Gelöst aber richtig?/ LPD (GVA) Trojaner auf XP mit Verhinderung abgesicherter Systemstart

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:25-05-2014 02
Ran by Harald Sahling (administrator) on INTELLISTATION1 on 27-05-2014 10:10:31
Running from C:\Dokumente und Einstellungen\Harald Sahling\Desktop
Platform: Microsoft Windows XP Service Pack 3 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Enigma Software Group USA, LLC.) C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(Acronis) C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Programme\Gemeinsame Dateien\Acronis\CDP\afcdpsrv.exe
(AVG Technologies CZ, s.r.o.) C:\Programme\AVG\AVG2014\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Programme\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) C:\Programme\Bonjour\mDNSResponder.exe
(Creative Technology Ltd) C:\WINDOWS\system32\CTSVCCDA.EXE
(Sun Microsystems, Inc.) C:\Programme\Java\jre6\bin\jqs.exe
(Microsoft Corporation) C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe
(Nero AG) C:\Programme\Nero\Update\NASvc.exe
(O&O Software GmbH) C:\WINDOWS\system32\oodag.exe
(AVG Technologies CZ, s.r.o.) C:\Programme\AVG\AVG2014\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Programme\AVG\AVG2014\avgemcx.exe
(Microsoft Corp.) C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(TeamViewer GmbH) C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe
(Microsoft Corporation) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE
(TeamViewer GmbH) C:\Programme\TeamViewer\Version7\TeamViewer.exe
(CANON INC.) C:\Programme\Canon\Memory Card Utility\iP6700D\PDUiP6700DMon.exe
(Creative Technology Ltd) C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
(Microsoft Corporation) C:\Programme\Microsoft IntelliType Pro\itype.exe
(Microsoft Corporation) C:\Programme\Microsoft IntelliPoint\ipoint.exe
(TeamViewer GmbH) C:\Programme\TeamViewer\Version7\tv_w32.exe
(Hewlett-Packard Company) C:\Programme\Gemeinsame Dateien\Hewlett-Packard\HP Device Communication Services\AppInterfaces\HPDeviceService.exe
(Hewlett-Packard Company) C:\Programme\Gemeinsame Dateien\Hewlett-Packard\HP Device Communication Services\AppInterfaces\HPDeviceHost.exe
(Microsoft Corporation) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVCM.EXE
() C:\Programme\DivX\DivX Update\DivXUpdate.exe
(Hewlett-Packard Company) C:\Programme\Hewlett-Packard\HP Easy Printer Care\HPPRun.exe
(EIZO NANAO CORPORATION) C:\Programme\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe
(Hewlett-Packard) C:\Programme\Hp\HP Software Update\hpwuschd2.exe
(Hewlett-Packard Company) C:\Programme\Gemeinsame Dateien\Hewlett-Packard\HP Printer Utility DCS\AppInterfaces\HPPUDS.exe
(Advanced Micro Devices Inc.) C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard Company) C:\Programme\Gemeinsame Dateien\Hewlett-Packard\HP Printer Utility DCS\AppInterfaces\HPPUDH.exe
(Hewlett-Packard Company) C:\Programme\Hewlett-Packard\HP Printer Utility\HPPU.exe
(Acronis) C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe
(Acronis) C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
(Adobe Systems Incorporated) C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
(Adobe Systems Inc.) C:\Programme\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
() C:\WINDOWS\system32\UMonit.exe
(Ask) C:\Programme\Ask.com\Updater\Updater.exe
(Samsung Electronics Co., Ltd.) C:\Programme\Samsung\AllShare\AllShareAgent.exe
() C:\Programme\Assmann\USB Device Server\Control Center.exe
(Microsoft Corp.) C:\Programme\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe
(AVG Technologies CZ, s.r.o.) C:\Programme\AVG\AVG2014\avgui.exe
(Enigma Software Group USA, LLC.) C:\Programme\Enigma Software Group\SpyHunter\SpyHunter4.exe
(ATI Technologies Inc.) C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(SlySoft, Inc.) C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe
(AMD) C:\Programme\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
(Akamai Technologies, Inc.) C:\Dokumente und Einstellungen\Harald Sahling\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe
(Hewlett-Packard Co.) C:\Programme\Hp\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
() C:\Dokumente und Einstellungen\Harald Sahling\Lokale Einstellungen\Anwendungsdaten\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
(Microsoft Corporation) C:\Programme\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Programme\Windows Live\Messenger\msnmsgr.exe
() C:\Programme\Datacolor\Spyder3Elite\Utility\Spyder3Utility.exe
(Microsoft Corporation) C:\Programme\Windows Desktop Search\WindowsSearch.exe
(Dropbox, Inc.) C:\Dokumente und Einstellungen\Harald Sahling\Anwendungsdaten\Dropbox\bin\Dropbox.exe
(Akamai Technologies, Inc.) C:\Dokumente und Einstellungen\Harald Sahling\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe
(Hewlett-Packard Co.) C:\Programme\Hp\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
(Microsoft Corporation) C:\Programme\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Programme\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Programme\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ATIPTA] => C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe [344064 2007-02-16] (ATI Technologies, Inc.)
HKLM\...\Run: [NWEReboot] => [X]
HKLM\...\Run: [PDUiP6700DMon] => C:\Programme\Canon\Memory Card Utility\iP6700D\PDUiP6700DMon.exe [61440 2006-03-16] (CANON INC.)
HKLM\...\Run: [Easy-PrintToolBox] => C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE [409600 2004-01-14] (CANON INC.)
HKLM\...\Run: [BluetoothAuthenticationAgent] => rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
HKLM\...\Run: [CTSysVol] => C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe [57344 2005-10-31] (Creative Technology Ltd)
HKLM\...\Run: [P17Helper] => C:\WINDOWS\system32\P17.dll [64512 2005-05-03] ()
HKLM\...\Run: [UpdReg] => C:\WINDOWS\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM\...\Run: [itype] => C:\Programme\Microsoft IntelliType Pro\itype.exe [576320 2006-07-08] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => C:\Programme\Microsoft IntelliPoint\ipoint.exe [600896 2006-07-08] (Microsoft Corporation)
HKLM\...\Run: [KnexStarter] => C:\Programme\Gemeinsame Dateien\Hewlett-Packard\HP Device Communication Services\Appinterfaces\HPDeviceService.exe [81920 2007-03-26] (Hewlett-Packard Company)
HKLM\...\Run: [HP Designjet Z3100 Photo Series] => C:\Programme\HP Designjet Z3100 Photo Series\Setup.exe [163840 2007-05-07] ()
HKLM\...\Run: [RunTasktray] => C:\Programme\Hewlett-Packard\HP Easy Printer Care\HPPRun.exe [69120 2007-03-26] (Hewlett-Packard Company)
HKLM\...\Run: [ScreenManager Pro for LCD] => C:\Programme\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe [10913320 2007-04-20] (EIZO NANAO CORPORATION)
HKLM\...\Run: [RegistryMechanic] => [X]
HKLM\...\Run: [FRYMXINS] => "C:\Programme\ATI Technologies\Fire GL 3D Studio Max\atiimxgl"
HKLM\...\Run: [KernelFaultCheck] => %systemroot%\system32\dumprep 0 -k
HKLM\...\Run: [HP Software Update] => C:\Programme\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [StartCCC] => C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2009-02-11] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [PUStarter] => C:\Programme\Gemeinsame Dateien\Hewlett-Packard\HP Printer Utility DCS\Appinterfaces\HPPUDS.exe [73728 2011-05-05] (Hewlett-Packard Company)
HKLM\...\Run: [RunPUTasktray] => C:\Programme\Hewlett-Packard\HP Printer Utility\HPPU.exe [68608 2011-05-05] (Hewlett-Packard Company)
HKLM\...\Run: [TrueImageMonitor.exe] => C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe [5957352 2011-08-05] (Acronis)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe [403592 2011-08-05] (Acronis)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Programme\Gemeinsame Dateien\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [SwitchBoard] => C:\Programme\Gemeinsame Dateien\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeCS5ServiceManager] => C:\Programme\Gemeinsame Dateien\Adobe\CS5ServiceManager\CS5ServiceManager.exe [402432 2010-07-22] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] => C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe Acrobat Speed Launcher] => C:\Programme\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-12-18] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] => C:\Programme\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-12-18] (Adobe Systems Inc.)
HKLM\...\Run: [UMonit] => C:\WINDOWS\system32\UMonit.exe [49152 2011-05-25] ()
HKLM\...\Run: [ApnUpdater] => C:\Programme\Ask.com\Updater\Updater.exe [1557160 2012-04-09] (Ask)
HKLM\...\Run: [NBAgent] => C:\Programme\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1485096 2011-07-15] (Nero AG)
HKLM\...\Run: [AllShareAgent] => C:\Programme\Samsung\AllShare\AllShareAgent.exe [285072 2012-03-02] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [KCodes UDS Control Center] => C:\Programme\Assmann\USB Device Server\Control Center.exe [4910592 2011-05-30] ()
HKLM\...\Run: [DivXMediaServer] => C:\Programme\DivX\DivX Media Server\DivXMediaServer.exe [450560 2014-02-14] (DivX, LLC)
HKLM\...\Run: [Bing Bar] => C:\Programme\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe [243544 2010-04-27] (Microsoft Corp.)
HKLM\...\Run: [Microsoft Default Manager] => C:\Programme\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [288088 2009-11-11] (Microsoft Corporation)
HKLM\...\Run: [AVG_UI] => C:\Programme\AVG\AVG2014\avgui.exe [5181456 2014-05-13] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [DivXUpdate] => C:\Programme\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] ()
HKLM\...\Run: [SpyHunter Security Suite] => C:\Programme\Enigma Software Group\SpyHunter\SpyHunter4.exe [6434176 2014-01-09] (Enigma Software Group USA, LLC.)
HKLM\...\Run: [AdobeCS6ServiceManager] => C:\Programme\Gemeinsame Dateien\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.)
HKU\S-1-5-21-1547161642-602162358-725345543-1003\...\Run: [AnyDVD] => C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe [6287008 2012-08-16] (SlySoft, Inc.)
HKU\S-1-5-21-1547161642-602162358-725345543-1003\...\Run: [HydraVisionDesktopManager] => C:\Programme\ATI Technologies\ATI HYDRAVISION\HydraDM.exe [368640 2007-07-25] (AMD)
HKU\S-1-5-21-1547161642-602162358-725345543-1003\...\Run: [Akamai NetSession Interface] => C:\Dokumente und Einstellungen\Harald Sahling\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-1547161642-602162358-725345543-1003\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Programme\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [1804648 2011-09-09] (Hewlett-Packard Co.)
HKU\S-1-5-21-1547161642-602162358-725345543-1003\...\Run: [AmazonMP3DownloaderHelper] => C:\Dokumente und Einstellungen\Harald Sahling\Lokale Einstellungen\Anwendungsdaten\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-1547161642-602162358-725345543-1003\...\Run: [WMPNSCFG] => C:\Programme\Windows Media Player\WMPNSCFG.exe [204288 2006-11-03] (Microsoft Corporation)
HKU\S-1-5-21-1547161642-602162358-725345543-1003\...\Run: [msnmsgr] => C:\Programme\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)
HKU\S-1-5-21-1547161642-602162358-725345543-1003\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1547161642-602162358-725345543-1003\...\Policies\Explorer: [NoDriveAutoRun] 0x00000000
HKU\S-1-5-21-1547161642-602162358-725345543-1003\...\MountPoints2: G - G:\TVCenterPro.exe -autorun
HKU\S-1-5-21-1547161642-602162358-725345543-1003\...\MountPoints2: {92de9e13-7bee-11dd-98d0-000d3aa379a4} - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL SanDisk-Games.exe
HKU\S-1-5-21-1547161642-602162358-725345543-1003\...\MountPoints2: {ee888388-2849-11dd-9667-000d3aa379a4} - G:\TVCenterPro.exe -autorun
Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Spyder3Utility.lnk
ShortcutTarget: Spyder3Utility.lnk -> C:\Programme\Datacolor\Spyder3Elite\Utility\Spyder3Utility.exe ()
Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Windows Search.lnk
ShortcutTarget: Windows Search.lnk -> C:\Programme\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)
Startup: C:\Dokumente und Einstellungen\Harald Sahling\Startmenü\Programme\Autostart\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Dokumente und Einstellungen\Harald Sahling\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Dokumente und Einstellungen\Harald Sahling\Startmenü\Programme\Autostart\explorer.lnk
ShortcutTarget: explorer.lnk -> c:\dokume~1\alluse~1\anwend~1\727081~1\hclg9dol.cpp (No File)
Startup: C:\Dokumente und Einstellungen\Harald Sahling\Startmenü\Programme\Autostart\PMCRemoteLauncher.lnk
ShortcutTarget: PMCRemoteLauncher.lnk -> C:\Dokumente und Einstellungen\Harald Sahling\Lokale Einstellungen\Anwendungsdaten\Pinnacle\TVC\Tools\PMCRemoteCtrl.exe (Pinnacle Systems)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = hxxp://search.avg.com/route/?d=4b3d2cf0&i=23&tp=chrome&q={searchTerms}&lng={language}&ychte=at&nt=1
BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - blank No File
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: EWPBrowseObject Class - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll ()
BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll (Microsoft Corporation)
BHO: Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
BHO: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
Toolbar: HKLM - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} -  No File
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM - @C:\Programme\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Programme\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll (Microsoft Corporation)
Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - &Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {A057A204-BACC-4D26-9990-79A187E2698E} -  No File
Toolbar: HKCU - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} -  No File
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} hxxp://www.ipix.com/viewers/ipixx.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {2DAD3559-2923-4935-AD49-B673D2539944} https://www-307.ibm.com/pc/support/access/aslibmain/content/AcpIR.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1176666679466
DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} https://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: HPDCS - {ba135f49-a12c-4e26-a2c4-6ea945999072} - C:\Programme\Gemeinsame Dateien\Hewlett-Packard\HP Device Communication Services\APP\hpdcsapp.dll (Hewlett-Packard Company)
Handler: hppfile - {C4E2084B-ED27-4893-A43D-488CA3F370E2} - C:\Programme\Hewlett-Packard\HP Easy Printer Care\HPPCtrls.dll (Hewlett-Packard Company)
Handler: hppsam - {C4E2084B-ED27-4893-A43D-488CA3F370E2} - C:\Programme\Hewlett-Packard\HP Easy Printer Care\HPPCtrls.dll (Hewlett-Packard Company)
Handler: HPPUDCS - {522CC7E5-F378-4F97-8BD7-125D17F5B332} - C:\Programme\Gemeinsame Dateien\Hewlett-Packard\HP Printer Utility DCS\APP\hplidcsapp.dll (Hewlett-Packard Company)
Handler: hppufile - {4BCA8E33-E18F-4358-9F6F-3C7206BCF72F} - C:\Programme\Hewlett-Packard\HP Printer Utility\hpluCtrls.dll (Hewlett-Packard Company)
Handler: hppusam - {4BCA8E33-E18F-4358-9F6F-3C7206BCF72F} - C:\Programme\Hewlett-Packard\HP Printer Utility\hpluCtrls.dll (Hewlett-Packard Company)
Handler: hppuzip - {4BCA8E33-E18F-4358-9F6F-3C7206BCF72F} - C:\Programme\Hewlett-Packard\HP Printer Utility\hpluCtrls.dll (Hewlett-Packard Company)
Handler: hppzip - {C4E2084B-ED27-4893-A43D-488CA3F370E2} - C:\Programme\Hewlett-Packard\HP Easy Printer Care\HPPCtrls.dll (Hewlett-Packard Company)
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\System32\msvidctl.dll (Microsoft Corporation)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - blank No File
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
ShellExecuteHooks: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll [304128 2009-05-24] (Microsoft Corporation)
Winsock: Catalog5 05 C:\Programme\Bonjour\mdnsNSP.dll [147456] (Apple Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138

FireFox:
========
FF Plugin: @divx.com/DivX Content Upload Plugin,version=1.0.0 - C:\Programme\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Programme\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @java.com/JavaPlugin - C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Programme\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @Microsoft.com/NpWinExt,version=5.0 - C:\Programme\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @Nero.com/KM - C:\PROGRA~1\GEMEIN~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin: @viewpoint.com/VMP - C:\Programme\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()
FF Plugin: Adobe Acrobat - C:\Programme\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Dokumente und Einstellungen\Harald Sahling\Lokale Einstellungen\Anwendungsdaten\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Dokumente und Einstellungen\Harald Sahling\Lokale Einstellungen\Anwendungsdaten\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [jqs@sun.com] - C:\Programme\Java\jre6\lib\deploy\jqs\ff
FF Extension: Java Quick Starter - C:\Programme\Java\jre6\lib\deploy\jqs\ff [2009-07-07]
FF HKLM\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Programme\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Programme\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012-08-20]
FF HKLM\...\Firefox\Extensions: [msntoolbar@msn.com] - C:\Programme\MSN Toolbar\Platform\5.0.1449.0\Firefox
FF Extension: Bing Bar - C:\Programme\MSN Toolbar\Platform\5.0.1449.0\Firefox [2013-07-24]

========================== Services (Whitelisted) =================

R2 AcrSch2Svc; C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe [809192 2011-08-05] (Acronis)
R2 afcdpsrv; C:\Programme\Gemeinsame Dateien\Acronis\CDP\afcdpsrv.exe [3442640 2012-06-24] (Acronis)
R2 avgfws; C:\Programme\AVG\AVG2014\avgfws.exe [1473792 2014-05-13] (AVG Technologies CZ, s.r.o.)
S2 AVGIDSAgent; C:\Programme\AVG\AVG2014\avgidsagent.exe [3644432 2014-05-13] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Programme\AVG\AVG2014\avgwdsvc.exe [292424 2014-05-13] (AVG Technologies CZ, s.r.o.)
R2 Bonjour Service; C:\Programme\Bonjour\mDNSResponder.exe [238888 2008-08-29] (Apple Inc.)
R2 Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.exe [44032 1999-12-13] (Creative Technology Ltd)
S3 fsssvc; C:\Programme\Windows Live\Family Safety\fsssvc.exe [704872 2010-04-28] (Microsoft Corporation)
R3 hpqcxs08; C:\Programme\HP\Digital Imaging\bin\hpqcxs08.dll [254824 2010-05-28] (Hewlett-Packard Co.)
R2 hpqddsvc; C:\Programme\HP\Digital Imaging\bin\hpqddsvc.dll [138600 2010-05-28] (Hewlett-Packard Co.)
R2 HPSLPSVC; C:\Programme\HP\Digital Imaging\bin\HPSLPSVC32.DLL [701288 2010-05-28] (Hewlett-Packard Co.)
S3 IDriverT; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation)
R2 JavaQuickStarterService; C:\Programme\Java\jre6\bin\jqs.exe [153376 2011-10-03] (Sun Microsystems, Inc.)
R2 MDM; C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation)
R2 NAUpdate; C:\Programme\Nero\Update\NASvc.exe [690472 2011-07-22] (Nero AG)
R2 O&O Defrag; C:\WINDOWS\system32\oodag.exe [225280 2005-05-11] (O&O Software GmbH)
S3 odserv; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [440696 2011-07-20] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
S2 SamsungAllShareV2.0; C:\Programme\Samsung\AllShare\AllShareDMS\AllShareDMS.exe [25504 2012-03-02] (Samsung Electronics Co., Ltd.)
R2 SeaPort; C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [226656 2009-01-14] (Microsoft Corp.)
S3 SimpleSlideShowServer; C:\Programme\Samsung\AllShare\AllShareSlideShowService.exe [27584 2012-03-02] (Samsung Electronics Co., Ltd.)
R2 SpyHunter 4 Service; C:\Programme\Enigma Software Group\SpyHunter\SH4Service.exe [770432 2014-01-09] (Enigma Software Group USA, LLC.)
S3 SwitchBoard; C:\Programme\Gemeinsame Dateien\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
S2 syncagentsrv; C:\Programme\Gemeinsame Dateien\Acronis\SyncAgent\syncagentsrv.exe [6495504 2011-08-05] (Acronis)
R2 TeamViewer7; C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe [2849120 2013-02-22] (TeamViewer GmbH)
R2 wlidsvc; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE [1529728 2009-08-18] (Microsoft Corporation)
R2 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [121208 2012-05-02] (SlySoft, Inc.)
R3 AssmannUDSMBus; C:\WINDOWS\System32\Drivers\AssmannUDSMBus.sys [86912 2011-05-06] (Windows (R) Codename Longhorn DDK provider)
S3 AssmannUDSTcpBus; C:\WINDOWS\System32\Drivers\AssmannUDSTcpBus.sys [139648 2011-05-06] (Windows (R) Codename Longhorn DDK provider)
R1 Avgdiskx; C:\WINDOWS\System32\DRIVERS\avgdiskx.sys [122136 2014-05-13] (AVG Technologies CZ, s.r.o.)
R3 Avgfwdx; C:\WINDOWS\System32\DRIVERS\avgfwdx.sys [30944 2012-01-12] (AVG Technologies CZ, s.r.o.)
S3 Avgfwfd; C:\WINDOWS\System32\DRIVERS\avgfwdx.sys [30944 2012-01-12] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\WINDOWS\System32\DRIVERS\avgidsdriverx.sys [198936 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\WINDOWS\System32\DRIVERS\avgidshx.sys [149784 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\WINDOWS\System32\DRIVERS\avgidsshimx.sys [21272 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\WINDOWS\System32\DRIVERS\avgldx86.sys [192280 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\WINDOWS\System32\DRIVERS\avglogx.sys [237848 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\WINDOWS\System32\DRIVERS\avgmfx86.sys [107288 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\WINDOWS\System32\DRIVERS\avgrkx86.sys [27416 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\WINDOWS\System32\DRIVERS\avgtdix.sys [210200 2014-05-13] (AVG Technologies CZ, s.r.o.)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
S3 cvspydr2; C:\WINDOWS\System32\DRIVERS\cvspydr2.sys [33024 2002-04-02] (Colorvision Inc)
R1 ElbyCDIO; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [31088 2010-12-17] (Elaborate Bytes AG)
R3 esgiguard; C:\Programme\Enigma Software Group\SpyHunter\esgiguard.sys [12288 2014-01-07] ()
S3 EsgScanner; C:\WINDOWS\System32\DRIVERS\EsgScanner.sys [19984 2012-06-22] ()
R2 fssfltr; C:\WINDOWS\System32\DRIVERS\fssfltr_tdi.sys [54760 2010-04-28] (Microsoft Corporation)
S3 GeneStor; C:\WINDOWS\System32\DRIVERS\GeneStor.sys [54784 2011-05-18] (GenesysLogic)
S3 HPZid412; C:\WINDOWS\System32\DRIVERS\HPZid412.sys [49920 2010-02-01] (HP)
S3 HPZipr12; C:\WINDOWS\System32\DRIVERS\HPZipr12.sys [16496 2010-02-01] (HP)
S3 HPZius12; C:\WINDOWS\System32\DRIVERS\HPZius12.sys [21568 2010-02-01] (HP)
S3 ivusb; C:\WINDOWS\System32\DRIVERS\ivusb.sys [25112 2010-07-29] (Initio Corporation)
R3 mod7700; C:\WINDOWS\System32\Drivers\mod7700.sys [554240 2007-12-11] (DiBcom SA)
R3 MODRC; C:\WINDOWS\System32\DRIVERS\modrc.sys [13824 2007-11-09] (DiBcom S.A.)
S3 MPE; C:\WINDOWS\System32\DRIVERS\MPE.sys [15232 2008-04-13] (Microsoft Corporation)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
R3 P17; C:\WINDOWS\System32\drivers\P17.sys [1389056 2005-07-07] (Creative Technology Ltd.)
S3 scsiscan; C:\WINDOWS\System32\DRIVERS\scsiscan.sys [11520 2008-04-13] (Microsoft Corporation)
R0 SI3124r; C:\WINDOWS\System32\DRIVERS\SI3124R.sys [100881 2004-02-03] (Silicon Image, Inc)
R0 Si3124r5; C:\WINDOWS\System32\DRIVERS\Si3124r5.sys [207152 2006-09-20] (Silicon Image, Inc)
R0 SiFilter; C:\WINDOWS\System32\DRIVERS\SiWinAcc.sys [17328 2006-07-13] (Silicon Image, Inc.)
S3 Spyder3; C:\WINDOWS\System32\DRIVERS\Spyder3.sys [12288 2007-12-12] ()
R0 symmpi; C:\WINDOWS\System32\drivers\symmpi.sys [37760 2003-05-23] (LSI Logic)
R0 tdrpman; C:\WINDOWS\System32\DRIVERS\tdrpman.sys [766208 2012-06-24] (Acronis)
R0 vididr; C:\WINDOWS\System32\DRIVERS\vididr.sys [126112 2012-06-24] (Acronis)
R0 vidsflt58; C:\WINDOWS\System32\DRIVERS\vsflt58.sys [84512 2012-06-24] (Acronis)
S4 hpt3xx; No ImagePath
S4 IntelIde; No ImagePath
S3 Pcouffin; System32\Drivers\Pcouffin.sys [X]
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
U5 Tcpip6; C:\Windows\System32\Drivers\Tcpip6.sys [226880 2010-02-11] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-27 10:10 - 2014-05-27 10:10 - 00033862 _____ () C:\Dokumente und Einstellungen\Harald Sahling\Desktop\FRST.txt
2014-05-27 10:10 - 2014-05-27 10:10 - 00000000 ____D () C:\FRST
2014-05-27 10:09 - 2014-05-27 10:09 - 01056256 _____ (Farbar) C:\Dokumente und Einstellungen\Harald Sahling\Desktop\FRST.exe
2014-05-26 19:35 - 2011-07-13 04:55 - 02237440 ____R (OldTimer Tools) C:\OTLPE.exe
2014-05-26 19:34 - 2014-05-26 19:34 - 00003044 _____ () C:\05262014_133017.log
2014-05-26 19:30 - 2014-05-26 19:30 - 00000000 ____D () C:\_OTL
2014-05-26 18:58 - 2014-05-26 18:58 - 00104104 _____ () C:\Dokumente und Einstellungen\Harald Sahling\Desktop\OTL.txt
2014-05-26 18:52 - 2014-05-26 21:06 - 00103858 _____ () C:\OTL.Txt
2014-05-26 17:52 - 2014-05-26 17:52 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling\Anwendungsdaten\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2014-05-26 17:52 - 2014-05-26 17:52 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Adobe
2014-05-26 17:32 - 2014-05-26 17:32 - 00001203 _____ () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Illustrator CS6.lnk
2014-05-26 17:32 - 2014-05-26 17:32 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ALM
2014-05-26 17:31 - 2014-05-26 17:31 - 00000788 _____ () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Bridge CS6.lnk
2014-05-26 17:29 - 2014-05-26 17:29 - 00001116 _____ () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe ExtendScript Toolkit CS6.lnk
2014-05-26 17:29 - 2014-05-26 17:29 - 00000972 _____ () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Extension Manager CS6.lnk
2014-05-26 17:28 - 2014-05-26 17:28 - 00000708 _____ () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Help.lnk
2014-05-26 16:39 - 2014-05-26 16:39 - 00068220 ____H () C:\WINDOWS\system32\mlfcache.dat
2014-05-26 16:34 - 2014-05-26 16:34 - 00000000 ___HD () C:\WINDOWS\PIF
2014-05-26 15:51 - 2014-05-26 15:51 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling\Anwendungsdaten\TuneUp Software
2014-05-26 15:51 - 2014-05-26 15:51 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\AVG
2014-05-26 15:17 - 2014-05-26 15:17 - 00000341 _____ () C:\Dokumente und Einstellungen\Harald Sahling\Desktop\TVCenter Pro.lnk
2014-05-26 13:46 - 2014-05-26 13:52 - 00003831 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-4048-F.txt
2014-05-26 13:39 - 2014-05-26 13:41 - 00001195 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-3916-F.txt
2014-05-26 11:11 - 2014-05-26 11:35 - 00013688 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-2256-F.txt
2014-05-26 10:55 - 2014-05-26 10:56 - 00000472 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-3792-F.txt
2014-05-26 10:43 - 2014-05-26 10:52 - 00005209 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-3860-F.txt
2014-05-26 10:28 - 2014-05-26 10:33 - 00003180 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-3976-F.txt
2014-05-26 10:12 - 2014-05-26 10:19 - 00004082 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-1640-F.txt
2014-05-26 10:07 - 2014-05-26 10:10 - 00001741 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-1784-F.txt
2014-05-26 10:01 - 2014-05-26 10:04 - 00001679 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-4024-F.txt
2014-05-26 09:55 - 2014-05-26 09:55 - 00000236 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-3864-F.txt
2014-05-26 09:51 - 2014-05-26 09:52 - 00000951 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-588-F.txt
2014-05-26 09:48 - 2014-05-26 09:48 - 00000000 __SHD () C:\WINDOWS\CSC
2014-05-26 09:46 - 2014-05-26 09:46 - 00000236 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-1792-F.txt
2014-05-26 09:39 - 2014-05-26 09:41 - 00000786 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-840-F.txt
2014-05-26 09:27 - 2014-05-26 09:36 - 00005150 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-3928-F.txt
2014-05-26 09:23 - 2014-05-26 09:23 - 00000353 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-37456-F.txt
2014-05-26 09:19 - 2014-05-26 21:09 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\72708163A29C273D7EF0E798417733CC
2014-05-16 08:10 - 2014-05-16 08:20 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling\Desktop\Steidl
2014-05-14 03:03 - 2014-05-14 03:03 - 00000000 ____D () C:\Programme\Gemeinsame Dateien\DESIGNER
2014-05-13 14:19 - 2014-05-13 14:19 - 00192280 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgldx86.sys
2014-05-13 14:17 - 2014-05-13 14:17 - 00122136 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgdiskx.sys
2014-05-13 14:17 - 2014-05-13 14:17 - 00107288 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgmfx86.sys
2014-05-13 14:09 - 2014-05-13 14:09 - 00198936 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgidsdriverx.sys
2014-05-13 14:04 - 2014-05-13 14:04 - 00027416 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgrkx86.sys
2014-05-13 14:04 - 2014-05-13 14:04 - 00021272 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgidsshimx.sys
2014-05-03 03:00 - 2014-05-03 03:01 - 00007027 _____ () C:\WINDOWS\KB2964358-IE8.log

==================== One Month Modified Files and Folders =======

2014-05-27 10:11 - 2012-10-11 19:18 - 00000244 _____ () C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
2014-05-27 10:10 - 2014-05-27 10:10 - 00033862 _____ () C:\Dokumente und Einstellungen\Harald Sahling\Desktop\FRST.txt
2014-05-27 10:10 - 2014-05-27 10:10 - 00000000 ____D () C:\FRST
2014-05-27 10:10 - 2012-11-13 20:06 - 00000448 _____ () C:\WINDOWS\Tasks\At1.job
2014-05-27 10:09 - 2014-05-27 10:09 - 01056256 _____ (Farbar) C:\Dokumente und Einstellungen\Harald Sahling\Desktop\FRST.exe
2014-05-27 10:03 - 2012-05-08 23:19 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MFAData
2014-05-27 09:24 - 2012-04-12 21:08 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-05-27 09:21 - 2007-04-15 20:57 - 00032506 _____ () C:\WINDOWS\SchedLgU.Txt
2014-05-27 03:00 - 2007-04-15 21:51 - 01462775 _____ () C:\WINDOWS\WindowsUpdate.log
2014-05-27 02:00 - 2012-06-25 23:18 - 00000364 _____ () C:\WINDOWS\Tasks\AdobeAAMUpdater-1.0-INTELLISTATION1-Harald Sahling.job
2014-05-26 21:09 - 2014-05-26 09:19 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\72708163A29C273D7EF0E798417733CC
2014-05-26 21:06 - 2014-05-26 18:52 - 00103858 _____ () C:\OTL.Txt
2014-05-26 20:40 - 2012-11-13 20:06 - 00000448 _____ () C:\WINDOWS\Tasks\At2.job
2014-05-26 19:34 - 2014-05-26 19:34 - 00003044 _____ () C:\05262014_133017.log
2014-05-26 19:30 - 2014-05-26 19:30 - 00000000 ____D () C:\_OTL
2014-05-26 19:19 - 2007-04-15 20:37 - 00000335 _____ () C:\WINDOWS\wiadebug.log
2014-05-26 19:06 - 2012-11-13 20:06 - 00000448 _____ () C:\WINDOWS\Tasks\At3.job
2014-05-26 18:58 - 2014-05-26 18:58 - 00104104 _____ () C:\Dokumente und Einstellungen\Harald Sahling\Desktop\OTL.txt
2014-05-26 18:13 - 2009-05-08 18:58 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling\Eigene Dateien\Eigene Scans
2014-05-26 17:52 - 2014-05-26 17:52 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling\Anwendungsdaten\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2014-05-26 17:52 - 2014-05-26 17:52 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Adobe
2014-05-26 17:52 - 2007-04-16 21:03 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling\Anwendungsdaten\Adobe
2014-05-26 17:51 - 2013-07-08 21:45 - 00085600 _____ () C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT
2014-05-26 17:34 - 2012-06-25 23:09 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\regid.1986-12.com.adobe
2014-05-26 17:32 - 2014-05-26 17:32 - 00001203 _____ () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Illustrator CS6.lnk
2014-05-26 17:32 - 2014-05-26 17:32 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ALM
2014-05-26 17:32 - 2007-04-15 20:34 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2014-05-26 17:31 - 2014-05-26 17:31 - 00000788 _____ () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Bridge CS6.lnk
2014-05-26 17:31 - 2007-04-16 20:58 - 00000000 ____D () C:\Programme\Gemeinsame Dateien\Adobe
2014-05-26 17:31 - 2007-04-16 20:58 - 00000000 ____D () C:\Programme\Adobe
2014-05-26 17:29 - 2014-05-26 17:29 - 00001116 _____ () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe ExtendScript Toolkit CS6.lnk
2014-05-26 17:29 - 2014-05-26 17:29 - 00000972 _____ () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Extension Manager CS6.lnk
2014-05-26 17:29 - 2007-04-16 20:58 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe
2014-05-26 17:28 - 2014-05-26 17:28 - 00000708 _____ () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Help.lnk
2014-05-26 16:41 - 2013-09-26 16:15 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling\Lokale Einstellungen\Anwendungsdaten\Avg2014
2014-05-26 16:39 - 2014-05-26 16:39 - 00068220 ____H () C:\WINDOWS\system32\mlfcache.dat
2014-05-26 16:37 - 2007-04-16 21:04 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling\Lokale Einstellungen\Anwendungsdaten\Adobe
2014-05-26 16:34 - 2014-05-26 16:34 - 00000000 ___HD () C:\WINDOWS\PIF
2014-05-26 16:34 - 2010-10-15 03:30 - 00994550 _____ () C:\WINDOWS\setupapi.log
2014-05-26 16:29 - 2014-02-06 13:07 - 00000000 ___RD () C:\Dokumente und Einstellungen\Harald Sahling\Eigene Dateien\Dropbox
2014-05-26 16:29 - 2014-02-06 13:06 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling\Anwendungsdaten\DropboxMaster
2014-05-26 16:29 - 2014-02-06 13:04 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling\Anwendungsdaten\Dropbox
2014-05-26 16:29 - 2014-01-02 09:54 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling\Tracing
2014-05-26 16:26 - 2014-04-06 21:17 - 00000240 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP –  Benachrichtigung – Anmeldung.job
2014-05-26 16:26 - 2013-01-30 20:05 - 00000334 _____ () C:\WINDOWS\Tasks\ROC_PAID_JAN2013_TB_rmv.job
2014-05-26 16:26 - 2013-01-25 09:49 - 00000334 _____ () C:\WINDOWS\Tasks\ROC_JAN2013_TB_rmv.job
2014-05-26 16:26 - 2007-04-15 20:37 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2014-05-26 16:26 - 2007-04-15 19:51 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-05-26 16:26 - 2001-08-23 14:00 - 00012598 _____ () C:\WINDOWS\system32\wpa.dbl
2014-05-26 16:25 - 2007-09-04 12:12 - 00150738 _____ () C:\WINDOWS\system32\OODBS.lor
2014-05-26 16:24 - 2009-10-31 14:13 - 00393216 _____ () C:\WINDOWS\system32\config\ACEEvent.evt
2014-05-26 16:24 - 2007-04-15 20:58 - 00000300 ___SH () C:\Dokumente und Einstellungen\Harald Sahling\ntuser.ini
2014-05-26 16:14 - 2007-04-15 20:58 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling
2014-05-26 16:13 - 2012-05-07 23:55 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling\Anwendungsdaten\uTorrent
2014-05-26 15:51 - 2014-05-26 15:51 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling\Anwendungsdaten\TuneUp Software
2014-05-26 15:51 - 2014-05-26 15:51 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\AVG
2014-05-26 15:49 - 2014-04-07 08:57 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\AVG Eigenständige Version von Link Scanner
2014-05-26 15:49 - 2013-09-26 16:17 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG2014
2014-05-26 15:17 - 2014-05-26 15:17 - 00000341 _____ () C:\Dokumente und Einstellungen\Harald Sahling\Desktop\TVCenter Pro.lnk
2014-05-26 13:52 - 2014-05-26 13:46 - 00003831 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-4048-F.txt
2014-05-26 13:41 - 2014-05-26 13:39 - 00001195 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-3916-F.txt
2014-05-26 13:39 - 2007-04-15 20:58 - 00000000 ___RD () C:\Dokumente und Einstellungen\Harald Sahling\Startmenü\Programme\Autostart
2014-05-26 11:35 - 2014-05-26 11:11 - 00013688 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-2256-F.txt
2014-05-26 11:22 - 2014-02-06 13:07 - 00001075 _____ () C:\Dokumente und Einstellungen\Harald Sahling\Desktop\Dropbox.lnk
2014-05-26 11:22 - 2014-02-06 13:06 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling\Startmenü\Programme\Dropbox
2014-05-26 10:56 - 2014-05-26 10:55 - 00000472 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-3792-F.txt
2014-05-26 10:52 - 2014-05-26 10:43 - 00005209 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-3860-F.txt
2014-05-26 10:33 - 2014-05-26 10:28 - 00003180 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-3976-F.txt
2014-05-26 10:19 - 2014-05-26 10:12 - 00004082 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-1640-F.txt
2014-05-26 10:10 - 2014-05-26 10:07 - 00001741 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-1784-F.txt
2014-05-26 10:08 - 2014-04-14 18:08 - 00001971 _____ () C:\Dokumente und Einstellungen\Harald Sahling\Desktop\SpyHunter.lnk
2014-05-26 10:04 - 2014-05-26 10:01 - 00001679 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-4024-F.txt
2014-05-26 09:55 - 2014-05-26 09:55 - 00000236 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-3864-F.txt
2014-05-26 09:52 - 2014-05-26 09:51 - 00000951 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-588-F.txt
2014-05-26 09:48 - 2014-05-26 09:48 - 00000000 __SHD () C:\WINDOWS\CSC
2014-05-26 09:46 - 2014-05-26 09:46 - 00000236 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-1792-F.txt
2014-05-26 09:41 - 2014-05-26 09:39 - 00000786 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-840-F.txt
2014-05-26 09:36 - 2014-05-26 09:27 - 00005150 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-3928-F.txt
2014-05-26 09:23 - 2014-05-26 09:23 - 00000353 _____ () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RUNDLL32.EXE-37456-F.txt
2014-05-25 14:00 - 2012-11-13 20:06 - 00000448 _____ () C:\WINDOWS\Tasks\At4.job
2014-05-21 09:37 - 2013-09-26 16:23 - 00000698 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\AVG 2014.lnk
2014-05-18 18:25 - 2010-09-18 00:51 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling\Anwendungsdaten\FileZilla
2014-05-16 08:35 - 2007-04-16 07:37 - 00108346 ____C () C:\WINDOWS\wmsetup.log
2014-05-16 08:20 - 2014-05-16 08:10 - 00000000 ____D () C:\Dokumente und Einstellungen\Harald Sahling\Desktop\Steidl
2014-05-14 03:12 - 2010-11-12 21:48 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft Help
2014-05-14 03:10 - 2013-08-15 03:51 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-05-14 03:04 - 2007-04-16 08:12 - 90547776 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-05-14 03:03 - 2014-05-14 03:03 - 00000000 ____D () C:\Programme\Gemeinsame Dateien\DESIGNER
2014-05-13 14:19 - 2014-05-13 14:19 - 00192280 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgldx86.sys
2014-05-13 14:17 - 2014-05-13 14:17 - 00122136 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgdiskx.sys
2014-05-13 14:17 - 2014-05-13 14:17 - 00107288 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgmfx86.sys
2014-05-13 14:17 - 2013-09-02 10:28 - 00237848 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avglogx.sys
2014-05-13 14:17 - 2012-04-19 04:50 - 00149784 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgidshx.sys
2014-05-13 14:17 - 2012-03-19 05:17 - 00210200 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgtdix.sys
2014-05-13 14:09 - 2014-05-13 14:09 - 00198936 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgidsdriverx.sys
2014-05-13 14:04 - 2014-05-13 14:04 - 00027416 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgrkx86.sys
2014-05-13 14:04 - 2014-05-13 14:04 - 00021272 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgidsshimx.sys
2014-05-11 15:01 - 2014-04-06 21:17 - 00000234 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Monatliche Benachrichtigung.job
2014-05-09 11:46 - 2010-06-24 00:01 - 00128512 __SHC () C:\Dokumente und Einstellungen\Harald Sahling\Desktop\Thumbs.db
2014-05-03 03:01 - 2014-05-03 03:00 - 00007027 _____ () C:\WINDOWS\KB2964358-IE8.log
2014-05-03 03:01 - 2010-04-01 09:24 - 00000000 ____D () C:\WINDOWS\ie8updates
2014-05-03 03:01 - 2007-04-17 03:00 - 00479346 ____C () C:\WINDOWS\updspapi.log
2014-05-03 03:01 - 2007-04-16 07:39 - 00554894 _____ () C:\WINDOWS\netfxocm.log
2014-05-03 03:01 - 2007-04-16 07:39 - 00159127 _____ () C:\WINDOWS\tabletoc.log
2014-05-03 03:01 - 2007-04-16 07:37 - 00220966 _____ () C:\WINDOWS\medctroc.Log
2014-05-03 03:01 - 2007-04-15 20:35 - 03282451 _____ () C:\WINDOWS\FaxSetup.log
2014-05-03 03:01 - 2007-04-15 20:35 - 01595741 _____ () C:\WINDOWS\iis6.log
2014-05-03 03:01 - 2007-04-15 20:35 - 01574605 _____ () C:\WINDOWS\ocgen.log
2014-05-03 03:01 - 2007-04-15 20:35 - 01506048 _____ () C:\WINDOWS\tsoc.log
2014-05-03 03:01 - 2007-04-15 20:35 - 01037230 _____ () C:\WINDOWS\comsetup.log
2014-05-03 03:01 - 2007-04-15 20:35 - 01003604 _____ () C:\WINDOWS\msmqinst.log
2014-05-03 03:01 - 2007-04-15 20:35 - 00629785 _____ () C:\WINDOWS\ntdtcsetup.log
2014-05-03 03:01 - 2007-04-15 20:35 - 00171380 _____ () C:\WINDOWS\ocmsn.log
2014-05-03 03:01 - 2007-04-15 20:35 - 00164675 _____ () C:\WINDOWS\msgsocm.log
2014-05-03 03:01 - 2007-04-15 20:35 - 00001355 _____ () C:\WINDOWS\imsins.log
2014-04-30 10:13 - 2007-01-04 15:40 - 06022144 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mshtml.dll
2014-04-30 10:13 - 2004-09-29 10:03 - 06022144 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

Files to move or delete:
====================
C:\Windows\Tasks\At1.job
C:\Windows\Tasks\At2.job
C:\Windows\Tasks\At3.job
C:\Windows\Tasks\At4.job


Some content of TEMP:
====================
C:\Dokumente und Einstellungen\Harald Sahling\Lokale Einstellungen\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp68mvgz.dll


==================== Bamital & volsnap Check =================

C:\WINDOWS\explorer.exe
[2001-08-23 14:00] - [2008-04-14 04:22] - 1036800 ____A (Microsoft Corporation) 418045a93cd87a352098ab7dabe1b53e 

C:\WINDOWS\system32\winlogon.exe
[2001-08-23 14:00] - [2008-04-14 04:23] - 0513024 ____A (Microsoft Corporation) f09a527b422e25c478e38caa0e44417a 

C:\WINDOWS\system32\svchost.exe
[2001-08-23 14:00] - [2008-04-14 04:23] - 0014336 ____A (Microsoft Corporation) 4fbc75b74479c7a6f829e0ca19df3366 

C:\WINDOWS\system32\services.exe
[2001-08-23 14:00] - [2009-02-09 13:21] - 0111104 ____A (Microsoft Corporation) a3edbe9053889fb24ab22492472b39dc 

C:\WINDOWS\system32\User32.dll
[2001-08-23 14:00] - [2008-04-14 04:22] - 0580096 ____A (Microsoft Corporation) b0050cc5340e3a0760dd8b417ff7aebd 

C:\WINDOWS\system32\userinit.exe
[2001-08-23 14:00] - [2008-04-14 04:23] - 0026624 ____A (Microsoft Corporation) 788f95312e26389d596c0fa55834e106 

C:\WINDOWS\system32\rpcss.dll
[2007-04-16 03:04] - [2009-02-09 12:51] - 0401408 ____A (Microsoft Corporation) 3127afbf2c1ed0ab14a1bbb7aaecb85b 

 ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.
C:\WINDOWS\system32\Drivers\volsnap.sys
[2001-08-23 14:00] - [2008-04-14 03:52] - 0053760 ____A (Microsoft Corporation) a5a712f4e880874a477af790b5186e1d 


==================== End Of Log ============================