MS DOS Aplikation / Trojaner durch Zip Datei eingefangen

acur · 02.07.2013, 11:58

Hallo Zusammen,

wir haben letzten Donnerstag heute in unseren Mail Account eine E-Mail,
Text: Sehr geehrte/r mein Name,

unser Anwalt-Büro wurden von Foto Shop Aachen GmbH beauftragt die finanziellen Interessen zu vertreten. Die Bevollmächtigung wurde notariell schriftlich zugesichert.

13,00 Euro (nach Nummer 2898 RGV)
22,00 Euro (Pauschalvergütung gemäß RVG § 5 Abs. 1 und 2)

Mit dem abgeschlossenem Vertrag vom 09.05.2013 haben Sie sich rechtlich verpflichtet die Summe in Höhe von 120,00 Euro an unseren Mandanten zu zahlen.
... blah balh blah...

erhalten und leider den Anhang (Zip Datei) geöffnet, klar ist das blöd, aber die Rahmendaten stimmten so verblüffend, Absender war vermeintlich bekannt...
dadurch installierte sich ein eine MS Dos Applikation .
Den Rechner (System ist XP professionell) sofort mit dem installieren und immer upgedateten Virenscanner gescannt und nichts gefunden, dachten das ist erledigt.
Rechner runter gefahren und heute Früh ließ er sich nicht mehr richtig starten, d.h. er fährt hoch, bis zum "Willkommen bei Windows" Fenster, dann Anmelden, geht auch noch, danach kommt "lade Daten" und er meldet uns wieder ab, unmittelbar danach kommt "speichere Daten" und wir landen wieder beim Eingabefenster.

Das ganze im abgesicherten Modus ( Auswahl F8) gemacht und auf den Rechner zugreifen können.
So mit Trojaner ReCover einen Scann laufen lassen , auch was gefunden und beseitigt, danach das ganze Spiel von neuem , der Fehler ist immer noch da , nur leider funktioniert es auch im abgesicherten Modus nicht mehr, kein Zugriff auf den Rechner möglich .

ich weiß jetzt so recht nicht mehr weiter, was ist zu tun?
Danke Uwe

schrauber · 02.07.2013, 12:12

Hi,

Falls Du kein Brennprogramm installiert hast, lade
dir bitte ISOBurner herunter.
Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen.
Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.

Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop.
Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
Lege eine leere CD in Deinen Brenner.
ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
Du kannst nun die Fenster des Brennprogramms schließen.

Nun boote von mit der OTLPE CD.
Hinweis: Wie boote ich von CD

Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
Mache einen Doppelklick auf das OTLPE Icon.
Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
OTLpe sollte nun starten.
Drücke Run Scan, um den Scan zu starten.
Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
Bitte poste den Inhalt von C:\OTL.Txt und Extras.Txt.

acur · 02.07.2013, 12:54

Hallo
danke für die Anleitung, leider hat das andere System mit dem ich hier schreibe keinen Brenner, bringe einen externen Brenner morgen mit und dann geht es weiter.
gruss Uwe

schrauber · 02.07.2013, 13:41

Ok

acur · 03.07.2013, 10:18

Hallo
hat was gedauert.... hier die OLT.txt, eien "extra.txt" wurde nicht generiert ?!

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 7/3/2013 1:04:42 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149.04 Gb Total Space | 106.12 Gb Free Space | 71.21% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002
 
========== Win32 Services (SafeList) ==========
 
SRV - [2013/06/12 07:05:28 | 000,181,664 | ---- | M] (Oracle Corporation) [Auto] -- C:\Programme\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2013/05/27 04:31:59 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/01/04 09:20:46 | 000,594,904 | ---- | M] () [Auto] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IBUpdaterService\ibsvc.exe -- (IBUpdaterService)
SRV - [2010/01/25 03:22:56 | 000,245,760 | ---- | M] (Brother Industries, Ltd.) [On_Demand] -- C:\Programme\Browny02\BrYNSvc.exe -- (BrYNSvc)
SRV - [2009/06/02 04:10:08 | 000,637,952 | ---- | M] (Nokia.) [On_Demand] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008/05/01 21:42:06 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2007/07/24 05:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2006/12/18 11:45:48 | 000,266,240 | ---- | M] (T-Systems) [On_Demand] -- C:\Programme\T-DSL Manager\DslMgrSvc.exe -- (TDslMgrService)
SRV - [2006/12/12 12:53:54 | 000,212,992 | ---- | M] (T-Systems Enterprise Services GmbH) [On_Demand] -- C:\Programme\Gemeinsame Dateien\T-COM\HotspotMgr\HotSpotFSvc.exe -- (HotSpotFSvc)
SRV - [2006/08/11 09:51:04 | 000,028,672 | ---- | M] (Novell, Inc.) [On_Demand] -- C:\WINDOWS\system32\cusrvc.exe -- (cusrvc)
SRV - [2006/07/28 10:07:08 | 000,119,952 | ---- | M] (symantec) [On_Demand] -- C:\Programme\Symantec AntiVirus\SavRoam.exe -- (SavRoam)
SRV - [2006/07/28 10:06:18 | 001,829,008 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Symantec AntiVirus\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2006/07/28 10:04:22 | 000,031,888 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Symantec AntiVirus\DefWatch.exe -- (DefWatch)
SRV - [2006/04/11 11:13:38 | 001,160,848 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe -- (SPBBCSvc)
SRV - [2006/03/24 11:14:58 | 000,169,632 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe -- (ccSetMgr)
SRV - [2006/03/24 11:14:52 | 000,192,160 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe -- (ccEvtMgr)
SRV - [2006/03/20 09:35:10 | 002,045,632 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_0.EXE -- (LiveUpdate)
SRV - [2006/01/24 14:06:58 | 000,214,720 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe -- (SNDSrvc)
SRV - [2005/04/03 18:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/07/14 10:00:44 | 000,147,456 | ---- | M] (T-Systems Nova, Berkom) [On_Demand] -- C:\Programme\T-DSL SpeedManager\tsmsvc.exe -- (TSMService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - File not found [Kernel | On_Demand] --  -- (BOVOLUME)
DRV - File not found [Kernel | On_Demand] --  -- (BOProtocol)
DRV - [2013/06/17 04:00:00 | 001,611,992 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20130626.002\NAVEX15.SYS -- (NAVEX15)
DRV - [2013/06/17 04:00:00 | 000,093,272 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20130626.002\NAVENG.SYS -- (NAVENG)
DRV - [2012/07/31 20:34:46 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/07/31 20:34:45 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2011/06/02 01:47:22 | 000,136,808 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadmdm.sys -- (ssadmdm)
DRV - [2011/06/02 01:47:22 | 000,121,064 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadbus.sys -- (ssadbus) SAMSUNG Android USB Composite Device driver (WDM)
DRV - [2011/06/02 01:47:22 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadmdfl.sys -- (ssadmdfl) SAMSUNG Android USB Modem (Filter)
DRV - [2009/02/09 02:37:56 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2009/02/09 02:37:48 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2009/02/09 02:37:46 | 000,022,016 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2009/02/09 02:37:46 | 000,017,664 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008/08/26 04:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/02/28 22:13:24 | 000,036,880 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2008/02/28 22:13:16 | 000,035,344 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2008/02/28 22:12:48 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2007/07/16 17:29:43 | 000,020,504 | R--- | M] (Hewlett Packard) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\hpfxfax.sys -- (HPFXFAX)
DRV - [2007/07/16 17:29:33 | 000,017,432 | R--- | M] (Hewlett Packard) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\hpfxbulk.sys -- (HPFXBULK)
DRV - [2007/05/30 06:54:10 | 004,356,608 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/05/30 06:49:42 | 000,105,088 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\WINDOWS\System32\drivers\nvatabus.sys -- (nvatabus)
DRV - [2007/05/30 06:49:37 | 000,105,088 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\nvata.sys -- (nvata)
DRV - [2007/05/30 06:47:14 | 000,057,856 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2007/05/30 06:47:14 | 000,020,480 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2006/12/01 11:04:10 | 000,013,184 | ---- | M] (T-Systems) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tsmpkt.sys -- (TSMPacket)
DRV - [2006/11/09 04:38:22 | 000,506,159 | ---- | M] (Novell, Inc.) [File_System | Auto] -- C:\WINDOWS\system32\NetWare\nwfs.sys -- (NetwareWorkstation)
DRV - [2006/10/28 04:39:04 | 000,217,164 | ---- | M] (Novell, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\vptunnel.sys -- (BM)
DRV - [2006/09/25 06:44:52 | 000,043,280 | ---- | M] (Novell, Inc.) [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwdns.sys -- (NWDNS)
DRV - [2006/09/25 03:54:54 | 000,160,209 | ---- | M] (Novell, Inc.) [File_System | Auto] -- C:\WINDOWS\system32\NetWare\srvloc.sys -- (SRVLOC)
DRV - [2006/06/29 18:53:44 | 000,003,712 | ---- | M] (Logitech, Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2006/05/10 03:56:54 | 000,027,264 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LHidKE.Sys -- (LHidKe)
DRV - [2006/05/10 03:56:50 | 000,071,680 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2006/05/10 03:56:18 | 000,056,064 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\L8042MOU.SYS -- (L8042mou)
DRV - [2006/05/05 10:19:50 | 000,107,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Symantec\SYMEVENT.SYS -- (SymEvent)
DRV - [2006/04/11 11:13:34 | 000,389,776 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2006/03/03 11:50:48 | 000,038,416 | ---- | M] (Novell, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\nicm.sys -- (NICM)
DRV - [2006/01/25 09:27:42 | 000,162,688 | ---- | M] (T-Systems Nova GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\WTDDI.sys -- (TDDIWAN) Deutsche Telekom Dynamic ISDN (WDM)
DRV - [2006/01/24 14:06:36 | 000,195,776 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - [2006/01/24 14:06:32 | 000,024,768 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV - [2005/12/19 14:41:58 | 000,054,968 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Symantec AntiVirus\Savrtpel.sys -- (SAVRTPEL)
DRV - [2005/12/19 14:41:56 | 000,337,592 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Symantec AntiVirus\savrt.sys -- (SAVRT)
DRV - [2005/11/22 04:51:22 | 000,018,353 | ---- | M] (Novell, Inc.) [File_System | Auto] -- C:\WINDOWS\system32\NetWare\nwdhcp.sys -- (NWDHCP)
DRV - [2005/10/27 10:15:14 | 000,039,731 | ---- | M] (Novell, Inc.) [File_System | Auto] -- C:\WINDOWS\system32\NetWare\nwsipx32.sys -- (NWSIPX32)
DRV - [2005/10/12 07:12:18 | 000,009,297 | ---- | M] (Novell, Inc.) [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwhost.sys -- (NWHOST)
DRV - [2005/10/12 07:11:32 | 000,006,128 | ---- | M] (Novell, Inc.) [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwsns.sys -- (NWSNS)
DRV - [2005/07/07 04:14:30 | 001,389,056 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\P17.sys -- (P17)
DRV - [2005/05/26 12:14:00 | 000,015,891 | ---- | M] (Novell, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\NetWare\nwfilter.sys -- (NWFILTER)
DRV - [2005/01/10 06:15:30 | 000,106,496 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv)
DRV - [2005/01/10 06:15:24 | 000,138,752 | R--- | M] (Creative Technology Ltd) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV - [2005/01/03 08:51:38 | 000,020,332 | ---- | M] (Novell, Inc.) [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwslp.sys -- (NWSLP)
DRV - [2004/06/21 08:52:58 | 000,039,152 | ---- | M] (T-Systems Nova GmbH, Berkom Berlin) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\BOPPPoE.sys -- (BOAdapter)
DRV - [2004/06/01 12:19:34 | 000,027,249 | ---- | M] (Novell, Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\NetWare\resmgr.sys -- (RESMGR)
DRV - [2004/03/11 11:44:26 | 000,009,696 | ---- | M] (T-Systems Nova GmbH) [Kernel | On_Demand] -- C:\Programme\T-DSL SpeedManager\TNPACKET.SYS -- (TNPacket)
DRV - [2003/08/22 04:44:56 | 000,456,080 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\System32\drivers\niciccs.sys -- (NICICCS)
DRV - [2003/02/26 08:51:18 | 000,023,232 | ---- | M] () [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwsap.sys -- (NWSAP)
DRV - [2000/10/15 12:38:54 | 000,016,068 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\Programme\T-DSL SpeedManager\PCANDIS5.SYS -- (PCANDIS5)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Aixtron_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\Aixtron_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\Aixtron_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.0.0.245:8080
 
IE - HKU\HorstAdmin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\HorstAdmin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\HorstAdmin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.0.0.245:8080
 
 
 
 
 
IE - HKU\ur_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\ur_ON_C\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\ur_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\ur_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\ur_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.0.0.245:8080
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://de.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official"
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.11.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2:  File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@ptc.com/ProductViewLite: C:\Programme\Gemeinsame Dateien\PTC\np6_pvapplite9.dll (PTC)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.660: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.660: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.660: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2007/10/23 06:14:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Programme\Nokia\Nokia PC Suite 7\bkmrksync\ [2009/07/23 08:01:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/07/21 02:07:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2013/05/27 04:32:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2013/05/27 04:31:51 | 000,000,000 | ---D | M]
 
[2007/06/13 04:18:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Aixtron\Anwendungsdaten\mozilla\Firefox\Profiles\is8k0htv.default\extensions
[2013/05/27 04:32:01 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013/05/27 04:31:49 | 000,000,000 | ---D | M] (Google Settings) -- C:\Programme\Mozilla Firefox\extensions\google-cjk@partners.mozilla.com
[2013/05/27 04:32:01 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions
[2013/05/27 04:32:01 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- C:\PROGRAMME\MOZILLA FIREFOX\EXTENSIONS\{3112CA9C-DE6D-4884-A869-9855DE68056C}
[2012/04/23 04:32:10 | 000,002,313 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
 
O1 HOSTS File: ([2007/06/13 06:35:36 | 000,001,346 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 10.0.0.245           nw-kommunikation.horst.de  
O1 - Hosts: 10.0.0.246           Fax-Server.horst.de
O1 - Hosts: 10.0.0.251           NW-SERVER.horst.de
O1 - Hosts: 10.0.0.245           nw-kommunikation
O1 - Hosts: 10.0.0.246           Fax-Server
O1 - Hosts: 10.0.0.251           NW-SERVER
O1 - Hosts: 10.0.0.244           Virual01
O1 - Hosts: 10.0.0.247           XP-Sich
O1 - Hosts: 10.0.0.248           PDC_Backup
O1 - Hosts: 10.0.0.249           PDC
O1 - Hosts: 10.0.0.250           PADB01
O1 - Hosts: 10.0.0.251           mail2.Horst.de
O1 - Hosts: 10.0.0.252           PADBSRV
O1 - Hosts: 10.0.0.253           HOR-LOR-000
O1 - Hosts: 10.0.0.254           PAOPT01     
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (WebCGMHlprObj Class) - {56B38F40-4E70-11d4-A076-0080AD86BA2F} - C:\WINDOWS\system32\cgmopenbho.dll (CGM Open Consortium, Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -  File not found
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKLM\..\Toolbar: (Babylon) - {965B54B0-71E0-4611-8DE7-F73FA0B20E26} - C:\Programme\Babylon\Babylon Toolbar\BabylonIEToolBar.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKU\ur_ON_C\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKU\ur_ON_C\..\Toolbar\WebBrowser: (Babylon) - {965B54B0-71E0-4611-8DE7-F73FA0B20E26} - C:\Programme\Babylon\Babylon Toolbar\BabylonIEToolBar.dll (Babylon Ltd.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [BrStsMon00] C:\Programme\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [KiesHelper] C:\Programme\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [NDPS] C:\WINDOWS\system32\dpmw32.exe (Novell, Inc.)
O4 - HKLM..\Run: [NovellVpn] C:\WINDOWS\System32\vpnstats.exe ()
O4 - HKLM..\Run: [NWTRAY] C:\WINDOWS\System32\nwtray.exe (Novell, Inc.)
O4 - HKLM..\Run: [P17Helper] C:\WINDOWS\System32\P17.dll ()
O4 - HKLM..\Run: [QuickFinder Scheduler] C:\Programme\Corel\WordPerfect Office X5\Programs\QFSCHD150.EXE (Corel Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Oracle Corporation)
O4 - HKLM..\Run: [T-DSL SpeedMgr] C:\Programme\T-DSL SpeedManager\SpeedMgr.exe (T-Systems Nova, Berkom)
O4 - HKLM..\Run: [T-DSL-Manager-Setup]  File not found
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [ToolBoxFX] C:\Programme\HP\ToolBoxFX\bin\HPTLBXFX.exe (HP)
O4 - HKLM..\Run: [TrojanScanner] C:\Programme\Trojan Remover\Trjscan.exe (Simply Super Software)
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [vptray] C:\Programme\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
O4 - HKU\ur_ON_C..\Run: [CreativeTaskScheduler] C:\Programme\Creative\Shared Files\CTSched.exe (Creative Technology Ltd)
O4 - HKU\ur_ON_C..\Run: [KiesPDLR] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKU\ur_ON_C..\Run: [PC Suite Tray] C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - HKU\ur_ON_C..\Run: [xnemvwez] C:\Dokumente und Einstellungen\ur\Ydupdne\jlgkvwez.exe (Simon Tatham)
O4 - HKLM..\RunOnce: [RestoreDNSSLPConfig] C:\WINDOWS\system32\SlpDnsRestore.exe ()
O4 - HKLM..\RunOnce: [Trojan Remover] C:\Programme\Trojan Remover\RMVTRJAN.EXE (Simply Super Software)
O4 - HKU\.DEFAULT..\RunOnce: [RealUpgradeHelper]  File not found
O4 - HKU\ur_ON_C..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil32_11_6_602_171_Plugin.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Dokumente und Einstellungen\Aixtron\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE (WinZip Computing, Inc. and H.C. Top Systems B.V.)
O4 - Startup: C:\Dokumente und Einstellungen\Default User\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\HorstAdmin\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\ur\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\ur.AIXTRON-2\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\ur.AIXTRON-2.000\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\ur.AIXTRON-2.001\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: CompatibleRUPSecurity = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Aixtron_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\HorstAdmin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\ur.AIXTRON-2.002_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\ur_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\NetWare\nwws2nds.dll (Novell, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\WINDOWS\system32\NetWare\nwws2sap.dll (Novell, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\WINDOWS\system32\NetWare\nwws2slp.dll (Novell, Inc.)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181645365703 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1181645626062 (MUWebControl Class)
O16 - DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://www.navigram.com/engine/v1111/Navigram.cab (Navigram Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (NWGINA.DLL) - C:\WINDOWS\System32\nwgina.dll (Novell, Inc.)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\programme\gemeinsame dateien\logitech\bluetooth\LBTWlgn.dll - C:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O27 - HKLM IFEO\userinit.exe: Debugger - C:\WINDOWS\system32\srvsmem.exe File not found
O30 - LSA: Authentication Packages - (nwv1_0) - C:\WINDOWS\System32\nwv1_0.dll (Novell, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/06/05 16:12:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/07/02 06:13:34 | 000,000,000 | --SD | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Anwendungsdaten\Microsoft
[2013/07/02 06:13:34 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Anwendungsdaten
[2013/07/02 06:13:34 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Cookies
[2013/07/02 06:13:34 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Druckumgebung
[2013/07/02 06:13:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Lokale Einstellungen\Anwendungsdaten\Microsoft
[2013/07/02 06:13:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Anwendungsdaten\Macromedia
[2013/07/02 06:13:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Favoriten
[2013/07/02 06:13:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Eigene Dateien
[2013/07/02 06:13:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Desktop
[2013/07/02 06:13:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Lokale Einstellungen\Anwendungsdaten\Adobe
[2013/07/02 06:13:33 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\SendTo
[2013/07/02 06:13:33 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Startmenü\Programme\Zubehör
[2013/07/02 06:13:33 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Startmenü
[2013/07/02 06:13:33 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Startmenü\Programme\Autostart
[2013/07/02 06:13:33 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Vorlagen
[2013/07/02 06:13:33 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Recent
[2013/07/02 06:13:33 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Netzwerkumgebung
[2013/07/02 06:13:33 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Lokale Einstellungen
[2013/07/02 05:28:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2013/07/02 05:27:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur\Eigene Dateien\Simply Super Software
[2013/07/02 05:27:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\Simply Super Software
[2013/07/02 05:27:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Trojan Remover
[2013/07/02 05:27:22 | 000,605,968 | ---- | C] (Igor Pavlov) -- C:\WINDOWS\System32\ztv7z.dll
[2013/07/02 05:27:22 | 000,077,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ztvcabinet.dll
[2013/07/02 05:27:21 | 000,000,000 | ---D | C] -- C:\Programme\Trojan Remover
[2013/07/02 05:27:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Simply Super Software
[2013/06/27 05:41:50 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\LocalService\IETldCache
[2013/06/27 05:41:41 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\LocalService\IECompatCache
[2013/06/27 05:10:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NortonInstaller
[2013/06/27 04:10:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur\Ydupdne
[2013/06/12 07:05:45 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java
[2010/08/05 08:22:01 | 000,065,536 | R--- | C] ( ) -- C:\WINDOWS\System32\A3d.dll
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\Dokumente und Einstellungen\ur\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\ur\Desktop\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/07/03 04:27:38 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/07/03 04:27:25 | 2146,750,464 | -HS- | M] () -- C:\hiberfil.sys
[2013/07/02 06:27:28 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/07/02 06:27:28 | 000,000,408 | ---- | M] () -- C:\WINDOWS\tasks\RNUpgradeHelperLogonPrompt_UR.job
[2013/07/02 06:27:28 | 000,000,264 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-553522983-733113839-4547331-1180.job
[2013/07/02 06:24:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/07/02 05:27:25 | 000,000,786 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Trojan Remover.lnk
[2013/07/02 05:27:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Trojan Remover
[2013/07/02 05:21:35 | 000,000,011 | ---- | M] () -- C:\WINDOWS\NetWare.INI
[2013/07/02 03:35:25 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/07/01 05:44:19 | 000,000,398 | ---- | M] () -- C:\WINDOWS\tasks\ReclaimerUpdateXML_UR.job
[2013/07/01 04:44:19 | 000,000,402 | ---- | M] () -- C:\WINDOWS\tasks\ReclaimerUpdateFiles_UR.job
[2013/06/28 07:10:00 | 000,001,044 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2013/06/27 09:47:07 | 000,536,368 | ---- | M] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2013/06/27 06:11:25 | 000,000,039 | ---- | M] () -- C:\WINDOWS\hpmnwun.ini
[2013/06/27 05:50:50 | 000,000,272 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-553522983-733113839-4547331-1180.job
[2013/06/27 04:10:32 | 000,038,400 | ---- | M] () -- C:\Dokumente und Einstellungen\ur\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/06/26 10:15:56 | 000,001,878 | -H-- | M] () -- C:\Dokumente und Einstellungen\ur\Eigene Dateien\Default.rdp
[2013/06/26 07:15:58 | 000,002,513 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Microsoft Excel.lnk
[2013/06/26 05:38:34 | 000,207,856 | ---- | M] () -- C:\Dokumente und Einstellungen\ur\Desktop\stex_runline_1_1_beheizung.pdf
[2013/06/24 06:03:13 | 000,434,015 | ---- | M] () -- C:\Dokumente und Einstellungen\ur\Desktop\42806A-02.pdf
[2013/06/20 04:31:21 | 000,001,777 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk
[2013/06/17 02:46:46 | 000,002,477 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Microsoft Word.lnk
[2013/06/12 09:57:33 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/06/07 06:02:21 | 000,071,190 | ---- | M] () -- C:\Dokumente und Einstellungen\ur\Desktop\POOL 1.jpg
[2013/06/05 04:45:12 | 000,108,567 | ---- | M] () -- C:\Dokumente und Einstellungen\ur\Desktop\AG Modul 6 701478 - 701878 HM.pdf
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\Dokumente und Einstellungen\ur\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\ur\Desktop\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/07/03 04:27:25 | 2146,750,464 | -HS- | C] () -- C:\hiberfil.sys
[2013/07/02 06:13:34 | 000,001,599 | ---- | C] () -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Startmenü\Programme\Remoteunterstützung.lnk
[2013/07/02 06:13:34 | 000,001,351 | ---- | C] () -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Startmenü\Programme\Autostart\T-DSL Manager.lnk
[2013/07/02 06:13:34 | 000,000,772 | ---- | C] () -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Startmenü\Programme\Windows Media Player.lnk
[2013/07/02 05:27:25 | 000,000,786 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Trojan Remover.lnk
[2013/07/02 05:27:22 | 000,185,616 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar39.dll
[2013/07/02 05:27:22 | 000,169,744 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar36.dll
[2013/07/02 05:27:22 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\UNRAR3.dll
[2013/07/02 05:27:22 | 000,077,312 | ---- | C] () -- C:\WINDOWS\System32\ztvunace26.dll
[2013/07/02 05:27:22 | 000,075,264 | ---- | C] () -- C:\WINDOWS\System32\unacev2.dll
[2013/06/26 05:41:41 | 000,207,856 | ---- | C] () -- C:\Dokumente und Einstellungen\ur\Desktop\stex_runline_1_1_beheizung.pdf
[2013/06/24 06:05:28 | 000,434,015 | ---- | C] () -- C:\Dokumente und Einstellungen\ur\Desktop\42806A-02.pdf
[2013/06/17 05:46:08 | 000,000,408 | ---- | C] () -- C:\WINDOWS\tasks\RNUpgradeHelperLogonPrompt_UR.job
[2013/06/17 05:46:07 | 000,000,402 | ---- | C] () -- C:\WINDOWS\tasks\ReclaimerUpdateFiles_UR.job
[2013/06/17 05:46:06 | 000,000,398 | ---- | C] () -- C:\WINDOWS\tasks\ReclaimerUpdateXML_UR.job
[2013/06/07 06:02:21 | 000,071,190 | ---- | C] () -- C:\Dokumente und Einstellungen\ur\Desktop\POOL 1.jpg
[2013/06/05 04:49:17 | 000,108,567 | ---- | C] () -- C:\Dokumente und Einstellungen\ur\Desktop\AG Modul 6 701478 - 701878 HM.pdf
[2013/06/05 04:48:59 | 000,506,987 | ---- | C] () -- C:\Dokumente und Einstellungen\ur\Desktop\AG 701878 HM.pdf
[2013/04/14 21:01:09 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2013/04/14 21:01:09 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2013/04/14 21:01:09 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2013/02/07 23:03:08 | 002,816,504 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data
[2013/01/10 11:15:19 | 000,536,368 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012/06/05 09:44:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\mtstack16.INI
[2012/04/23 05:17:55 | 000,002,516 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys
[2012/04/23 05:17:55 | 000,000,088 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\5ACC70BB8E.sys
[2012/04/23 05:11:02 | 000,000,394 | ---- | C] () -- C:\WINDOWS\capture.ini
[2012/02/28 10:39:45 | 000,000,114 | ---- | C] () -- C:\WINDOWS\System32\BRLMW03A.INI
[2012/02/28 10:39:45 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\BRADM10A.DAT
[2012/02/28 10:39:44 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\BRTCPCON.DLL
[2012/02/16 04:52:55 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/09/16 05:54:48 | 000,030,568 | ---- | C] () -- C:\WINDOWS\MusiccityDownload.exe
[2011/09/16 05:54:44 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll
[2011/09/16 05:54:44 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2011/09/16 05:54:44 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2011/09/16 05:54:44 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll
[2010/11/08 06:55:53 | 000,000,218 | ---- | C] () -- C:\Dokumente und Einstellungen\ur\.recently-used.xbel
[2010/08/05 08:22:01 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\P17CPI.dll
[2010/08/05 08:21:59 | 000,064,512 | R--- | C] () -- C:\WINDOWS\System32\P17.dll
[2010/07/28 08:59:47 | 000,000,039 | ---- | C] () -- C:\WINDOWS\hpmnwun.ini
[2010/07/06 07:59:50 | 000,000,608 | -HS- | C] () -- C:\WINDOWS\System32\winzvprt5.sys
[2010/07/06 07:48:36 | 000,170,405 | ---- | C] () -- C:\WINDOWS\hppins08.dat
[2010/07/06 07:48:36 | 000,170,364 | ---- | C] () -- C:\WINDOWS\System32\hppins08.dat
[2010/07/06 07:48:36 | 000,001,116 | ---- | C] () -- C:\WINDOWS\hppmdl08.dat
[2010/07/06 07:48:18 | 000,000,316 | ---- | C] () -- C:\WINDOWS\hpbvspst.ini
[2010/07/06 07:47:31 | 000,000,685 | R--- | C] () -- C:\WINDOWS\System32\hppapr08.dat
[2010/01/19 04:44:28 | 000,000,011 | ---- | C] () -- C:\WINDOWS\NetWare.INI
[2008/02/14 04:34:11 | 000,001,142 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2007/10/04 06:16:37 | 000,038,400 | ---- | C] () -- C:\Dokumente und Einstellungen\ur\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/06/13 03:59:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI
[2007/06/12 07:11:13 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2007/06/12 07:02:02 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\adistres.dll
[2007/06/12 06:51:18 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/06/12 06:35:45 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\GAMSWrap.dll
[2007/06/12 06:35:45 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\NMASReg.exe
[2007/06/12 06:35:45 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\NMASWrap.dll
[2007/06/12 06:35:45 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\unclient.exe
[2007/06/12 06:35:35 | 000,456,080 | ---- | C] () -- C:\WINDOWS\System32\drivers\niciccs.sys
[2007/06/12 06:33:14 | 000,078,448 | ---- | C] () -- C:\WINDOWS\System32\bmnotify.dll
[2007/06/12 06:33:13 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ldapmethod.dll
[2007/06/12 06:33:13 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\vpnrst.exe
[2007/06/12 06:33:12 | 000,561,152 | ---- | C] () -- C:\WINDOWS\System32\vpnlogin.exe
[2007/06/12 06:33:12 | 000,253,952 | ---- | C] () -- C:\WINDOWS\System32\ikeapp.exe
[2007/06/12 06:33:12 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\vpnstats.exe
[2007/06/12 06:33:12 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\vpnext.dll
[2007/06/12 06:33:12 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\regvpn.exe
[2007/06/12 06:33:12 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\SlpDnsRestore.exe
[2007/06/12 06:03:10 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\prtwin32.dll
[2007/06/12 06:03:10 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\nwpsrv32.dll
[2007/06/12 06:03:08 | 000,216,064 | ---- | C] () -- C:\WINDOWS\System32\lgnwnt32.dll
[2007/06/12 06:03:02 | 000,002,757 | ---- | C] () -- C:\WINDOWS\System32\rdrstats.ini
[2007/06/12 06:02:54 | 000,015,898 | ---- | C] () -- C:\WINDOWS\System32\vlmsup.exe
[2007/06/12 06:02:54 | 000,001,724 | ---- | C] () -- C:\WINDOWS\System32\vipx.exe
[2007/06/12 06:02:53 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\setupw2k.dll
[2007/06/12 06:02:52 | 000,245,843 | ---- | C] () -- C:\WINDOWS\System32\nwshlxnt.dll
[2007/06/12 06:02:50 | 000,051,200 | ---- | C] () -- C:\WINDOWS\System32\lgncon32.dll
[2007/06/12 06:02:50 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\dplgnw32.dll
[2007/06/12 06:02:49 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\nwslog32.dll
[2007/06/12 06:02:49 | 000,012,736 | ---- | C] () -- C:\WINDOWS\System32\cmdinfo.exe
[2007/06/05 17:00:49 | 000,004,335 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2007/06/05 16:59:40 | 000,319,400 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2007/06/05 16:14:45 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2007/06/05 16:09:49 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2007/03/12 12:59:00 | 000,299,008 | ---- | C] () -- C:\Programme\navigram_register.exe
[2006/08/16 03:35:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/16 03:35:00 | 001,617,920 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2006/08/16 03:35:00 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006/08/16 03:35:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2006/08/16 03:35:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/08/16 03:35:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006/08/16 03:35:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006/08/16 03:35:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2006/08/16 03:35:00 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2006/08/16 03:35:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2006/02/28 08:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2006/02/28 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2006/02/28 08:00:00 | 000,442,114 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2006/02/28 08:00:00 | 000,426,498 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006/02/28 08:00:00 | 000,285,696 | ---- | C] () -- C:\WINDOWS\System32\srvsmem.exe.vir
[2006/02/28 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2006/02/28 08:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2006/02/28 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2006/02/28 08:00:00 | 000,077,854 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2006/02/28 08:00:00 | 000,065,508 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006/02/28 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2006/02/28 08:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2006/02/28 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2006/02/28 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2006/02/28 08:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2006/02/28 08:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2006/02/28 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2005/07/07 05:26:56 | 000,005,627 | R--- | C] () -- C:\WINDOWS\System32\Ludap17.ini
[2005/03/08 02:17:08 | 000,000,039 | R--- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2001/07/06 22:00:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
[2000/10/20 16:25:36 | 000,079,360 | ---- | C] () -- C:\WINDOWS\System32\acdbres.dll
 
========== LOP Check ==========
 
[2007/06/12 10:11:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HorstAdmin\Anwendungsdaten\Autodesk
[2007/06/12 07:00:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HorstAdmin\Anwendungsdaten\InterTrust
[2007/08/08 08:42:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\Autodesk
[2012/04/23 04:32:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\Babylon
[2012/04/24 05:02:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\BabylonToolbar
[2013/03/06 07:15:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\File Scout
[2012/09/25 10:58:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\IrfanView
[2011/10/26 08:14:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\Navigram
[2009/07/23 08:02:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\Nokia
[2011/06/07 07:58:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\PC Suite
[2013/01/07 04:37:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\PerformerSoft
[2012/10/11 04:40:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\ptc
[2010/11/08 06:54:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\RawTherapee
[2011/10/20 08:13:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\Samsung
[2013/07/02 05:27:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\Simply Super Software
[2007/08/08 08:53:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\T-DSL Manager
[2007/08/08 08:41:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\T-DSL SpeedManager
[2012/04/16 09:27:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ask
[2007/06/12 08:59:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Autodesk
[2012/04/23 04:32:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2012/04/23 05:13:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Borland
[2013/01/04 09:22:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IBUpdaterService
[2009/07/23 07:59:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2009/10/28 09:32:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2011/10/20 08:15:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Samsung
[2013/07/02 05:27:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Simply Super Software
[2007/08/08 08:53:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-DSL Manager
[2007/08/29 06:03:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-DSL SpeedManager
[2013/07/02 05:28:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2012/04/23 05:16:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WordPerfect Office X5
[2010/07/06 07:59:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\zvprt50
[2012/04/26 05:30:00 | 000,000,270 | ---- | M] () -- C:\WINDOWS\Tasks\PixillionReminder.job
[2013/07/01 04:44:19 | 000,000,402 | ---- | M] () -- C:\WINDOWS\Tasks\ReclaimerUpdateFiles_UR.job
[2013/07/01 05:44:19 | 000,000,398 | ---- | M] () -- C:\WINDOWS\Tasks\ReclaimerUpdateXML_UR.job
[2013/07/02 06:27:28 | 000,000,408 | ---- | M] () -- C:\WINDOWS\Tasks\RNUpgradeHelperLogonPrompt_UR.job
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2013/03/01 04:51:37 | 000,175,547 | ---- | C] ()(C:\Dokumente und Einstellungen\ur\Desktop\???????????.pdf.pdf.pdf) -- C:\Dokumente und Einstellungen\ur\Desktop\ヒータージャケット写真.pdf.pdf.pdf
[2013/03/01 04:50:41 | 000,175,547 | ---- | M] ()(C:\Dokumente und Einstellungen\ur\Desktop\???????????.pdf.pdf.pdf) -- C:\Dokumente und Einstellungen\ur\Desktop\ヒータージャケット写真.pdf.pdf.pdf
< End of report >

--- --- ---

schrauber · 03.07.2013, 10:42

Fixen mit OTL

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:

ATTFilter

:OTL
O4 - HKU\ur_ON_C..\Run: [xnemvwez] C:\Dokumente und Einstellungen\ur\Ydupdne\jlgkvwez.exe (Simon Tatham)

Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

acur · 03.07.2013, 11:07

Hallo,

das sieht dann so aus:

========== OTL ==========
Registry key HKEY_USERS\ur_ON_C\Software\Microsoft\Windows\CurrentVersion\Run not found.
C:\Dokumente und Einstellungen\ur\Ydupdne\jlgkvwez.exe moved successfully.

OTLPE by OldTimer - Version 3.1.48.0 log created on 07032013_140028

??? war es das oder lauert die Gefahr noch wo anders ???

gr Uwe

schrauber · 03.07.2013, 12:31

Kannst normal booten?

acur · 03.07.2013, 12:32

... noch nicht getraut auszuprobieren...

selbes Spiel wie vorher, anmelden ja, lade Daten.... und er meldet mich umgehend wieder ab....funktioniert also nicht ;-(

schrauber · 03.07.2013, 12:45

Àlso du kommst bis nach dem Anmelden mit Passwort? Frisches FRST log aus der Recovery bitte.

acur · 03.07.2013, 12:54

Hallo

ja richtig.
also wieder eine OLT.txt erstellen...

ist in Arbeit.
gruss Uwe

OTL logfile created on: 7/3/2013 7:14:11 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149.04 Gb Total Space | 105.82 Gb Free Space | 71.00% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002

========== Win32 Services (SafeList) ==========

SRV - [2013/06/12 07:05:28 | 000,181,664 | ---- | M] (Oracle Corporation) [Auto] -- C:\Programme\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2013/05/27 04:31:59 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/01/04 09:20:46 | 000,594,904 | ---- | M] () [Auto] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IBUpdaterService\ibsvc.exe -- (IBUpdaterService)
SRV - [2010/01/25 03:22:56 | 000,245,760 | ---- | M] (Brother Industries, Ltd.) [On_Demand] -- C:\Programme\Browny02\BrYNSvc.exe -- (BrYNSvc)
SRV - [2009/06/02 04:10:08 | 000,637,952 | ---- | M] (Nokia.) [On_Demand] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008/05/01 21:42:06 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2007/07/24 05:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2006/12/18 11:45:48 | 000,266,240 | ---- | M] (T-Systems) [On_Demand] -- C:\Programme\T-DSL Manager\DslMgrSvc.exe -- (TDslMgrService)
SRV - [2006/12/12 12:53:54 | 000,212,992 | ---- | M] (T-Systems Enterprise Services GmbH) [On_Demand] -- C:\Programme\Gemeinsame Dateien\T-COM\HotspotMgr\HotSpotFSvc.exe -- (HotSpotFSvc)
SRV - [2006/08/11 09:51:04 | 000,028,672 | ---- | M] (Novell, Inc.) [On_Demand] -- C:\WINDOWS\system32\cusrvc.exe -- (cusrvc)
SRV - [2006/07/28 10:07:08 | 000,119,952 | ---- | M] (symantec) [On_Demand] -- C:\Programme\Symantec AntiVirus\SavRoam.exe -- (SavRoam)
SRV - [2006/07/28 10:06:18 | 001,829,008 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Symantec AntiVirus\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2006/07/28 10:04:22 | 000,031,888 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Symantec AntiVirus\DefWatch.exe -- (DefWatch)
SRV - [2006/04/11 11:13:38 | 001,160,848 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe -- (SPBBCSvc)
SRV - [2006/03/24 11:14:58 | 000,169,632 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe -- (ccSetMgr)
SRV - [2006/03/24 11:14:52 | 000,192,160 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe -- (ccEvtMgr)
SRV - [2006/03/20 09:35:10 | 002,045,632 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_0.EXE -- (LiveUpdate)
SRV - [2006/01/24 14:06:58 | 000,214,720 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe -- (SNDSrvc)
SRV - [2005/04/03 18:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/07/14 10:00:44 | 000,147,456 | ---- | M] (T-Systems Nova, Berkom) [On_Demand] -- C:\Programme\T-DSL SpeedManager\tsmsvc.exe -- (TSMService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP)
DRV - File not found [Kernel | System] -- -- (PCIDump)
DRV - File not found [Kernel | System] -- -- (lbrtfdc)
DRV - File not found [Kernel | System] -- -- (i2omgmt)
DRV - File not found [Kernel | System] -- -- (Changer)
DRV - File not found [Kernel | On_Demand] -- -- (BOVOLUME)
DRV - File not found [Kernel | On_Demand] -- -- (BOProtocol)
DRV - [2013/06/17 04:00:00 | 001,611,992 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20130626.002\NAVEX15.SYS -- (NAVEX15)
DRV - [2013/06/17 04:00:00 | 000,093,272 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20130626.002\NAVENG.SYS -- (NAVENG)
DRV - [2012/07/31 20:34:46 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/07/31 20:34:45 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2011/06/02 01:47:22 | 000,136,808 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadmdm.sys -- (ssadmdm)
DRV - [2011/06/02 01:47:22 | 000,121,064 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadbus.sys -- (ssadbus) SAMSUNG Android USB Composite Device driver (WDM)
DRV - [2011/06/02 01:47:22 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadmdfl.sys -- (ssadmdfl) SAMSUNG Android USB Modem (Filter)
DRV - [2009/02/09 02:37:56 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2009/02/09 02:37:48 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2009/02/09 02:37:46 | 000,022,016 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2009/02/09 02:37:46 | 000,017,664 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008/08/26 04:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/02/28 22:13:24 | 000,036,880 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2008/02/28 22:13:16 | 000,035,344 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2008/02/28 22:12:48 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2007/07/16 17:29:43 | 000,020,504 | R--- | M] (Hewlett Packard) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\hpfxfax.sys -- (HPFXFAX)
DRV - [2007/07/16 17:29:33 | 000,017,432 | R--- | M] (Hewlett Packard) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\hpfxbulk.sys -- (HPFXBULK)
DRV - [2007/05/30 06:54:10 | 004,356,608 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/05/30 06:49:42 | 000,105,088 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\WINDOWS\System32\drivers\nvatabus.sys -- (nvatabus)
DRV - [2007/05/30 06:49:37 | 000,105,088 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\nvata.sys -- (nvata)
DRV - [2007/05/30 06:47:14 | 000,057,856 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2007/05/30 06:47:14 | 000,020,480 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2006/12/01 11:04:10 | 000,013,184 | ---- | M] (T-Systems) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tsmpkt.sys -- (TSMPacket)
DRV - [2006/11/09 04:38:22 | 000,506,159 | ---- | M] (Novell, Inc.) [File_System | Auto] -- C:\WINDOWS\system32\NetWare\nwfs.sys -- (NetwareWorkstation)
DRV - [2006/10/28 04:39:04 | 000,217,164 | ---- | M] (Novell, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\vptunnel.sys -- (BM)
DRV - [2006/09/25 06:44:52 | 000,043,280 | ---- | M] (Novell, Inc.) [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwdns.sys -- (NWDNS)
DRV - [2006/09/25 03:54:54 | 000,160,209 | ---- | M] (Novell, Inc.) [File_System | Auto] -- C:\WINDOWS\system32\NetWare\srvloc.sys -- (SRVLOC)
DRV - [2006/06/29 18:53:44 | 000,003,712 | ---- | M] (Logitech, Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2006/05/10 03:56:54 | 000,027,264 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LHidKE.Sys -- (LHidKe)
DRV - [2006/05/10 03:56:50 | 000,071,680 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2006/05/10 03:56:18 | 000,056,064 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\L8042MOU.SYS -- (L8042mou)
DRV - [2006/05/05 10:19:50 | 000,107,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Symantec\SYMEVENT.SYS -- (SymEvent)
DRV - [2006/04/11 11:13:34 | 000,389,776 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2006/03/03 11:50:48 | 000,038,416 | ---- | M] (Novell, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\nicm.sys -- (NICM)
DRV - [2006/01/25 09:27:42 | 000,162,688 | ---- | M] (T-Systems Nova GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\WTDDI.sys -- (TDDIWAN) Deutsche Telekom Dynamic ISDN (WDM)
DRV - [2006/01/24 14:06:36 | 000,195,776 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - [2006/01/24 14:06:32 | 000,024,768 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV - [2005/12/19 14:41:58 | 000,054,968 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Symantec AntiVirus\Savrtpel.sys -- (SAVRTPEL)
DRV - [2005/12/19 14:41:56 | 000,337,592 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Symantec AntiVirus\savrt.sys -- (SAVRT)
DRV - [2005/11/22 04:51:22 | 000,018,353 | ---- | M] (Novell, Inc.) [File_System | Auto] -- C:\WINDOWS\system32\NetWare\nwdhcp.sys -- (NWDHCP)
DRV - [2005/10/27 10:15:14 | 000,039,731 | ---- | M] (Novell, Inc.) [File_System | Auto] -- C:\WINDOWS\system32\NetWare\nwsipx32.sys -- (NWSIPX32)
DRV - [2005/10/12 07:12:18 | 000,009,297 | ---- | M] (Novell, Inc.) [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwhost.sys -- (NWHOST)
DRV - [2005/10/12 07:11:32 | 000,006,128 | ---- | M] (Novell, Inc.) [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwsns.sys -- (NWSNS)
DRV - [2005/07/07 04:14:30 | 001,389,056 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\P17.sys -- (P17)
DRV - [2005/05/26 12:14:00 | 000,015,891 | ---- | M] (Novell, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\NetWare\nwfilter.sys -- (NWFILTER)
DRV - [2005/01/10 06:15:30 | 000,106,496 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv)
DRV - [2005/01/10 06:15:24 | 000,138,752 | R--- | M] (Creative Technology Ltd) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV - [2005/01/03 08:51:38 | 000,020,332 | ---- | M] (Novell, Inc.) [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwslp.sys -- (NWSLP)
DRV - [2004/06/21 08:52:58 | 000,039,152 | ---- | M] (T-Systems Nova GmbH, Berkom Berlin) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\BOPPPoE.sys -- (BOAdapter)
DRV - [2004/06/01 12:19:34 | 000,027,249 | ---- | M] (Novell, Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\NetWare\resmgr.sys -- (RESMGR)
DRV - [2004/03/11 11:44:26 | 000,009,696 | ---- | M] (T-Systems Nova GmbH) [Kernel | On_Demand] -- C:\Programme\T-DSL SpeedManager\TNPACKET.SYS -- (TNPacket)
DRV - [2003/08/22 04:44:56 | 000,456,080 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\System32\drivers\niciccs.sys -- (NICICCS)
DRV - [2003/02/26 08:51:18 | 000,023,232 | ---- | M] () [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwsap.sys -- (NWSAP)
DRV - [2000/10/15 12:38:54 | 000,016,068 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\Programme\T-DSL SpeedManager\PCANDIS5.SYS -- (PCANDIS5)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Aixtron_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\Aixtron_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\Aixtron_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.0.0.245:8080

IE - HKU\HorstAdmin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\HorstAdmin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\HorstAdmin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.0.0.245:8080

IE - HKU\ur_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\ur_ON_C\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\ur_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\ur_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\ur_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.0.0.245:8080

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://de.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de

fficial"

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.11.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@ptc.com/ProductViewLite: C:\Programme\Gemeinsame Dateien\PTC\np6_pvapplite9.dll (PTC)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.660: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.660: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.660: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2007/10/23 06:14:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Programme\Nokia\Nokia PC Suite 7\bkmrksync\ [2009/07/23 08:01:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/07/21 02:07:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2013/05/27 04:32:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2013/05/27 04:31:51 | 000,000,000 | ---D | M]

[2007/06/13 04:18:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Aixtron\Anwendungsdaten\mozilla\Firefox\Profiles\is8k0htv.default\extensions
[2013/05/27 04:32:01 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013/05/27 04:31:49 | 000,000,000 | ---D | M] (Google Settings) -- C:\Programme\Mozilla Firefox\extensions\google-cjk@partners.mozilla.com
[2013/05/27 04:32:01 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions
[2013/05/27 04:32:01 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- C:\PROGRAMME\MOZILLA FIREFOX\EXTENSIONS\{3112CA9C-DE6D-4884-A869-9855DE68056C}
[2012/04/23 04:32:10 | 000,002,313 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml

O1 HOSTS File: ([2007/06/13 06:35:36 | 000,001,346 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 10.0.0.245 nw-kommunikation.horst.de
O1 - Hosts: 10.0.0.246 Fax-Server.horst.de
O1 - Hosts: 10.0.0.251 NW-SERVER.horst.de
O1 - Hosts: 10.0.0.245 nw-kommunikation
O1 - Hosts: 10.0.0.246 Fax-Server
O1 - Hosts: 10.0.0.251 NW-SERVER
O1 - Hosts: 10.0.0.244 Virual01
O1 - Hosts: 10.0.0.247 XP-Sich
O1 - Hosts: 10.0.0.248 PDC_Backup
O1 - Hosts: 10.0.0.249 PDC
O1 - Hosts: 10.0.0.250 PADB01
O1 - Hosts: 10.0.0.251 mail2.Horst.de
O1 - Hosts: 10.0.0.252 PADBSRV
O1 - Hosts: 10.0.0.253 HOR-LOR-000
O1 - Hosts: 10.0.0.254 PAOPT01
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (WebCGMHlprObj Class) - {56B38F40-4E70-11d4-A076-0080AD86BA2F} - C:\WINDOWS\system32\cgmopenbho.dll (CGM Open Consortium, Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - File not found
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKLM\..\Toolbar: (Babylon) - {965B54B0-71E0-4611-8DE7-F73FA0B20E26} - C:\Programme\Babylon\Babylon Toolbar\BabylonIEToolBar.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKU\ur_ON_C\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKU\ur_ON_C\..\Toolbar\WebBrowser: (Babylon) - {965B54B0-71E0-4611-8DE7-F73FA0B20E26} - C:\Programme\Babylon\Babylon Toolbar\BabylonIEToolBar.dll (Babylon Ltd.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [BrStsMon00] C:\Programme\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [KiesHelper] C:\Programme\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [NDPS] C:\WINDOWS\system32\dpmw32.exe (Novell, Inc.)
O4 - HKLM..\Run: [NovellVpn] C:\WINDOWS\System32\vpnstats.exe ()
O4 - HKLM..\Run: [NWTRAY] C:\WINDOWS\System32\nwtray.exe (Novell, Inc.)
O4 - HKLM..\Run: [P17Helper] C:\WINDOWS\System32\P17.dll ()
O4 - HKLM..\Run: [QuickFinder Scheduler] C:\Programme\Corel\WordPerfect Office X5\Programs\QFSCHD150.EXE (Corel Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Oracle Corporation)
O4 - HKLM..\Run: [T-DSL SpeedMgr] C:\Programme\T-DSL SpeedManager\SpeedMgr.exe (T-Systems Nova, Berkom)
O4 - HKLM..\Run: [T-DSL-Manager-Setup] File not found
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [ToolBoxFX] C:\Programme\HP\ToolBoxFX\bin\HPTLBXFX.exe (HP)
O4 - HKLM..\Run: [TrojanScanner] C:\Programme\Trojan Remover\Trjscan.exe (Simply Super Software)
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [vptray] C:\Programme\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
O4 - HKU\ur_ON_C..\Run: [CreativeTaskScheduler] C:\Programme\Creative\Shared Files\CTSched.exe (Creative Technology Ltd)
O4 - HKU\ur_ON_C..\Run: [KiesPDLR] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKU\ur_ON_C..\Run: [PC Suite Tray] C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - HKU\ur_ON_C..\Run: [xnemvwez] File not found
O4 - HKLM..\RunOnce: [RestoreDNSSLPConfig] C:\WINDOWS\system32\SlpDnsRestore.exe ()
O4 - HKLM..\RunOnce: [Trojan Remover] C:\Programme\Trojan Remover\RMVTRJAN.EXE (Simply Super Software)
O4 - HKU\.DEFAULT..\RunOnce: [RealUpgradeHelper] File not found
O4 - HKU\ur_ON_C..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil32_11_6_602_171_Plugin.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Dokumente und Einstellungen\Aixtron\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE (WinZip Computing, Inc. and H.C. Top Systems B.V.)
O4 - Startup: C:\Dokumente und Einstellungen\Default User\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\HorstAdmin\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\ur\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\ur.AIXTRON-2\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\ur.AIXTRON-2.000\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\ur.AIXTRON-2.001\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0

schrauber · 03.07.2013, 13:50

Hi,

bitte in codetags.

acur · 03.07.2013, 14:11

... sorry mein Fehler, hier als code:

Code:

ATTFilter

OTL logfile created on: 7/3/2013 7:14:11 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149.04 Gb Total Space | 105.82 Gb Free Space | 71.00% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002
 
========== Win32 Services (SafeList) ==========
 
SRV - [2013/06/12 07:05:28 | 000,181,664 | ---- | M] (Oracle Corporation) [Auto] -- C:\Programme\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2013/05/27 04:31:59 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/01/04 09:20:46 | 000,594,904 | ---- | M] () [Auto] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IBUpdaterService\ibsvc.exe -- (IBUpdaterService)
SRV - [2010/01/25 03:22:56 | 000,245,760 | ---- | M] (Brother Industries, Ltd.) [On_Demand] -- C:\Programme\Browny02\BrYNSvc.exe -- (BrYNSvc)
SRV - [2009/06/02 04:10:08 | 000,637,952 | ---- | M] (Nokia.) [On_Demand] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008/05/01 21:42:06 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2007/07/24 05:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2006/12/18 11:45:48 | 000,266,240 | ---- | M] (T-Systems) [On_Demand] -- C:\Programme\T-DSL Manager\DslMgrSvc.exe -- (TDslMgrService)
SRV - [2006/12/12 12:53:54 | 000,212,992 | ---- | M] (T-Systems Enterprise Services GmbH) [On_Demand] -- C:\Programme\Gemeinsame Dateien\T-COM\HotspotMgr\HotSpotFSvc.exe -- (HotSpotFSvc)
SRV - [2006/08/11 09:51:04 | 000,028,672 | ---- | M] (Novell, Inc.) [On_Demand] -- C:\WINDOWS\system32\cusrvc.exe -- (cusrvc)
SRV - [2006/07/28 10:07:08 | 000,119,952 | ---- | M] (symantec) [On_Demand] -- C:\Programme\Symantec AntiVirus\SavRoam.exe -- (SavRoam)
SRV - [2006/07/28 10:06:18 | 001,829,008 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Symantec AntiVirus\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2006/07/28 10:04:22 | 000,031,888 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Symantec AntiVirus\DefWatch.exe -- (DefWatch)
SRV - [2006/04/11 11:13:38 | 001,160,848 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe -- (SPBBCSvc)
SRV - [2006/03/24 11:14:58 | 000,169,632 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe -- (ccSetMgr)
SRV - [2006/03/24 11:14:52 | 000,192,160 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe -- (ccEvtMgr)
SRV - [2006/03/20 09:35:10 | 002,045,632 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_0.EXE -- (LiveUpdate)
SRV - [2006/01/24 14:06:58 | 000,214,720 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe -- (SNDSrvc)
SRV - [2005/04/03 18:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/07/14 10:00:44 | 000,147,456 | ---- | M] (T-Systems Nova, Berkom) [On_Demand] -- C:\Programme\T-DSL SpeedManager\tsmsvc.exe -- (TSMService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - File not found [Kernel | On_Demand] --  -- (BOVOLUME)
DRV - File not found [Kernel | On_Demand] --  -- (BOProtocol)
DRV - [2013/06/17 04:00:00 | 001,611,992 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20130626.002\NAVEX15.SYS -- (NAVEX15)
DRV - [2013/06/17 04:00:00 | 000,093,272 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20130626.002\NAVENG.SYS -- (NAVENG)
DRV - [2012/07/31 20:34:46 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/07/31 20:34:45 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2011/06/02 01:47:22 | 000,136,808 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadmdm.sys -- (ssadmdm)
DRV - [2011/06/02 01:47:22 | 000,121,064 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadbus.sys -- (ssadbus) SAMSUNG Android USB Composite Device driver (WDM)
DRV - [2011/06/02 01:47:22 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadmdfl.sys -- (ssadmdfl) SAMSUNG Android USB Modem (Filter)
DRV - [2009/02/09 02:37:56 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2009/02/09 02:37:48 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2009/02/09 02:37:46 | 000,022,016 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2009/02/09 02:37:46 | 000,017,664 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008/08/26 04:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/02/28 22:13:24 | 000,036,880 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2008/02/28 22:13:16 | 000,035,344 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2008/02/28 22:12:48 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2007/07/16 17:29:43 | 000,020,504 | R--- | M] (Hewlett Packard) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\hpfxfax.sys -- (HPFXFAX)
DRV - [2007/07/16 17:29:33 | 000,017,432 | R--- | M] (Hewlett Packard) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\hpfxbulk.sys -- (HPFXBULK)
DRV - [2007/05/30 06:54:10 | 004,356,608 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/05/30 06:49:42 | 000,105,088 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\WINDOWS\System32\drivers\nvatabus.sys -- (nvatabus)
DRV - [2007/05/30 06:49:37 | 000,105,088 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\nvata.sys -- (nvata)
DRV - [2007/05/30 06:47:14 | 000,057,856 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2007/05/30 06:47:14 | 000,020,480 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2006/12/01 11:04:10 | 000,013,184 | ---- | M] (T-Systems) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tsmpkt.sys -- (TSMPacket)
DRV - [2006/11/09 04:38:22 | 000,506,159 | ---- | M] (Novell, Inc.) [File_System | Auto] -- C:\WINDOWS\system32\NetWare\nwfs.sys -- (NetwareWorkstation)
DRV - [2006/10/28 04:39:04 | 000,217,164 | ---- | M] (Novell, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\vptunnel.sys -- (BM)
DRV - [2006/09/25 06:44:52 | 000,043,280 | ---- | M] (Novell, Inc.) [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwdns.sys -- (NWDNS)
DRV - [2006/09/25 03:54:54 | 000,160,209 | ---- | M] (Novell, Inc.) [File_System | Auto] -- C:\WINDOWS\system32\NetWare\srvloc.sys -- (SRVLOC)
DRV - [2006/06/29 18:53:44 | 000,003,712 | ---- | M] (Logitech, Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2006/05/10 03:56:54 | 000,027,264 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LHidKE.Sys -- (LHidKe)
DRV - [2006/05/10 03:56:50 | 000,071,680 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2006/05/10 03:56:18 | 000,056,064 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\L8042MOU.SYS -- (L8042mou)
DRV - [2006/05/05 10:19:50 | 000,107,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Symantec\SYMEVENT.SYS -- (SymEvent)
DRV - [2006/04/11 11:13:34 | 000,389,776 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2006/03/03 11:50:48 | 000,038,416 | ---- | M] (Novell, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\nicm.sys -- (NICM)
DRV - [2006/01/25 09:27:42 | 000,162,688 | ---- | M] (T-Systems Nova GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\WTDDI.sys -- (TDDIWAN) Deutsche Telekom Dynamic ISDN (WDM)
DRV - [2006/01/24 14:06:36 | 000,195,776 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - [2006/01/24 14:06:32 | 000,024,768 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV - [2005/12/19 14:41:58 | 000,054,968 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Symantec AntiVirus\Savrtpel.sys -- (SAVRTPEL)
DRV - [2005/12/19 14:41:56 | 000,337,592 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Symantec AntiVirus\savrt.sys -- (SAVRT)
DRV - [2005/11/22 04:51:22 | 000,018,353 | ---- | M] (Novell, Inc.) [File_System | Auto] -- C:\WINDOWS\system32\NetWare\nwdhcp.sys -- (NWDHCP)
DRV - [2005/10/27 10:15:14 | 000,039,731 | ---- | M] (Novell, Inc.) [File_System | Auto] -- C:\WINDOWS\system32\NetWare\nwsipx32.sys -- (NWSIPX32)
DRV - [2005/10/12 07:12:18 | 000,009,297 | ---- | M] (Novell, Inc.) [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwhost.sys -- (NWHOST)
DRV - [2005/10/12 07:11:32 | 000,006,128 | ---- | M] (Novell, Inc.) [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwsns.sys -- (NWSNS)
DRV - [2005/07/07 04:14:30 | 001,389,056 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\P17.sys -- (P17)
DRV - [2005/05/26 12:14:00 | 000,015,891 | ---- | M] (Novell, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\NetWare\nwfilter.sys -- (NWFILTER)
DRV - [2005/01/10 06:15:30 | 000,106,496 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv)
DRV - [2005/01/10 06:15:24 | 000,138,752 | R--- | M] (Creative Technology Ltd) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV - [2005/01/03 08:51:38 | 000,020,332 | ---- | M] (Novell, Inc.) [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwslp.sys -- (NWSLP)
DRV - [2004/06/21 08:52:58 | 000,039,152 | ---- | M] (T-Systems Nova GmbH, Berkom Berlin) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\BOPPPoE.sys -- (BOAdapter)
DRV - [2004/06/01 12:19:34 | 000,027,249 | ---- | M] (Novell, Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\NetWare\resmgr.sys -- (RESMGR)
DRV - [2004/03/11 11:44:26 | 000,009,696 | ---- | M] (T-Systems Nova GmbH) [Kernel | On_Demand] -- C:\Programme\T-DSL SpeedManager\TNPACKET.SYS -- (TNPacket)
DRV - [2003/08/22 04:44:56 | 000,456,080 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\System32\drivers\niciccs.sys -- (NICICCS)
DRV - [2003/02/26 08:51:18 | 000,023,232 | ---- | M] () [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwsap.sys -- (NWSAP)
DRV - [2000/10/15 12:38:54 | 000,016,068 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\Programme\T-DSL SpeedManager\PCANDIS5.SYS -- (PCANDIS5)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Aixtron_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\Aixtron_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\Aixtron_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.0.0.245:8080
 
IE - HKU\HorstAdmin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\HorstAdmin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\HorstAdmin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.0.0.245:8080
 
 
 
 
 
IE - HKU\ur_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\ur_ON_C\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\ur_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\ur_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\ur_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.0.0.245:8080
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://de.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official"
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.11.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2:  File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@ptc.com/ProductViewLite: C:\Programme\Gemeinsame Dateien\PTC\np6_pvapplite9.dll (PTC)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.660: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.660: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.660: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2007/10/23 06:14:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Programme\Nokia\Nokia PC Suite 7\bkmrksync\ [2009/07/23 08:01:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/07/21 02:07:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2013/05/27 04:32:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2013/05/27 04:31:51 | 000,000,000 | ---D | M]
 
[2007/06/13 04:18:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Aixtron\Anwendungsdaten\mozilla\Firefox\Profiles\is8k0htv.default\extensions
[2013/05/27 04:32:01 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013/05/27 04:31:49 | 000,000,000 | ---D | M] (Google Settings) -- C:\Programme\Mozilla Firefox\extensions\google-cjk@partners.mozilla.com
[2013/05/27 04:32:01 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions
[2013/05/27 04:32:01 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- C:\PROGRAMME\MOZILLA FIREFOX\EXTENSIONS\{3112CA9C-DE6D-4884-A869-9855DE68056C}
[2012/04/23 04:32:10 | 000,002,313 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml

schrauber · 03.07.2013, 14:13

irgendwie fehlt da die Häfte vom Log

acur · 03.07.2013, 14:21

... stimmt, hier alles:

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 7/3/2013 7:14:11 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149.04 Gb Total Space | 105.82 Gb Free Space | 71.00% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002
 
========== Win32 Services (SafeList) ==========
 
SRV - [2013/06/12 07:05:28 | 000,181,664 | ---- | M] (Oracle Corporation) [Auto] -- C:\Programme\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2013/05/27 04:31:59 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/01/04 09:20:46 | 000,594,904 | ---- | M] () [Auto] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IBUpdaterService\ibsvc.exe -- (IBUpdaterService)
SRV - [2010/01/25 03:22:56 | 000,245,760 | ---- | M] (Brother Industries, Ltd.) [On_Demand] -- C:\Programme\Browny02\BrYNSvc.exe -- (BrYNSvc)
SRV - [2009/06/02 04:10:08 | 000,637,952 | ---- | M] (Nokia.) [On_Demand] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008/05/01 21:42:06 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2007/07/24 05:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2006/12/18 11:45:48 | 000,266,240 | ---- | M] (T-Systems) [On_Demand] -- C:\Programme\T-DSL Manager\DslMgrSvc.exe -- (TDslMgrService)
SRV - [2006/12/12 12:53:54 | 000,212,992 | ---- | M] (T-Systems Enterprise Services GmbH) [On_Demand] -- C:\Programme\Gemeinsame Dateien\T-COM\HotspotMgr\HotSpotFSvc.exe -- (HotSpotFSvc)
SRV - [2006/08/11 09:51:04 | 000,028,672 | ---- | M] (Novell, Inc.) [On_Demand] -- C:\WINDOWS\system32\cusrvc.exe -- (cusrvc)
SRV - [2006/07/28 10:07:08 | 000,119,952 | ---- | M] (symantec) [On_Demand] -- C:\Programme\Symantec AntiVirus\SavRoam.exe -- (SavRoam)
SRV - [2006/07/28 10:06:18 | 001,829,008 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Symantec AntiVirus\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2006/07/28 10:04:22 | 000,031,888 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Symantec AntiVirus\DefWatch.exe -- (DefWatch)
SRV - [2006/04/11 11:13:38 | 001,160,848 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe -- (SPBBCSvc)
SRV - [2006/03/24 11:14:58 | 000,169,632 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe -- (ccSetMgr)
SRV - [2006/03/24 11:14:52 | 000,192,160 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe -- (ccEvtMgr)
SRV - [2006/03/20 09:35:10 | 002,045,632 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_0.EXE -- (LiveUpdate)
SRV - [2006/01/24 14:06:58 | 000,214,720 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe -- (SNDSrvc)
SRV - [2005/04/03 18:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/07/14 10:00:44 | 000,147,456 | ---- | M] (T-Systems Nova, Berkom) [On_Demand] -- C:\Programme\T-DSL SpeedManager\tsmsvc.exe -- (TSMService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - File not found [Kernel | On_Demand] --  -- (BOVOLUME)
DRV - File not found [Kernel | On_Demand] --  -- (BOProtocol)
DRV - [2013/06/17 04:00:00 | 001,611,992 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20130626.002\NAVEX15.SYS -- (NAVEX15)
DRV - [2013/06/17 04:00:00 | 000,093,272 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20130626.002\NAVENG.SYS -- (NAVENG)
DRV - [2012/07/31 20:34:46 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/07/31 20:34:45 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2011/06/02 01:47:22 | 000,136,808 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadmdm.sys -- (ssadmdm)
DRV - [2011/06/02 01:47:22 | 000,121,064 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadbus.sys -- (ssadbus) SAMSUNG Android USB Composite Device driver (WDM)
DRV - [2011/06/02 01:47:22 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssadmdfl.sys -- (ssadmdfl) SAMSUNG Android USB Modem (Filter)
DRV - [2009/02/09 02:37:56 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2009/02/09 02:37:48 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2009/02/09 02:37:46 | 000,022,016 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2009/02/09 02:37:46 | 000,017,664 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008/08/26 04:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/02/28 22:13:24 | 000,036,880 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2008/02/28 22:13:16 | 000,035,344 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2008/02/28 22:12:48 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2007/07/16 17:29:43 | 000,020,504 | R--- | M] (Hewlett Packard) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\hpfxfax.sys -- (HPFXFAX)
DRV - [2007/07/16 17:29:33 | 000,017,432 | R--- | M] (Hewlett Packard) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\hpfxbulk.sys -- (HPFXBULK)
DRV - [2007/05/30 06:54:10 | 004,356,608 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/05/30 06:49:42 | 000,105,088 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\WINDOWS\System32\drivers\nvatabus.sys -- (nvatabus)
DRV - [2007/05/30 06:49:37 | 000,105,088 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\nvata.sys -- (nvata)
DRV - [2007/05/30 06:47:14 | 000,057,856 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2007/05/30 06:47:14 | 000,020,480 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2006/12/01 11:04:10 | 000,013,184 | ---- | M] (T-Systems) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tsmpkt.sys -- (TSMPacket)
DRV - [2006/11/09 04:38:22 | 000,506,159 | ---- | M] (Novell, Inc.) [File_System | Auto] -- C:\WINDOWS\system32\NetWare\nwfs.sys -- (NetwareWorkstation)
DRV - [2006/10/28 04:39:04 | 000,217,164 | ---- | M] (Novell, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\vptunnel.sys -- (BM)
DRV - [2006/09/25 06:44:52 | 000,043,280 | ---- | M] (Novell, Inc.) [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwdns.sys -- (NWDNS)
DRV - [2006/09/25 03:54:54 | 000,160,209 | ---- | M] (Novell, Inc.) [File_System | Auto] -- C:\WINDOWS\system32\NetWare\srvloc.sys -- (SRVLOC)
DRV - [2006/06/29 18:53:44 | 000,003,712 | ---- | M] (Logitech, Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2006/05/10 03:56:54 | 000,027,264 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LHidKE.Sys -- (LHidKe)
DRV - [2006/05/10 03:56:50 | 000,071,680 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2006/05/10 03:56:18 | 000,056,064 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\L8042MOU.SYS -- (L8042mou)
DRV - [2006/05/05 10:19:50 | 000,107,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Symantec\SYMEVENT.SYS -- (SymEvent)
DRV - [2006/04/11 11:13:34 | 000,389,776 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2006/03/03 11:50:48 | 000,038,416 | ---- | M] (Novell, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\nicm.sys -- (NICM)
DRV - [2006/01/25 09:27:42 | 000,162,688 | ---- | M] (T-Systems Nova GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\WTDDI.sys -- (TDDIWAN) Deutsche Telekom Dynamic ISDN (WDM)
DRV - [2006/01/24 14:06:36 | 000,195,776 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - [2006/01/24 14:06:32 | 000,024,768 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV - [2005/12/19 14:41:58 | 000,054,968 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Symantec AntiVirus\Savrtpel.sys -- (SAVRTPEL)
DRV - [2005/12/19 14:41:56 | 000,337,592 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Symantec AntiVirus\savrt.sys -- (SAVRT)
DRV - [2005/11/22 04:51:22 | 000,018,353 | ---- | M] (Novell, Inc.) [File_System | Auto] -- C:\WINDOWS\system32\NetWare\nwdhcp.sys -- (NWDHCP)
DRV - [2005/10/27 10:15:14 | 000,039,731 | ---- | M] (Novell, Inc.) [File_System | Auto] -- C:\WINDOWS\system32\NetWare\nwsipx32.sys -- (NWSIPX32)
DRV - [2005/10/12 07:12:18 | 000,009,297 | ---- | M] (Novell, Inc.) [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwhost.sys -- (NWHOST)
DRV - [2005/10/12 07:11:32 | 000,006,128 | ---- | M] (Novell, Inc.) [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwsns.sys -- (NWSNS)
DRV - [2005/07/07 04:14:30 | 001,389,056 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\P17.sys -- (P17)
DRV - [2005/05/26 12:14:00 | 000,015,891 | ---- | M] (Novell, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\NetWare\nwfilter.sys -- (NWFILTER)
DRV - [2005/01/10 06:15:30 | 000,106,496 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv)
DRV - [2005/01/10 06:15:24 | 000,138,752 | R--- | M] (Creative Technology Ltd) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV - [2005/01/03 08:51:38 | 000,020,332 | ---- | M] (Novell, Inc.) [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwslp.sys -- (NWSLP)
DRV - [2004/06/21 08:52:58 | 000,039,152 | ---- | M] (T-Systems Nova GmbH, Berkom Berlin) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\BOPPPoE.sys -- (BOAdapter)
DRV - [2004/06/01 12:19:34 | 000,027,249 | ---- | M] (Novell, Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\NetWare\resmgr.sys -- (RESMGR)
DRV - [2004/03/11 11:44:26 | 000,009,696 | ---- | M] (T-Systems Nova GmbH) [Kernel | On_Demand] -- C:\Programme\T-DSL SpeedManager\TNPACKET.SYS -- (TNPacket)
DRV - [2003/08/22 04:44:56 | 000,456,080 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\System32\drivers\niciccs.sys -- (NICICCS)
DRV - [2003/02/26 08:51:18 | 000,023,232 | ---- | M] () [File_System | On_Demand] -- C:\WINDOWS\system32\NetWare\nwsap.sys -- (NWSAP)
DRV - [2000/10/15 12:38:54 | 000,016,068 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\Programme\T-DSL SpeedManager\PCANDIS5.SYS -- (PCANDIS5)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Aixtron_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\Aixtron_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\Aixtron_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.0.0.245:8080
 
IE - HKU\HorstAdmin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\HorstAdmin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\HorstAdmin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.0.0.245:8080
 
 
 
 
 
IE - HKU\ur_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\ur_ON_C\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\ur_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\ur_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\ur_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.0.0.245:8080
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://de.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official"
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.11.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2:  File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@ptc.com/ProductViewLite: C:\Programme\Gemeinsame Dateien\PTC\np6_pvapplite9.dll (PTC)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.660: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.660: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.660: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2007/10/23 06:14:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Programme\Nokia\Nokia PC Suite 7\bkmrksync\ [2009/07/23 08:01:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/07/21 02:07:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2013/05/27 04:32:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2013/05/27 04:31:51 | 000,000,000 | ---D | M]
 
[2007/06/13 04:18:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Aixtron\Anwendungsdaten\mozilla\Firefox\Profiles\is8k0htv.default\extensions
[2013/05/27 04:32:01 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013/05/27 04:31:49 | 000,000,000 | ---D | M] (Google Settings) -- C:\Programme\Mozilla Firefox\extensions\google-cjk@partners.mozilla.com
[2013/05/27 04:32:01 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions
[2013/05/27 04:32:01 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- C:\PROGRAMME\MOZILLA FIREFOX\EXTENSIONS\{3112CA9C-DE6D-4884-A869-9855DE68056C}
[2012/04/23 04:32:10 | 000,002,313 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
 
O1 HOSTS File: ([2007/06/13 06:35:36 | 000,001,346 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 10.0.0.245           nw-kommunikation.horst.de  
O1 - Hosts: 10.0.0.246           Fax-Server.horst.de
O1 - Hosts: 10.0.0.251           NW-SERVER.horst.de
O1 - Hosts: 10.0.0.245           nw-kommunikation
O1 - Hosts: 10.0.0.246           Fax-Server
O1 - Hosts: 10.0.0.251           NW-SERVER
O1 - Hosts: 10.0.0.244           Virual01
O1 - Hosts: 10.0.0.247           XP-Sich
O1 - Hosts: 10.0.0.248           PDC_Backup
O1 - Hosts: 10.0.0.249           PDC
O1 - Hosts: 10.0.0.250           PADB01
O1 - Hosts: 10.0.0.251           mail2.Horst.de
O1 - Hosts: 10.0.0.252           PADBSRV
O1 - Hosts: 10.0.0.253           HOR-LOR-000
O1 - Hosts: 10.0.0.254           PAOPT01     
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (WebCGMHlprObj Class) - {56B38F40-4E70-11d4-A076-0080AD86BA2F} - C:\WINDOWS\system32\cgmopenbho.dll (CGM Open Consortium, Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -  File not found
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKLM\..\Toolbar: (Babylon) - {965B54B0-71E0-4611-8DE7-F73FA0B20E26} - C:\Programme\Babylon\Babylon Toolbar\BabylonIEToolBar.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKU\ur_ON_C\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKU\ur_ON_C\..\Toolbar\WebBrowser: (Babylon) - {965B54B0-71E0-4611-8DE7-F73FA0B20E26} - C:\Programme\Babylon\Babylon Toolbar\BabylonIEToolBar.dll (Babylon Ltd.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [BrStsMon00] C:\Programme\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [KiesHelper] C:\Programme\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [NDPS] C:\WINDOWS\system32\dpmw32.exe (Novell, Inc.)
O4 - HKLM..\Run: [NovellVpn] C:\WINDOWS\System32\vpnstats.exe ()
O4 - HKLM..\Run: [NWTRAY] C:\WINDOWS\System32\nwtray.exe (Novell, Inc.)
O4 - HKLM..\Run: [P17Helper] C:\WINDOWS\System32\P17.dll ()
O4 - HKLM..\Run: [QuickFinder Scheduler] C:\Programme\Corel\WordPerfect Office X5\Programs\QFSCHD150.EXE (Corel Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Oracle Corporation)
O4 - HKLM..\Run: [T-DSL SpeedMgr] C:\Programme\T-DSL SpeedManager\SpeedMgr.exe (T-Systems Nova, Berkom)
O4 - HKLM..\Run: [T-DSL-Manager-Setup]  File not found
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [ToolBoxFX] C:\Programme\HP\ToolBoxFX\bin\HPTLBXFX.exe (HP)
O4 - HKLM..\Run: [TrojanScanner] C:\Programme\Trojan Remover\Trjscan.exe (Simply Super Software)
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [vptray] C:\Programme\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
O4 - HKU\ur_ON_C..\Run: [CreativeTaskScheduler] C:\Programme\Creative\Shared Files\CTSched.exe (Creative Technology Ltd)
O4 - HKU\ur_ON_C..\Run: [KiesPDLR] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKU\ur_ON_C..\Run: [PC Suite Tray] C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - HKU\ur_ON_C..\Run: [xnemvwez]  File not found
O4 - HKLM..\RunOnce: [RestoreDNSSLPConfig] C:\WINDOWS\system32\SlpDnsRestore.exe ()
O4 - HKLM..\RunOnce: [Trojan Remover] C:\Programme\Trojan Remover\RMVTRJAN.EXE (Simply Super Software)
O4 - HKU\.DEFAULT..\RunOnce: [RealUpgradeHelper]  File not found
O4 - HKU\ur_ON_C..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil32_11_6_602_171_Plugin.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Dokumente und Einstellungen\Aixtron\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE (WinZip Computing, Inc. and H.C. Top Systems B.V.)
O4 - Startup: C:\Dokumente und Einstellungen\Default User\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\HorstAdmin\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\ur\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\ur.AIXTRON-2\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\ur.AIXTRON-2.000\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\ur.AIXTRON-2.001\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O4 - Startup: C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Startmenü\Programme\Autostart\T-DSL Manager.lnk = C:\Programme\T-DSL Manager\DslMgr.exe (T-Systems)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: CompatibleRUPSecurity = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Aixtron_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\HorstAdmin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\ur.AIXTRON-2.002_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\ur_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\NetWare\nwws2nds.dll (Novell, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\WINDOWS\system32\NetWare\nwws2sap.dll (Novell, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\WINDOWS\system32\NetWare\nwws2slp.dll (Novell, Inc.)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181645365703 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1181645626062 (MUWebControl Class)
O16 - DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://www.navigram.com/engine/v1111/Navigram.cab (Navigram Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (NWGINA.DLL) - C:\WINDOWS\System32\nwgina.dll (Novell, Inc.)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\programme\gemeinsame dateien\logitech\bluetooth\LBTWlgn.dll - C:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O27 - HKLM IFEO\userinit.exe: Debugger - C:\WINDOWS\system32\srvsmem.exe File not found
O30 - LSA: Authentication Packages - (nwv1_0) - C:\WINDOWS\System32\nwv1_0.dll (Novell, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/06/05 16:12:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/07/03 14:00:28 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/07/02 06:13:34 | 000,000,000 | --SD | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Anwendungsdaten\Microsoft
[2013/07/02 06:13:34 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Anwendungsdaten
[2013/07/02 06:13:34 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Cookies
[2013/07/02 06:13:34 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Druckumgebung
[2013/07/02 06:13:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Lokale Einstellungen\Anwendungsdaten\Microsoft
[2013/07/02 06:13:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Anwendungsdaten\Macromedia
[2013/07/02 06:13:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Favoriten
[2013/07/02 06:13:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Eigene Dateien
[2013/07/02 06:13:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Desktop
[2013/07/02 06:13:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Lokale Einstellungen\Anwendungsdaten\Adobe
[2013/07/02 06:13:33 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\SendTo
[2013/07/02 06:13:33 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Startmenü\Programme\Zubehör
[2013/07/02 06:13:33 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Startmenü
[2013/07/02 06:13:33 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Startmenü\Programme\Autostart
[2013/07/02 06:13:33 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Vorlagen
[2013/07/02 06:13:33 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Recent
[2013/07/02 06:13:33 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Netzwerkumgebung
[2013/07/02 06:13:33 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Lokale Einstellungen
[2013/07/02 05:28:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2013/07/02 05:27:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur\Eigene Dateien\Simply Super Software
[2013/07/02 05:27:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\Simply Super Software
[2013/07/02 05:27:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Trojan Remover
[2013/07/02 05:27:22 | 000,605,968 | ---- | C] (Igor Pavlov) -- C:\WINDOWS\System32\ztv7z.dll
[2013/07/02 05:27:22 | 000,077,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ztvcabinet.dll
[2013/07/02 05:27:21 | 000,000,000 | ---D | C] -- C:\Programme\Trojan Remover
[2013/07/02 05:27:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Simply Super Software
[2013/06/27 05:41:50 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\LocalService\IETldCache
[2013/06/27 05:41:41 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\LocalService\IECompatCache
[2013/06/27 05:10:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NortonInstaller
[2013/06/27 04:10:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ur\Ydupdne
[2013/06/12 07:05:45 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java
[2010/08/05 08:22:01 | 000,065,536 | R--- | C] ( ) -- C:\WINDOWS\System32\A3d.dll
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\Dokumente und Einstellungen\ur\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\ur\Desktop\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/07/03 10:40:35 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/07/03 10:39:22 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/07/03 10:39:18 | 000,000,408 | ---- | M] () -- C:\WINDOWS\tasks\RNUpgradeHelperLogonPrompt_UR.job
[2013/07/03 10:39:18 | 000,000,264 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-553522983-733113839-4547331-1180.job
[2013/07/03 08:58:18 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/07/02 06:24:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/07/02 05:27:25 | 000,000,786 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Trojan Remover.lnk
[2013/07/02 05:27:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Trojan Remover
[2013/07/02 05:21:35 | 000,000,011 | ---- | M] () -- C:\WINDOWS\NetWare.INI
[2013/07/01 05:44:19 | 000,000,398 | ---- | M] () -- C:\WINDOWS\tasks\ReclaimerUpdateXML_UR.job
[2013/07/01 04:44:19 | 000,000,402 | ---- | M] () -- C:\WINDOWS\tasks\ReclaimerUpdateFiles_UR.job
[2013/06/28 07:10:00 | 000,001,044 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2013/06/27 09:47:07 | 000,536,368 | ---- | M] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2013/06/27 06:11:25 | 000,000,039 | ---- | M] () -- C:\WINDOWS\hpmnwun.ini
[2013/06/27 05:50:50 | 000,000,272 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-553522983-733113839-4547331-1180.job
[2013/06/27 04:10:32 | 000,038,400 | ---- | M] () -- C:\Dokumente und Einstellungen\ur\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/06/26 10:15:56 | 000,001,878 | -H-- | M] () -- C:\Dokumente und Einstellungen\ur\Eigene Dateien\Default.rdp
[2013/06/26 07:15:58 | 000,002,513 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Microsoft Excel.lnk
[2013/06/26 05:38:34 | 000,207,856 | ---- | M] () -- C:\Dokumente und Einstellungen\ur\Desktop\stex_runline_1_1_beheizung.pdf
[2013/06/24 06:03:13 | 000,434,015 | ---- | M] () -- C:\Dokumente und Einstellungen\ur\Desktop\42806A-02.pdf
[2013/06/20 04:31:21 | 000,001,777 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk
[2013/06/17 02:46:46 | 000,002,477 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Microsoft Word.lnk
[2013/06/12 09:57:33 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/06/07 06:02:21 | 000,071,190 | ---- | M] () -- C:\Dokumente und Einstellungen\ur\Desktop\POOL 1.jpg
[2013/06/05 04:45:12 | 000,108,567 | ---- | M] () -- C:\Dokumente und Einstellungen\ur\Desktop\AG Modul 6 701478 - 701878 HM.pdf
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\Dokumente und Einstellungen\ur\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\ur\Desktop\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/07/02 06:13:34 | 000,001,599 | ---- | C] () -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Startmenü\Programme\Remoteunterstützung.lnk
[2013/07/02 06:13:34 | 000,001,351 | ---- | C] () -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Startmenü\Programme\Autostart\T-DSL Manager.lnk
[2013/07/02 06:13:34 | 000,000,772 | ---- | C] () -- C:\Dokumente und Einstellungen\ur.AIXTRON-2.002\Startmenü\Programme\Windows Media Player.lnk
[2013/07/02 05:27:25 | 000,000,786 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Trojan Remover.lnk
[2013/07/02 05:27:22 | 000,185,616 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar39.dll
[2013/07/02 05:27:22 | 000,169,744 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar36.dll
[2013/07/02 05:27:22 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\UNRAR3.dll
[2013/07/02 05:27:22 | 000,077,312 | ---- | C] () -- C:\WINDOWS\System32\ztvunace26.dll
[2013/07/02 05:27:22 | 000,075,264 | ---- | C] () -- C:\WINDOWS\System32\unacev2.dll
[2013/06/26 05:41:41 | 000,207,856 | ---- | C] () -- C:\Dokumente und Einstellungen\ur\Desktop\stex_runline_1_1_beheizung.pdf
[2013/06/24 06:05:28 | 000,434,015 | ---- | C] () -- C:\Dokumente und Einstellungen\ur\Desktop\42806A-02.pdf
[2013/06/17 05:46:08 | 000,000,408 | ---- | C] () -- C:\WINDOWS\tasks\RNUpgradeHelperLogonPrompt_UR.job
[2013/06/17 05:46:07 | 000,000,402 | ---- | C] () -- C:\WINDOWS\tasks\ReclaimerUpdateFiles_UR.job
[2013/06/17 05:46:06 | 000,000,398 | ---- | C] () -- C:\WINDOWS\tasks\ReclaimerUpdateXML_UR.job
[2013/06/07 06:02:21 | 000,071,190 | ---- | C] () -- C:\Dokumente und Einstellungen\ur\Desktop\POOL 1.jpg
[2013/06/05 04:49:17 | 000,108,567 | ---- | C] () -- C:\Dokumente und Einstellungen\ur\Desktop\AG Modul 6 701478 - 701878 HM.pdf
[2013/06/05 04:48:59 | 000,506,987 | ---- | C] () -- C:\Dokumente und Einstellungen\ur\Desktop\AG 701878 HM.pdf
[2013/04/14 21:01:09 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2013/04/14 21:01:09 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2013/04/14 21:01:09 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2013/02/07 23:03:08 | 002,816,504 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data
[2013/01/10 11:15:19 | 000,536,368 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012/06/05 09:44:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\mtstack16.INI
[2012/04/23 05:17:55 | 000,002,516 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys
[2012/04/23 05:17:55 | 000,000,088 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\5ACC70BB8E.sys
[2012/04/23 05:11:02 | 000,000,394 | ---- | C] () -- C:\WINDOWS\capture.ini
[2012/02/28 10:39:45 | 000,000,114 | ---- | C] () -- C:\WINDOWS\System32\BRLMW03A.INI
[2012/02/28 10:39:45 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\BRADM10A.DAT
[2012/02/28 10:39:44 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\BRTCPCON.DLL
[2012/02/16 04:52:55 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/09/16 05:54:48 | 000,030,568 | ---- | C] () -- C:\WINDOWS\MusiccityDownload.exe
[2011/09/16 05:54:44 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll
[2011/09/16 05:54:44 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2011/09/16 05:54:44 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2011/09/16 05:54:44 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll
[2010/11/08 06:55:53 | 000,000,218 | ---- | C] () -- C:\Dokumente und Einstellungen\ur\.recently-used.xbel
[2010/08/05 08:22:01 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\P17CPI.dll
[2010/08/05 08:21:59 | 000,064,512 | R--- | C] () -- C:\WINDOWS\System32\P17.dll
[2010/07/28 08:59:47 | 000,000,039 | ---- | C] () -- C:\WINDOWS\hpmnwun.ini
[2010/07/06 07:59:50 | 000,000,608 | -HS- | C] () -- C:\WINDOWS\System32\winzvprt5.sys
[2010/07/06 07:48:36 | 000,170,405 | ---- | C] () -- C:\WINDOWS\hppins08.dat
[2010/07/06 07:48:36 | 000,170,364 | ---- | C] () -- C:\WINDOWS\System32\hppins08.dat
[2010/07/06 07:48:36 | 000,001,116 | ---- | C] () -- C:\WINDOWS\hppmdl08.dat
[2010/07/06 07:48:18 | 000,000,316 | ---- | C] () -- C:\WINDOWS\hpbvspst.ini
[2010/07/06 07:47:31 | 000,000,685 | R--- | C] () -- C:\WINDOWS\System32\hppapr08.dat
[2010/01/19 04:44:28 | 000,000,011 | ---- | C] () -- C:\WINDOWS\NetWare.INI
[2008/02/14 04:34:11 | 000,001,142 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2007/10/04 06:16:37 | 000,038,400 | ---- | C] () -- C:\Dokumente und Einstellungen\ur\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/06/13 03:59:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI
[2007/06/12 07:11:13 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2007/06/12 07:02:02 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\adistres.dll
[2007/06/12 06:51:18 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/06/12 06:35:45 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\GAMSWrap.dll
[2007/06/12 06:35:45 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\NMASReg.exe
[2007/06/12 06:35:45 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\NMASWrap.dll
[2007/06/12 06:35:45 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\unclient.exe
[2007/06/12 06:35:35 | 000,456,080 | ---- | C] () -- C:\WINDOWS\System32\drivers\niciccs.sys
[2007/06/12 06:33:14 | 000,078,448 | ---- | C] () -- C:\WINDOWS\System32\bmnotify.dll
[2007/06/12 06:33:13 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ldapmethod.dll
[2007/06/12 06:33:13 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\vpnrst.exe
[2007/06/12 06:33:12 | 000,561,152 | ---- | C] () -- C:\WINDOWS\System32\vpnlogin.exe
[2007/06/12 06:33:12 | 000,253,952 | ---- | C] () -- C:\WINDOWS\System32\ikeapp.exe
[2007/06/12 06:33:12 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\vpnstats.exe
[2007/06/12 06:33:12 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\vpnext.dll
[2007/06/12 06:33:12 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\regvpn.exe
[2007/06/12 06:33:12 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\SlpDnsRestore.exe
[2007/06/12 06:03:10 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\prtwin32.dll
[2007/06/12 06:03:10 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\nwpsrv32.dll
[2007/06/12 06:03:08 | 000,216,064 | ---- | C] () -- C:\WINDOWS\System32\lgnwnt32.dll
[2007/06/12 06:03:02 | 000,002,757 | ---- | C] () -- C:\WINDOWS\System32\rdrstats.ini
[2007/06/12 06:02:54 | 000,015,898 | ---- | C] () -- C:\WINDOWS\System32\vlmsup.exe
[2007/06/12 06:02:54 | 000,001,724 | ---- | C] () -- C:\WINDOWS\System32\vipx.exe
[2007/06/12 06:02:53 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\setupw2k.dll
[2007/06/12 06:02:52 | 000,245,843 | ---- | C] () -- C:\WINDOWS\System32\nwshlxnt.dll
[2007/06/12 06:02:50 | 000,051,200 | ---- | C] () -- C:\WINDOWS\System32\lgncon32.dll
[2007/06/12 06:02:50 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\dplgnw32.dll
[2007/06/12 06:02:49 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\nwslog32.dll
[2007/06/12 06:02:49 | 000,012,736 | ---- | C] () -- C:\WINDOWS\System32\cmdinfo.exe
[2007/06/05 17:00:49 | 000,004,335 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2007/06/05 16:59:40 | 000,319,400 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2007/06/05 16:14:45 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2007/06/05 16:09:49 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2007/03/12 12:59:00 | 000,299,008 | ---- | C] () -- C:\Programme\navigram_register.exe
[2006/08/16 03:35:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/16 03:35:00 | 001,617,920 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2006/08/16 03:35:00 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006/08/16 03:35:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2006/08/16 03:35:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/08/16 03:35:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006/08/16 03:35:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006/08/16 03:35:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2006/08/16 03:35:00 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2006/08/16 03:35:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2006/02/28 08:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2006/02/28 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2006/02/28 08:00:00 | 000,442,114 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2006/02/28 08:00:00 | 000,426,498 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006/02/28 08:00:00 | 000,285,696 | ---- | C] () -- C:\WINDOWS\System32\srvsmem.exe.vir
[2006/02/28 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2006/02/28 08:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2006/02/28 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2006/02/28 08:00:00 | 000,077,854 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2006/02/28 08:00:00 | 000,065,508 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006/02/28 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2006/02/28 08:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2006/02/28 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2006/02/28 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2006/02/28 08:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2006/02/28 08:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2006/02/28 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2005/07/07 05:26:56 | 000,005,627 | R--- | C] () -- C:\WINDOWS\System32\Ludap17.ini
[2005/03/08 02:17:08 | 000,000,039 | R--- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2001/07/06 22:00:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
[2000/10/20 16:25:36 | 000,079,360 | ---- | C] () -- C:\WINDOWS\System32\acdbres.dll
 
========== LOP Check ==========
 
[2007/06/12 10:11:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HorstAdmin\Anwendungsdaten\Autodesk
[2007/06/12 07:00:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HorstAdmin\Anwendungsdaten\InterTrust
[2007/08/08 08:42:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\Autodesk
[2012/04/23 04:32:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\Babylon
[2012/04/24 05:02:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\BabylonToolbar
[2013/03/06 07:15:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\File Scout
[2012/09/25 10:58:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\IrfanView
[2011/10/26 08:14:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\Navigram
[2009/07/23 08:02:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\Nokia
[2011/06/07 07:58:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\PC Suite
[2013/01/07 04:37:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\PerformerSoft
[2012/10/11 04:40:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\ptc
[2010/11/08 06:54:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\RawTherapee
[2011/10/20 08:13:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\Samsung
[2013/07/02 05:27:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\Simply Super Software
[2007/08/08 08:53:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\T-DSL Manager
[2007/08/08 08:41:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ur\Anwendungsdaten\T-DSL SpeedManager
[2012/04/16 09:27:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ask
[2007/06/12 08:59:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Autodesk
[2012/04/23 04:32:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2012/04/23 05:13:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Borland
[2013/01/04 09:22:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IBUpdaterService
[2009/07/23 07:59:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2009/10/28 09:32:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2011/10/20 08:15:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Samsung
[2013/07/02 05:27:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Simply Super Software
[2007/08/08 08:53:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-DSL Manager
[2007/08/29 06:03:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-DSL SpeedManager
[2013/07/02 05:28:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2012/04/23 05:16:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WordPerfect Office X5
[2010/07/06 07:59:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\zvprt50
[2012/04/26 05:30:00 | 000,000,270 | ---- | M] () -- C:\WINDOWS\Tasks\PixillionReminder.job
[2013/07/01 04:44:19 | 000,000,402 | ---- | M] () -- C:\WINDOWS\Tasks\ReclaimerUpdateFiles_UR.job
[2013/07/01 05:44:19 | 000,000,398 | ---- | M] () -- C:\WINDOWS\Tasks\ReclaimerUpdateXML_UR.job
[2013/07/03 10:39:18 | 000,000,408 | ---- | M] () -- C:\WINDOWS\Tasks\RNUpgradeHelperLogonPrompt_UR.job
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2013/03/01 04:51:37 | 000,175,547 | ---- | C] ()(C:\Dokumente und Einstellungen\ur\Desktop\???????????.pdf.pdf.pdf) -- C:\Dokumente und Einstellungen\ur\Desktop\ヒータージャケット写真.pdf.pdf.pdf
[2013/03/01 04:50:41 | 000,175,547 | ---- | M] ()(C:\Dokumente und Einstellungen\ur\Desktop\???????????.pdf.pdf.pdf) -- C:\Dokumente und Einstellungen\ur\Desktop\ヒータージャケット写真.pdf.pdf.pdf
< End of report >

--- --- ---

02.07.2013, 13:41	#4
schrauber /// the machine /// TB-Ausbilder	MS DOS Aplikation / Trojaner durch Zip Datei eingefangen Ok __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

03.07.2013, 12:31	#8
schrauber /// the machine /// TB-Ausbilder	MS DOS Aplikation / Trojaner durch Zip Datei eingefangen Kannst normal booten? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

03.07.2013, 12:45	#10
schrauber /// the machine /// TB-Ausbilder	MS DOS Aplikation / Trojaner durch Zip Datei eingefangen Àlso du kommst bis nach dem Anmelden mit Passwort? Frisches FRST log aus der Recovery bitte. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

03.07.2013, 13:50	#12
schrauber /// the machine /// TB-Ausbilder	MS DOS Aplikation / Trojaner durch Zip Datei eingefangen Hi, bitte in codetags. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

03.07.2013, 14:13	#14
schrauber /// the machine /// TB-Ausbilder	MS DOS Aplikation / Trojaner durch Zip Datei eingefangen irgendwie fehlt da die Häfte vom Log __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

MS DOS Aplikation / Trojaner durch Zip Datei eingefangen

Plagegeister aller Art und deren Bekämpfung: MS DOS Aplikation / Trojaner durch Zip Datei eingefangen