B93444617E0}" = Steuer 2006
"{4D400407-6332-4101-8C78-506C85813506}" = Sony Ericsson OCS
"{53480520-7555-470E-8C69-750B0472B4BB}" = O&O Defrag Professional Edition
"{544FB392-069D-4BA5-9DC7-FFD47230AEE5}" = Photohands 1.0G
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{59C95D15-5F24-435E-898D-3806961FC79D}" = Steuer 2006
"{5E8C42DD-7E43-462C-84CC-99E5BBE3E101}" = Steuer 2007
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{70B45586-B51E-4947-A258-A895596C5CED}" = Photo Loader 2.3G
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{757AD3D4-036B-42FA-B0A4-96BD6F4605A0}" = Ulead VideoStudio 7 SE DVD
"{7AA828F3-BD67-495E-9742-BD9C3F196E78}" = PC Suite
"{81A60A13-224D-4637-8203-3EAC03B121A4}" = Maxtor*MaxBlast
"{8FBC9407-713D-4B8A-98D2-57210DA56049}" = MSN Toolbar
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9075FCA2-7B7E-46A3-841A-52519270C1B2}" = PowerQuest Drive Image 5.0
"{909B62B0-8ACA-4061-A83B-09CAEF609619}" = MSXML 6.0 Parser
"{95E0E6DC-C308-4C96-BEDB-68C75A32FAF8}_is1" = Tetris
"{97A4D873-47B9-454A-A567-8AFF41C07155}" = EasyRecovery DataRecovery
"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows
"{A074DE55-29EB-459C-99C9-3F26C5669ECB}" = EasyRecovery DataRecovery Trial
"{A0E2CD91-BC77-411F-BD5D-5ABCA8C7C5B8}" = Sony Ericsson Mobile Phone Monitor
"{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}" = Brother MFL-Pro Suite
"{AC76BA86-1033-F400-7760-000000000002}" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch
"{B08D262E-D902-11D5-9C28-0080C85A0C2D}" = ScanWizard 5
"{B754B683-E23C-4583-9312-50AD86836B42}" = Steuer Hilfesammlung
"{C00FAC7F-DAF5-4FD8-83E7-5959C882A811}" = Sony Ericsson File Manager
"{CBA04F21-D46C-46FC-9A8A-A5360F58CF94}" = Sony Ericsson Sync Station
"{D777130E-86A9-428C-B7E6-9EFBCAB4E4CC}" = Steuer Hilfesammlung
"{E03EE3F8-F081-4EF5-BE18-CC849459B070}" = Sony Ericsson Capability Manager
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{EA9FAF16-0E5C-42C4-9742-9AF8D5F6D69B}" = ATI Catalyst Control Center
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA}" = Pinnacle TVCenter Pro
"{FDDC37C3-B2FC-4B5E-A854-1E69B2FFCA71}" = Steuer Update 14.01
"Ad-Aware SE Personal" = Ad-Aware SE Personal
"Adobe Acrobat 7.0 Professional - EFG" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"All ATI Software" = ATI - Software Uninstall Utility
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal – Free Antivirus
"AsusUpdate" = AsusUpdate
"ATI Display Driver" = ATI Display Driver
"BetaPlayer" = BetaPlayer
"Digital Image Recovery_is1" = Digital Image Recovery 1.47
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"FFMPEG" = FFMPEG
"FLAC" = FLAC
"FTDICOMM" = SEMC DSS SyncStation Driver
"Google Updater" = Google Updater
"Hard Disk Low Level Format Tool_is1" = Hard Disk Low Level Format Tool 2.36 build 1181
"HijackThis" = HijackThis 1.99.1
"ImTOO 3GP Video Converter" = ImTOO 3GP Video Converter
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"InstallShield_{97A4D873-47B9-454A-A567-8AFF41C07155}" = EasyRecovery DataRecovery
"InstallShield_{A074DE55-29EB-459C-99C9-3F26C5669ECB}" = EasyRecovery DataRecovery Trial
"KlickTel99" = klickTel Mai 99 - 32-Bit
"KLiteCodecPack_is1" = K-Lite Codec Pack 3.8.0 Full
"Language pack for Ad-Aware SE" = Language pack for Ad-Aware SE
"MAGIX Fotos auf CD & DVD 7 deluxe D" = MAGIX Fotos auf CD & DVD 7 deluxe 7.0.2.0 (D)
"MediaCoder" = MediaCoder 0.6.2
"MediaInfo" = MediaInfo 0.7.6.1BETA
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox (2.0.0.12)" = Mozilla Firefox (2.0.0.12)
"Need For Speed III" = Need For Speed III
"OEMaster-Daten-ExportfürOutlookExpress" = OEMaster - DBX-Reader und Daten-Export für Outlook Express
"ProtectDisc Driver 10" = ProtectDisc Helper Driver 10
"S4Uninst" = Die Siedler IV
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"ST6UNST #1" = Outlook Express Quick Backup
"VLC media player" = VLC media player 0.9.6
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinRAR archiver" = WinRAR Archivierer
"ZoneAlarm" = ZoneAlarm
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\gast_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dr. Hardware 2008_is1" = Dr. Hardware 2008 9.0.0d
"JAP" = JAP
"Mozilla Firefox (2.0)" = Mozilla Firefox (2.0)
"Stellar Phoenix DMR_is1" = Stellar Phoenix DMR 1.0
 
< End of report >
Ich hoffe Ihr könnt was damit anfangen und findet den Übeltäter.

Danke und Gruß

Christian

Alt 07.02.2013, 13:20   #10
markusg
/// Malware-holic
 
Windows XP startet auch nicht im abgesichtern Modus - Standard

Windows XP startet auch nicht im abgesichtern Modus


hattest du um otl zu starten, änderungen im bios vorgenommen, den ide bzw aci mode eingestellt, dann stelle das wieder um.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 07.02.2013, 17:21   #11
paulibins
 
Windows XP startet auch nicht im abgesichtern Modus - Standard

Windows XP startet auch nicht im abgesichtern Modus


Hallo,
nein ich habe nur die Bootreihenfolge geändert.
Aber ich habe was anderes gefunden:
Habe gestern Nacht das ausführlich Scanprogramm von Avast über die Kopi meiner C:\Windows Patrtition auf der USB Platte laufen lassen und heute morgen hat es zwei Bedrohungen aufgelistet:
c:\windows/system32\i.virus-Generic.Botget F8733BEE und
hiberfil.sys
vielleicht hilft das weiter.

Gruß
Christian

Alt 08.02.2013, 16:29   #12
markusg
/// Malware-holic
 
Windows XP startet auch nicht im abgesichtern Modus - Standard

Windows XP startet auch nicht im abgesichtern Modus


endere die bootreiehenfolge mal wieder um. so dass c an erster Stelle steht
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 09.02.2013, 16:43   #13
paulibins
 
Windows XP startet auch nicht im abgesichtern Modus - Standard

Windows XP startet auch nicht im abgesichtern Modus


Hallo
danke für eure Hilfe. Rchner läuft wieder. Bitte Thread schließen

Gruß
Christian

Antwort

Themen zu Windows XP startet auch nicht im abgesichtern Modus
angemeldet, aufforderung, bricht, chris, christian, euren, extras.txt, fehlermeldung, gemeldet, gestern, guten, heulen, komische, malwareprogramm, modus, nicht mehr, otl.txt, plug-in, scans, starte, startet, versuche, windows, windows xp


« Verdacht auf Spyware - Anzeichen: Monitor blinkt ab und zu mal | Trojaner gelöscht aber wohl nicht ganz »


Ähnliche Themen: Windows XP startet auch nicht im abgesichtern Modus


  1. Windows 8 startet nicht mehr und auch kein abgesicherter Modus möglich
    Plagegeister aller Art und deren Bekämpfung - 09.11.2015 (7)
  2. Windows 7: BKA Trojaner - Sperrbildschirm - abges. Modus startet nicht
    Log-Analyse und Auswertung - 11.06.2014 (3)
  3. Bundestrojaner, Windows startet nicht im abgesicherten Modus
    Log-Analyse und Auswertung - 13.05.2014 (17)
  4. Windows 7: Langsam, MBam startet nicht, auch im abgesicherten Modus
    Plagegeister aller Art und deren Bekämpfung - 11.03.2014 (7)
  5. GVU Trojaner - Windows XP startet nicht im abgesicherten Modus
    Plagegeister aller Art und deren Bekämpfung - 15.12.2013 (13)
  6. Windows XP: GUV Trojaner - abgesicherter Modus startet nicht
    Log-Analyse und Auswertung - 28.11.2013 (17)
  7. PC lässt sich nicht mehr hochfahren, auch nicht im abgesicherten Modus (Windows 7)
    Plagegeister aller Art und deren Bekämpfung - 30.08.2013 (11)
  8. Windows 7 blockiert nach kurzer Zeit auch im abgesichtern Modus (Trojaner)
    Log-Analyse und Auswertung - 25.08.2013 (13)
  9. Windows 8 startet nicht - schwarzer Bilderschirm - Abgesicherter Modus nicht möglich
    Log-Analyse und Auswertung - 25.08.2013 (7)
  10. GVU TROJANER, kein Zugang zum abgesichtern Modus, keine Ahnung von PC
    Plagegeister aller Art und deren Bekämpfung - 15.04.2013 (20)
  11. GVU auf Windows XP / abgesicherter Modus startet nicht
    Plagegeister aller Art und deren Bekämpfung - 13.01.2013 (38)
  12. Bundestrojaner, der auch im abgesicherten Modus startet
    Log-Analyse und Auswertung - 03.08.2012 (7)
  13. GVU Trojaner - Windows XP startet nicht im abgesicherten Modus
    Plagegeister aller Art und deren Bekämpfung - 26.06.2012 (37)
  14. Security suite entfernen, im abgesichtern Modus fährt der Computer einfach bei scans herunter.
    Plagegeister aller Art und deren Bekämpfung - 08.09.2010 (8)
  15. Laptop Startet Nicht, Abgesicherter Modus auch nicht! Virus... Was machen?
    Plagegeister aller Art und deren Bekämpfung - 05.12.2009 (2)
  16. Windows startet nicht mehr im normalen Modus...
    Plagegeister aller Art und deren Bekämpfung - 01.09.2009 (8)
  17. Windows startet nicht,auch nicht im abgesicherten Modus
    Alles rund um Windows - 29.07.2008 (3)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Windows XP startet auch nicht im abgesichtern Modus - Guten Abend ich habe mich hier angemeldet, weil Windows XP nicht mehr startet *auch nicht im abesicherten Modus. Gestern ging noch alles, es kam beimSzstemstart nur so eine komische Aufforderung - Windows XP startet auch nicht im abgesichtern Modus...
Archiv
Du betrachtest: Windows XP startet auch nicht im abgesichtern Modus auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131