Zeus/ZBot vermutet. Schreiben Telekom und Hausbank hierzu.

OTL logfile created on: 27.05.2013 07:35:52 - Run 6
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Download
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,93 Gb Total Physical Memory | 1,29 Gb Available Physical Memory | 66,96% Memory free
3,78 Gb Paging File | 3,20 Gb Available in Paging File | 84,72% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 232,88 Gb Total Space | 179,61 Gb Free Space | 77,13% Space Free | Partition Type: NTFS
Drive E: | 996,00 Mb Total Space | 413,41 Mb Free Space | 41,51% Space Free | Partition Type: FAT32
 
Computer Name: RAINERS-HP | User Name: Rainer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Download\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Download\Defogger.exe ()
PRC - C:\Programme\Ask.com\AbineSDK\IE\DNTPService.exe (Abine Inc.)
PRC - C:\Programme\Ask.com\CallingIDSDK\CIDGlobalLight.exe (CallingID Ltd.)
PRC - C:\Programme\Ask.com\Updater\Updater.exe (Ask)
PRC - C:\Programme\T-Mobile\web'n'walk Manager\DataCardMonitor.exe (Huawei Technologies Co., Ltd.)
PRC - C:\Programme\TeamViewer\Version7\TeamViewer.exe (TeamViewer GmbH)
PRC - C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Programme\TeamViewer\Version7\tv_w32.exe (TeamViewer GmbH)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\Gemeinsame Dateien\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
PRC - C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Programme\ArcSoft\TotalMedia Backup\uBBMonitor.exe (ArcSoft, Inc.)
PRC - C:\Programme\T-Mobile\web'n'walk Manager\WTGU.exe ()
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTMON.EXE (Intel Corporation)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE (Intel Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\accelerometerST.exe (Hewlett-Packard Corporation)
PRC - C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems)
PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - C:\Download\Defogger.exe ()
MOD - C:\Programme\Ask.com\AbineSDK\IE\DNTPContentFilter.dll ()
MOD - C:\Programme\Ask.com\AbineSDK\IE\DNTPButton.dll ()
MOD - C:\Programme\Ask.com\AbineSDK\IE\DNTPServicePS.dll ()
MOD - C:\WINDOWS\system32\redmonnt.dll ()
MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU ()
MOD - C:\Programme\T-Mobile\web'n'walk Manager\UpgraderGer.dll ()
MOD - C:\Programme\T-Mobile\web'n'walk Manager\WTGU.exe ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (ImapiService) -- C:\WINDOWS\system32\imapihp.exe (Microsoft Corporation)
SRV - (TeamViewer7) -- C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (ACDaemon) -- C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (FLCDLOCK) -- C:\WINDOWS\system32\flcdlock.exe (Hewlett-Packard Ltd)
SRV - (IAANTMON) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTMON.EXE (Intel Corporation)
SRV - (RoxMediaDB10) -- C:\Programme\Gemeinsame Dateien\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe (Sonic Solutions)
SRV - (stllssvr) -- C:\Programme\Gemeinsame Dateien\SureThing Shared\stllssvr.exe (MicroVision Development, Inc.)
SRV - (AgereModemAudio) -- C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (MDM) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WDICA) -- File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (lbrtfdc) -- File not found
DRV - (i2omgmt) -- File not found
DRV - (Changer) -- File not found
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV - (avkmgr) -- C:\WINDOWS\system32\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (BazisPortableCDBus) -- C:\WINDOWS\system32\drivers\BazisPortableCDBus.sys (SysProgs.org)
DRV - (25023122) -- C:\WINDOWS\system32\drivers\25023122.sys (Kaspersky Lab)
DRV - (25023121) -- C:\WINDOWS\system32\drivers\25023121.sys (Kaspersky Lab)
DRV - (SNP2UVC) -- C:\WINDOWS\system32\drivers\snp2uvc.sys ()
DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (NETw5x32) -- C:\WINDOWS\system32\drivers\NETw5x32.sys (Intel Corporation)
DRV - (DAMDrv) -- C:\WINDOWS\system32\drivers\DAMDrv.sys (Hewlett-Packard Development Company L.P.)
DRV - (BTWUSB) -- C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (Accelerometer) -- C:\WINDOWS\system32\drivers\Accelerometer.sys (Hewlett-Packard Corporation)
DRV - (hpdskflt) -- C:\WINDOWS\system32\drivers\hpdskflt.sys (Hewlett-Packard Corporation)
DRV - (SFAUDIO) -- C:\WINDOWS\system32\drivers\sfaudio.sys (Sonic Focus, Inc)
DRV - (tcpipBM) -- C:\WINDOWS\System32\drivers\tcpipBM.sys (Bytemobile, Inc.)
DRV - (b57w2k) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (SCR3XX2K) -- C:\WINDOWS\system32\drivers\SCR3XX2K.sys (SCM Microsystems Inc.)
DRV - (HpqKbFiltr) -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (HBtnKey) -- C:\WINDOWS\system32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1085031214-1177238915-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE
IE - HKU\S-1-5-21-1085031214-1177238915-725345543-1003\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-1085031214-1177238915-725345543-1003\..\SearchScopes,DefaultScope = {EF4643A6-ED83-415A-AC71-2CB44AC20B8A}
IE - HKU\S-1-5-21-1085031214-1177238915-725345543-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1085031214-1177238915-725345543-1003\..\SearchScopes\{EF4643A6-ED83-415A-AC71-2CB44AC20B8A}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-1085031214-1177238915-725345543-1003\..\SearchScopes\{FFF296E3-A461-4813-A727-AE8E79F0A86E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=7d643e0c-55dc-40bd-97db-902a7b88af0c&apn_sauid=0BD0F842-0146-453C-9340-A9C04FC3C63F
IE - HKU\S-1-5-21-1085031214-1177238915-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1085031214-1177238915-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\S-1-5-21-1085031214-1177238915-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 192.168.121.99:8080
 
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programme\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Programme\Gemeinsame Dateien\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
 
 
O1 HOSTS File: ([2012.05.05 18:09:58 | 000,442,846 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1    www.007guard.com
O1 - Hosts: 127.0.0.1    007guard.com
O1 - Hosts: 127.0.0.1    008i.com
O1 - Hosts: 127.0.0.1    www.008k.com
O1 - Hosts: 127.0.0.1    008k.com
O1 - Hosts: 127.0.0.1    www.00hq.com
O1 - Hosts: 127.0.0.1    00hq.com
O1 - Hosts: 127.0.0.1    010402.com
O1 - Hosts: 127.0.0.1    www.032439.com
O1 - Hosts: 127.0.0.1    032439.com
O1 - Hosts: 127.0.0.1    www.0scan.com
O1 - Hosts: 127.0.0.1    0scan.com
O1 - Hosts: 127.0.0.1    www.1000gratisproben.com
O1 - Hosts: 127.0.0.1    1000gratisproben.com
O1 - Hosts: 127.0.0.1    1001namen.com
O1 - Hosts: 127.0.0.1    www.1001namen.com
O1 - Hosts: 127.0.0.1    100888290cs.com
O1 - Hosts: 127.0.0.1    www.100888290cs.com
O1 - Hosts: 127.0.0.1    www.100sexlinks.com
O1 - Hosts: 127.0.0.1    100sexlinks.com
O1 - Hosts: 127.0.0.1    www.10sek.com
O1 - Hosts: 127.0.0.1    10sek.com
O1 - Hosts: 127.0.0.1    www.1-2005-search.com
O1 - Hosts: 127.0.0.1    1-2005-search.com
O1 - Hosts: 15215 more lines...
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-1085031214-1177238915-725345543-1003\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AccelerometerSysTrayApplet] C:\WINDOWS\system32\accelerometerST.exe (Hewlett-Packard Corporation)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Cpqset] C:\Programme\Hewlett-Packard\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [DataCardMonitor] C:\Programme\T-Mobile\web'n'walk Manager\DataCardMonitor.exe (Huawei Technologies Co., Ltd.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [hp 1000 firmware] C:\Programme\hp LaserJet 1000\fwdl.exe (Zenographics)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE (Intel Corporation)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Programme\Gemeinsame Dateien\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SyncInfrastructure] C:\Dokumente und Einstellungen\Rainer\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\4669\SyncInfrastructure.exe File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\AutorunsDisabled [2012.02.24 09:40:52 | 000,000,000 | -H-D | M]
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\TotalMedia Backup Monitor.lnk = C:\Programme\ArcSoft\TotalMedia Backup\uBBMonitor.exe (ArcSoft, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WTGU.lnk = C:\Programme\T-Mobile\web'n'walk Manager\WTGU.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1085031214-1177238915-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1085031214-1177238915-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1369398220937 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.121.7 192.168.121.8 127.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0F908E28-76B8-40D3-A752-E8E0E834FE1A}: DhcpNameServer = 192.168.121.7 192.168.121.8 127.0.0.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\DeviceNP: DllName - (DeviceNP.dll) - C:\WINDOWS\System32\DeviceNP.dll (Hewlett-Packard Limited)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.02.23 22:18:30 | 000,000,000 | -HS- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{3652724f-5e65-11e1-81a5-001f29ad28db}\Shell - "" = AutoRun
O33 - MountPoints2\{3652724f-5e65-11e1-81a5-001f29ad28db}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3652724f-5e65-11e1-81a5-001f29ad28db}\Shell\AutoRun\command - "" = E:\UpdateInstaller.exe
O33 - MountPoints2\{39e3ec23-5e74-11e1-81aa-001f29ad28db}\Shell - "" = AutoRun
O33 - MountPoints2\{39e3ec23-5e74-11e1-81aa-001f29ad28db}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{39e3ec23-5e74-11e1-81aa-001f29ad28db}\Shell\AutoRun\command - "" = E:\UpdateInstaller.exe
O33 - MountPoints2\{4c1fefb3-5e6a-11e1-81a7-001f29ad28db}\Shell - "" = AutoRun
O33 - MountPoints2\{4c1fefb3-5e6a-11e1-81a7-001f29ad28db}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{4c1fefb3-5e6a-11e1-81a7-001f29ad28db}\Shell\AutoRun\command - "" = E:\UpdateInstaller.exe
O33 - MountPoints2\{5066ffc9-5ecb-11e1-81af-001f29ad28db}\Shell - "" = AutoRun
O33 - MountPoints2\{5066ffc9-5ecb-11e1-81af-001f29ad28db}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5066ffc9-5ecb-11e1-81af-001f29ad28db}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{62998590-9138-11e1-8216-0016eabbde90}\Shell - "" = AutoRun
O33 - MountPoints2\{62998590-9138-11e1-8216-0016eabbde90}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{62998590-9138-11e1-8216-0016eabbde90}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{62998591-9138-11e1-8216-0016eabbde90}\Shell - "" = AutoRun
O33 - MountPoints2\{62998591-9138-11e1-8216-0016eabbde90}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{62998591-9138-11e1-8216-0016eabbde90}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{7ea85dcc-9810-11e1-8224-0016eabbde90}\Shell - "" = AutoRun
O33 - MountPoints2\{7ea85dcc-9810-11e1-8224-0016eabbde90}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7ea85dcc-9810-11e1-8224-0016eabbde90}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{7ea85dcd-9810-11e1-8224-0016eabbde90}\Shell - "" = AutoRun
O33 - MountPoints2\{7ea85dcd-9810-11e1-8224-0016eabbde90}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7ea85dcd-9810-11e1-8224-0016eabbde90}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{800d2888-5e68-11e1-81a6-001f29ad28db}\Shell - "" = AutoRun
O33 - MountPoints2\{800d2888-5e68-11e1-81a6-001f29ad28db}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{800d2888-5e68-11e1-81a6-001f29ad28db}\Shell\AutoRun\command - "" = E:\UpdateInstaller.exe
O33 - MountPoints2\{dcff0e26-5e71-11e1-81a9-001f29ad28db}\Shell - "" = AutoRun
O33 - MountPoints2\{dcff0e26-5e71-11e1-81a9-001f29ad28db}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{dcff0e26-5e71-11e1-81a9-001f29ad28db}\Shell\AutoRun\command - "" = E:\UpdateInstaller.exe
O33 - MountPoints2\{f0513e24-5e6f-11e1-81a8-001f29ad28db}\Shell - "" = AutoRun
O33 - MountPoints2\{f0513e24-5e6f-11e1-81a8-001f29ad28db}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f0513e24-5e6f-11e1-81a8-001f29ad28db}\Shell\AutoRun\command - "" = E:\UpdateInstaller.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.25 15:31:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Avira
[2013.05.25 15:26:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rainer\Lokale Einstellungen\Anwendungsdaten\DoNotTrackPlus
[2013.05.25 15:26:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\AskToolbar
[2013.05.25 15:25:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira
[2013.05.25 15:25:13 | 000,000,000 | ---D | C] -- C:\Firefox
[2013.05.25 15:25:12 | 000,000,000 | ---D | C] -- C:\Programme\Ask.com
[2013.05.25 15:25:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rainer\Lokale Einstellungen\Anwendungsdaten\AskToolbar
[2013.05.25 15:24:38 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2013.05.25 15:24:36 | 000,135,136 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2013.05.25 15:24:36 | 000,084,744 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2013.05.25 15:24:36 | 000,037,352 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2013.05.25 15:24:35 | 000,000,000 | ---D | C] -- C:\Programme\Avira
[2013.05.25 13:03:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\HitmanPro
[2013.05.25 13:03:29 | 000,000,000 | ---D | C] -- C:\Programme\HitmanPro
[2013.05.25 13:02:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HitmanPro
[2013.05.24 15:18:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\CallingID
[2013.05.24 14:45:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
[2013.05.24 14:42:29 | 000,000,000 | ---D | C] -- C:\Download
[2013.05.24 12:16:25 | 000,000,000 | --SD | C] -- C:\Dokumente und Einstellungen\Rainer\Eigene Dateien\Passwords Database
[2013.05.22 21:39:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Bytemobile
[2013.05.22 18:51:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Trend Micro
[2013.05.22 18:03:55 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2013.05.21 21:50:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rainer\Lokale Einstellungen\Anwendungsdaten\PCHealth
[2013.05.21 20:28:08 | 000,000,000 | ---D | C] -- C:\Programme\SaferSurf
[2013.05.21 20:28:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nutzwerk
[2013.05.21 20:23:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Systweak
[2013.05.21 20:23:29 | 000,018,776 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\WINDOWS\System32\roboot.exe
[2013.05.01 08:12:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rainer\4.0
[2013.05.01 08:12:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rainer\.tfo4
[2003.05.27 13:37:24 | 001,953,792 | ---- | C] (Hewlett-Packard Corp.) -- C:\Programme\pcldll6l.dll
[2003.05.27 13:37:24 | 000,900,388 | ---- | C] (Macromedia, Inc.) -- C:\Programme\hpflash1.exe
[2003.05.27 13:37:24 | 000,151,552 | ---- | C] (Hewlett-Packard Company) -- C:\Programme\SDhp1000.DLL
[2003.05.27 13:37:24 | 000,147,456 | ---- | C] (Zenographics, Inc.) -- C:\Programme\Sr32.dll
[2003.05.27 13:37:24 | 000,147,456 | ---- | C] (Zenographics) -- C:\Programme\ZUNINST.EXE
[2003.05.27 13:37:24 | 000,135,168 | ---- | C] (Hewlett-Packard Company) -- C:\Programme\SUhp1000.DLL
[2003.05.27 13:37:24 | 000,122,880 | ---- | C] (Zenographics, Inc.) -- C:\Programme\SDDMUI.DLL
[2003.05.27 13:37:24 | 000,099,616 | ---- | C] (Zenographics, Inc.) -- C:\Programme\IMF16.drv
[2003.05.27 13:37:24 | 000,098,304 | ---- | C] (Zenographics) -- C:\Programme\vsetup.dll
[2003.05.27 13:37:24 | 000,090,112 | ---- | C] (Zenographics) -- C:\Programme\apptune.exe
[2003.05.27 13:37:24 | 000,086,016 | ---- | C] (Zenographics, Inc.) -- C:\Programme\ZSPOOL.DLL
[2003.05.27 13:37:24 | 000,077,824 | ---- | C] (Zenographics) -- C:\Programme\zlmhp1.dll
[2003.05.27 13:37:24 | 000,073,728 | ---- | C] (Zenographics) -- C:\Programme\ZSHP1000.dll
[2003.05.27 13:37:24 | 000,071,168 | ---- | C] (Zenographics, Inc.) -- C:\Programme\Sd32.dll
[2003.05.27 13:37:24 | 000,065,536 | ---- | C] (Zenographics, Inc.) -- C:\Programme\SDDM32.DLL
[2003.05.27 13:37:24 | 000,054,784 | ---- | C] (Zenographics, Inc.) -- C:\Programme\zPJL.dll
[2003.05.27 13:37:24 | 000,049,152 | ---- | C] (Zenographics, Inc.) -- C:\Programme\IMFPRINT.DLL
[2003.05.27 13:37:24 | 000,047,136 | ---- | C] (Zenographics, Inc.) -- C:\Programme\SD4.DLL
[2003.05.27 13:37:24 | 000,045,056 | ---- | C] (Zenographics, Inc.) -- C:\Programme\zpp.dll
[2003.05.27 13:37:24 | 000,036,864 | ---- | C] (Zenographics, Inc.) -- C:\Programme\zpppcl.dll
[2003.05.27 13:37:24 | 000,036,864 | ---- | C] (Zenographics) -- C:\Programme\zstatus.exe
[2003.05.27 13:37:24 | 000,036,864 | ---- | C] (Zenographics) -- C:\Programme\fwdl.exe
[2003.05.27 13:37:24 | 000,032,256 | ---- | C] (Zenographics, Inc.) -- C:\Programme\imfnt5.dll
[2003.05.27 13:37:24 | 000,029,184 | ---- | C] (Zenographics, Inc.) -- C:\Programme\ZSPOOL32.EXE
[2003.05.27 13:37:24 | 000,028,672 | ---- | C] (Zenographics, Inc.) -- C:\Programme\zlm.dll
[2003.05.27 13:37:24 | 000,028,672 | ---- | C] (Zenographics, Inc.) -- C:\Programme\SDNT5UI.dll
[2003.05.27 13:37:24 | 000,026,624 | ---- | C] (Zenographics, Inc.) -- C:\Programme\QDPRINT.DLL
[2003.05.27 13:37:24 | 000,023,552 | ---- | C] (Zenographics, Inc.) -- C:\Programme\ZGDI32.DLL
[2003.05.27 13:37:24 | 000,022,608 | ---- | C] (Microsoft Corporation) -- C:\Programme\USBPRINT.SYS
[2003.05.27 13:37:24 | 000,019,456 | ---- | C] (Zenographics, Inc.) -- C:\Programme\ZTAG32.DLL
[2003.05.27 13:37:24 | 000,018,944 | ---- | C] (Zenographics, Inc.) -- C:\Programme\SDIMF32.DLL
[2003.05.27 13:37:24 | 000,016,384 | ---- | C] (Zenographics) -- C:\Programme\ZJBIG.dll
[2003.05.27 13:37:24 | 000,012,288 | ---- | C] (Zenographics, Inc.) -- C:\Programme\IMF32.DLL
[2003.05.27 13:37:24 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Programme\USBMON.DLL
[2003.05.27 13:37:24 | 000,009,216 | ---- | C] (Zenographics, Inc.) -- C:\Programme\Zlang.dll
[2003.05.27 13:37:24 | 000,008,704 | ---- | C] (Zenographics, Inc.) -- C:\Programme\ZPRINT32.EXE
[2003.05.27 13:37:24 | 000,005,632 | ---- | C] (Zenographics, Inc.) -- C:\Programme\SDNTUM4.DLL
[2001.12.13 10:09:54 | 000,179,712 | ---- | C] (InstallShield Software Corporation) -- C:\Programme\Setup.exe
[2001.12.13 10:09:54 | 000,036,864 | ---- | C] (Zenographics) -- C:\Programme\autorun.exe
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.27 07:35:31 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Rainer\defogger_reenable
[2013.05.27 07:35:00 | 000,000,228 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2013.05.27 07:01:12 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013.05.27 07:00:45 | 000,000,871 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WTGU.lnk
[2013.05.27 07:00:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013.05.27 07:00:29 | 2073,346,048 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.25 15:25:56 | 000,001,683 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
[2013.05.25 15:23:46 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2013.05.25 15:23:46 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2013.05.25 15:23:46 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2013.05.25 15:23:46 | 000,028,520 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2013.05.25 14:57:11 | 000,000,544 | ---- | M] () -- C:\WINDOWS\System32\.crusader
[2013.05.25 13:29:27 | 000,001,606 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\HitmanPro.lnk
[2013.05.25 06:40:12 | 000,314,768 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013.05.24 14:30:00 | 000,001,912 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
[2013.05.23 20:19:53 | 000,002,607 | ---- | M] () -- C:\Dokumente und Einstellungen\Rainer\Desktop\Microsoft Office Outlook 2003.lnk
[2013.05.22 18:12:44 | 000,000,036 | ---- | M] () -- C:\Dokumente und Einstellungen\Rainer\Lokale Einstellungen\Anwendungsdaten\housecall.guid.cache
[2013.05.21 21:50:59 | 000,463,382 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2013.05.21 21:50:59 | 000,444,848 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013.05.21 21:50:59 | 000,086,226 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2013.05.21 21:50:59 | 000,072,724 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013.05.15 19:08:01 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013.05.07 06:27:17 | 006,015,488 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2013.05.02 17:28:50 | 000,238,872 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.05.27 07:35:31 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\defogger_reenable
[2013.05.25 15:25:56 | 000,001,683 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
[2013.05.25 15:25:45 | 000,000,228 | ---- | C] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2013.05.25 13:12:19 | 000,000,544 | ---- | C] () -- C:\WINDOWS\System32\.crusader
[2013.05.25 13:03:31 | 000,001,606 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\HitmanPro.lnk
[2013.05.22 18:12:44 | 000,000,036 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\Lokale Einstellungen\Anwendungsdaten\housecall.guid.cache
[2012.05.25 07:08:34 | 000,233,525 | ---- | C] () -- C:\WINDOWS\System32\isutil.dll
[2012.05.25 07:08:32 | 000,000,271 | ---- | C] () -- C:\WINDOWS\apptune.ini
[2012.05.24 15:21:09 | 000,038,462 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Microsoft Excel.ADR
[2012.05.22 17:46:51 | 000,001,336 | ---- | C] () -- C:\WINDOWS\_isenv31.ini
[2012.05.22 17:46:51 | 000,000,633 | ---- | C] () -- C:\WINDOWS\_iserr31.ini
[2012.05.22 17:46:51 | 000,000,196 | ---- | C] () -- C:\WINDOWS\_delis32.ini
[2012.05.05 17:41:08 | 000,000,715 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\result.db
[2012.02.24 13:58:20 | 000,159,803 | ---- | C] () -- C:\WINDOWS\closewnd.exe
[2012.02.24 09:00:31 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2012.02.24 09:00:31 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe
[2012.02.24 00:40:50 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.02.23 23:30:38 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2012.02.23 23:10:58 | 000,029,752 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2012.02.23 22:57:15 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2012.02.23 22:57:15 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2012.02.23 22:57:15 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2012.02.23 22:57:15 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2012.02.23 22:57:15 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2012.02.23 22:57:15 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2012.02.23 22:53:03 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\Rainer\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2012.02.23 22:39:33 | 001,810,992 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys
[2012.02.23 22:39:33 | 000,195,120 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll
[2012.02.23 22:39:33 | 000,034,096 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys
[2012.02.23 22:39:33 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini
[2012.02.23 22:39:28 | 000,180,224 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll
[2012.02.23 22:38:59 | 000,000,571 | ---- | C] () -- C:\WINDOWS\HBCIKRNL.INI
[2012.02.23 22:35:57 | 000,147,456 | R--- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4953.dll
[2012.02.23 22:35:56 | 001,991,464 | R--- | C] () -- C:\WINDOWS\System32\igkrng500.bin
[2012.02.23 22:35:56 | 000,432,400 | R--- | C] () -- C:\WINDOWS\System32\igcompkrng500.bin
[2012.02.23 22:22:10 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2012.02.23 22:16:12 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2012.02.23 22:11:41 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2012.02.23 22:10:40 | 000,314,768 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2003.05.27 13:37:24 | 001,958,470 | ---- | C] () -- C:\Programme\guide.pdf
[2003.05.27 13:37:24 | 000,114,233 | ---- | C] () -- C:\Programme\sihp1000.img
[2003.05.27 13:37:24 | 000,088,504 | ---- | C] () -- C:\Programme\dour65w.ttf
[2003.05.27 13:37:24 | 000,088,408 | ---- | C] () -- C:\Programme\dour45w.ttf
[2003.05.27 13:37:24 | 000,080,712 | ---- | C] () -- C:\Programme\dour66w.ttf
[2003.05.27 13:37:24 | 000,080,676 | ---- | C] () -- C:\Programme\dour46w.ttf
[2003.05.27 13:37:24 | 000,047,526 | ---- | C] () -- C:\Programme\readme.wri
[2003.05.27 13:37:24 | 000,032,351 | ---- | C] () -- C:\Programme\hp1KW9x.cat
[2003.05.27 13:37:24 | 000,020,489 | ---- | C] () -- C:\Programme\hp1KW2K.cat
[2003.05.27 13:37:24 | 000,008,911 | ---- | C] () -- C:\Programme\zUsb.cat
[2003.05.27 13:37:24 | 000,003,608 | ---- | C] () -- C:\Programme\HPLJ1000.INF
[2003.05.27 13:37:24 | 000,003,021 | ---- | C] () -- C:\Programme\SDhp1000.sdd
[2003.05.27 13:37:24 | 000,001,598 | ---- | C] () -- C:\Programme\sd4.ini
[2003.05.27 13:37:24 | 000,001,145 | ---- | C] () -- C:\Programme\SDhp1000.UNZ
[2003.05.27 13:37:24 | 000,000,949 | ---- | C] () -- C:\Programme\zUsb.inf
[2003.05.27 13:37:24 | 000,000,271 | ---- | C] () -- C:\Programme\apptune.ini
[2001.12.13 10:09:54 | 003,789,889 | ---- | C] () -- C:\Programme\data1.cab
[2001.12.13 10:09:54 | 000,921,654 | ---- | C] () -- C:\Programme\Setup.bmp
[2001.12.13 10:09:54 | 000,340,866 | ---- | C] () -- C:\Programme\ikernel.ex_
[2001.12.13 10:09:54 | 000,336,297 | ---- | C] () -- C:\Programme\data1.hdr
[2001.12.13 10:09:54 | 000,197,287 | ---- | C] () -- C:\Programme\Setup.inx
[2001.12.13 10:09:54 | 000,032,768 | ---- | C] () -- C:\Programme\spldr.exe
[2001.12.13 10:09:54 | 000,001,507 | ---- | C] () -- C:\Programme\layout.bin
[2001.12.13 10:09:54 | 000,000,512 | ---- | C] () -- C:\Programme\data2.cab
[2001.12.13 10:09:54 | 000,000,430 | ---- | C] () -- C:\Programme\Setup.ini
[2001.12.13 10:09:54 | 000,000,045 | ---- | C] () -- C:\Programme\autorun.inf
[2001.11.15 09:17:14 | 000,000,054 | ---- | C] () -- C:\Programme\HPLJ1000.DOI
 
========== ZeroAccess Check ==========
 
[2012.02.23 22:52:15 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008.04.14 08:52:26 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 08:52:34 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2013.05.25 13:12:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HitmanPro
[2013.05.21 20:28:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nutzwerk
[2012.05.31 13:10:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Research In Motion
[2012.02.23 23:18:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Uninstall
[2013.05.22 21:39:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Bytemobile
[2013.05.25 15:26:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\AskToolbar
[2013.05.27 07:38:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\CallingID
[2012.02.24 09:00:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\FreePDF
[2012.02.24 02:10:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\GHISLER
[2012.02.24 11:45:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\HCM Updater
[2012.07.23 07:16:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\hellomoto
[2012.05.31 13:12:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Research In Motion
[2013.05.22 17:52:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Systweak
[2013.05.21 21:45:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\Ymobv
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 60 bytes -> C:\Dokumente und Einstellungen\Rainer\Eigene Dateien\Rechnungsbuch:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Dokumente und Einstellungen\Rainer\Eigene Dateien\***:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Dokumente und Einstellungen\Rainer\Eigene Dateien\PRIVAT:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Dokumente und Einstellungen\Rainer\Eigene Dateien\Preisilste 2001:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Dokumente und Einstellungen\Rainer\Eigene Dateien\Musik:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Dokumente und Einstellungen\Rainer\Eigene Dateien\***:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Dokumente und Einstellungen\Rainer\Eigene Dateien\***:AFP_AfpInfo
 
< End of report >
         

OTL Extras logfile created on: 27.05.2013 07:35:52 - Run 6
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Download
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,93 Gb Total Physical Memory | 1,29 Gb Available Physical Memory | 66,96% Memory free
3,78 Gb Paging File | 3,20 Gb Available in Paging File | 84,72% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 232,88 Gb Total Space | 179,61 Gb Free Space | 77,13% Space Free | Partition Type: NTFS
Drive E: | 996,00 Mb Total Space | 413,41 Mb Free Space | 41,51% Space Free | Partition Type: FAT32
 
Computer Name: RAINERS-HP | User Name: Rainer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"4481:TCP" = 4481:TCP:LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync data transfer
"4481:UDP" = 4481:UDP:LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync discovery
"4482:TCP" = 4482:TCP:LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync data transfer
"4482:UDP" = 4482:UDP:LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync discovery
"13387:UDP" = 13387:UDP:*:Enabled:UDP 13387
"21460:TCP" = 21460:TCP:*:Enabled:TCP 21460
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Programme\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe" = C:\Programme\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe:*:Enabled:BlackBerry Desktop Software
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{154E4F71-DFC0-4B31-8D99-F97615031B02}" = HP Webcam Application
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{30A2A953-DEB1-466A-B660-F4399C7C6B9D}" = Roxio MyDVD
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 D3
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = HP Webcam
"{3D69628B-4DE8-43C7-9A22-F90F5B870C08}" = ArcSoft TotalMedia Backup
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack
"{537BF16E-7412-448C-95D8-846E85A1D817}" = Roxio Creator Business
"{55B52830-024A-443E-AF61-61E1E71AFA1B}" = Device Access Manager for HP ProtectTools
"{5D97A4A7-C274-4B63-86D9-07A33435F505}" = InterVideo DVD Check
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{69333A04-5134-40A5-A055-9166A7AA1EC8}" = 
"{6EECB283-E65F-40EF-86D3-D51BF02A8D43}" = Microsoft Office Converter Pack
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{7FD8231E-3991-48D7-A2C8-2C42A7075FB1}" = HP User Guide Bluetooth Addendum 0062
"{8595812B-9104-4196-B629-FD298D819399}" = HP User Guides 0097
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{92ADF852-F4BE-4839-9BBF-BADDBA070A3B}" = HP 3D DriveGuard
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{975C8028-51D8-44A9-9585-82E9810FE96A}" = hp LaserJet 1000
"{983980FC-66FB-4ECC-A5D8-4565BE217733}" = SCR3xxx Smart Card Reader
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9ADABDDE-9644-461B-9E73-83FA3EFCAB50}" = HP Wireless Assistant
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.1 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AEB9948B-4FF2-47C9-990E-47014492A0FE}" = MSXML 6.0 Parser
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C8FD5BC1-92EF-4C15-92A9-F9AC7F61985F}" = HP Update
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DA94A899-F439-44D1-90B6-DB02A7341170}" = BlackBerry Desktop Software 7.0
"{E3723A04-A894-4036-A78E-282E18F43C0A}_is1" = Tinypic 3.18
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{EC877639-07AB-495C-BFD1-D63AF9140810}" = Roxio Activation Module
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator Business v10
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{FC57FC53-104C-415C-98D7-B05E659461A9}" = Broadcom NetXtreme Ethernet Controller
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira Free Antivirus
"BlackBerry_Desktop" = BlackBerry Desktop Software 7.0
"FreePDF_XP" = FreePDF (Remove only)
"GPL Ghostscript 9.04" = GPL Ghostscript
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HitmanPro37" = HitmanPro 3.7
"ie8" = Windows Internet Explorer 8
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamViewer 7 Host" = TeamViewer 7 Host
"Totalcmd" = Total Commander (Remove or Repair)
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"web'n'walk Manager" = web'n'walk Manager
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1085031214-1177238915-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Avira SearchFree Toolbar plus Web Protection Updater
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 20.05.2013 05:24:38 | Computer Name = RAINERS-HP | Source = MsiInstaller | ID = 11706
Description = Produkt: BlackBerry Desktop Software 7.0 -- Fehler 1706. Für das Produkt
BlackBerry Desktop Software 7.0 wurde kein Installationspaket gefunden. Wiederholen
Sie die Installation und verwenden Sie dabei eine gültige Kopie des Installationspakets
"BlackBerry Desktop Software.msi".
 
Error - 21.05.2013 15:03:51 | Computer Name = RAINERS-HP | Source = MPSampleSubmission | ID = 5000
Description = 
 
Error - 24.05.2013 06:16:22 | Computer Name = RAINERS-HP | Source = Microsoft Smartcard CSP | ID = 0
Description = 
 
Error - 25.05.2013 07:30:38 | Computer Name = RAINERS-HP | Source = Microsoft Management Console | ID = 1000
Description = 
 
Error - 25.05.2013 07:48:26 | Computer Name = RAINERS-HP | Source = Microsoft Management Console | ID = 1000
Description = 
 
Error - 25.05.2013 07:48:49 | Computer Name = RAINERS-HP | Source = Microsoft Management Console | ID = 1000
Description = 
 
Error - 25.05.2013 07:52:06 | Computer Name = RAINERS-HP | Source = Microsoft Management Console | ID = 1000
Description = 
 
Error - 25.05.2013 07:53:09 | Computer Name = RAINERS-HP | Source = Microsoft Management Console | ID = 1000
Description = 
 
Error - 25.05.2013 07:55:13 | Computer Name = RAINERS-HP | Source = Microsoft Management Console | ID = 1000
Description = 
 
Error - 25.05.2013 08:39:20 | Computer Name = RAINERS-HP | Source = Microsoft Management Console | ID = 1000
Description = 
 
[ System Events ]
Error - 25.05.2013 07:50:39 | Computer Name = RAINERS-HP | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Avira
Echtzeit-Scanner.
 
Error - 25.05.2013 07:50:39 | Computer Name = RAINERS-HP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Avira Echtzeit-Scanner" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053
 
Error - 25.05.2013 07:56:44 | Computer Name = RAINERS-HP | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Avira
Echtzeit-Scanner.
 
Error - 25.05.2013 07:56:44 | Computer Name = RAINERS-HP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Avira Echtzeit-Scanner" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053
 
Error - 25.05.2013 08:42:49 | Computer Name = RAINERS-HP | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Avira
Echtzeit-Scanner.
 
Error - 25.05.2013 08:42:49 | Computer Name = RAINERS-HP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Avira Echtzeit-Scanner" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053
 
Error - 25.05.2013 08:52:42 | Computer Name = RAINERS-HP | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Avira
Echtzeit-Scanner.
 
Error - 25.05.2013 08:52:42 | Computer Name = RAINERS-HP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Avira Echtzeit-Scanner" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053
 
Error - 25.05.2013 08:52:47 | Computer Name = RAINERS-HP | Source = Service Control Manager | ID = 7024
Description = Der Dienst "HitmanPro 3.7 Crusader (Boot)" wurde mit folgendem dienstspezifischem
Fehler beendet: 0 (0x0).
 
Error - 25.05.2013 09:02:00 | Computer Name = RAINERS-HP | Source = Service Control Manager | ID = 7024
Description = Der Dienst "HitmanPro 3.7 Crusader (Boot)" wurde mit folgendem dienstspezifischem
Fehler beendet: 0 (0x0).
 
 
< End of report >
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-05-27 11:24:22
Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.LV01 232,89GB
Running: gmer_2.1.19163.exe; Driver: C:\DOKUME~1\Rainer\LOKALE~1\Temp\kxldikod.sys
 
 
---- System - GMER 2.1 ----
 
SSDT A2DB0504 ZwClose
SSDT A2DB04BE ZwCreateKey
SSDT A2DB050E ZwCreateSection
SSDT A2DB04B4 ZwCreateThread
SSDT A2DB04C3 ZwDeleteKey
SSDT A2DB04CD ZwDeleteValueKey
SSDT A2DB04FF ZwDuplicateObject
SSDT A2DB04D2 ZwLoadKey
SSDT A2DB04A0 ZwOpenProcess
SSDT A2DB04A5 ZwOpenThread
SSDT A2DB0527 ZwQueryValueKey
SSDT A2DB04DC ZwReplaceKey
SSDT A2DB0518 ZwRequestWaitReplyPort
SSDT A2DB04D7 ZwRestoreKey
SSDT A2DB0513 ZwSetContextThread
SSDT A2DB051D ZwSetSecurityObject
SSDT A2DB04C8 ZwSetValueKey
SSDT A2DB0522 ZwSystemDebugControl
SSDT A2DB04AF ZwTerminateProcess
 
---- User code sections - GMER 2.1 ----
 
.text C:\Programme\Internet Explorer\iexplore.exe[2144] USER32.dll!DialogBoxParamW 7E3747AB 5 Bytes JMP 41195545 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2144] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 41269B89 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2144] USER32.dll!CallNextHookEx 7E37B3C6 5 Bytes JMP 4125D1C5 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2144] USER32.dll!CreateWindowExW 7E37D0A3 5 Bytes JMP 4126DC14 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2144] USER32.dll!UnhookWindowsHookEx 7E37D5F3 5 Bytes JMP 411D46A6 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2144] USER32.dll!DialogBoxIndirectParamW 7E382072 5 Bytes JMP 4136799F C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2144] USER32.dll!MessageBoxIndirectA 7E38A082 5 Bytes JMP 413678D1 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2144] USER32.dll!DialogBoxParamA 7E38B144 5 Bytes JMP 4136793C C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2144] USER32.dll!MessageBoxExW 7E3A0838 5 Bytes JMP 413677A2 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2144] USER32.dll!MessageBoxExA 7E3A085C 5 Bytes JMP 41367804 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2144] USER32.dll!DialogBoxIndirectParamA 7E3A6D7D 5 Bytes JMP 41367A02 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2144] USER32.dll!MessageBoxIndirectW 7E3B64D5 5 Bytes JMP 41367866 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2144] ole32.dll!CoCreateInstance 774CF1BC 5 Bytes JMP 4126DC70 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2144] ole32.dll!OleLoadFromStream 774F983B 5 Bytes JMP 41367D07 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2736] USER32.dll!DialogBoxParamW 7E3747AB 5 Bytes JMP 41195545 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2736] USER32.dll!CreateWindowExW 7E37D0A3 5 Bytes JMP 4126DC14 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2736] USER32.dll!DialogBoxIndirectParamW 7E382072 5 Bytes JMP 4136799F C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2736] USER32.dll!MessageBoxIndirectA 7E38A082 5 Bytes JMP 413678D1 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2736] USER32.dll!DialogBoxParamA 7E38B144 5 Bytes JMP 4136793C C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2736] USER32.dll!MessageBoxExW 7E3A0838 5 Bytes JMP 413677A2 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2736] USER32.dll!MessageBoxExA 7E3A085C 5 Bytes JMP 41367804 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2736] USER32.dll!DialogBoxIndirectParamA 7E3A6D7D 5 Bytes JMP 41367A02 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Programme\Internet Explorer\iexplore.exe[2736] USER32.dll!MessageBoxIndirectW 7E3B64D5 5 Bytes JMP 41367866 C:\WINDOWS\system32\IEFRAME.dll
 
---- Devices - GMER 2.1 ----
 
Device Ntfs.sys
Device Fastfat.SYS
 
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 Wdf01000.sys
AttachedDevice \Driver\Tcpip \Device\Tcp tcpipBM.SYS
 
Device mrxsmb.sys
 
AttachedDevice fltmgr.sys
 
---- EOF - GMER 2.1 ----