Hallo Member des Trojaner Boards

Ich habe ein Problem, mit einem unten rechts immer wieder aufgehenden popup Fenster es wird Werbung angezeigt, es nervt halt.

Was habe ich unternommen.
Malwarebytes Anti-Malware installiert aktualisiert
Quick-scan durchgeführt

nix bedrohliches gefunden

und Gmer das Programm konnte nicht komplett ausgeführt werden, da mein Rechner auf einmal einen bluescreen Bildschirm anzeigte und der Rechner neu hochfuhr.

folgende Auswertung konnte ich noch sichern
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-05-11 20:57:22
Windows 5.1.2600 Service Pack 3
Running: 7imxn6n6.exe; Driver: C:\DOKUME~1\Lippert\LOKALE~1\Temp\uxtdapow.sys


---- System - GMER 1.0.15 ----

SSDT A8244316 ZwCreateKey
SSDT A824430C ZwCreateThread
SSDT A824431B ZwDeleteKey
SSDT A8244325 ZwDeleteValueKey
SSDT A824432A ZwLoadKey
SSDT A82442F8 ZwOpenProcess
SSDT A82442FD ZwOpenThread
SSDT A8244334 ZwReplaceKey
SSDT A824432F ZwRestoreKey
SSDT A8244320 ZwSetValueKey

---- Kernel code sections - GMER 1.0.15 ----

.reloc C:\WINDOWS\system32\drivers\acedrv11.sys section is executable [0xA6ABC480, 0x306DD, 0xE0000060]

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Programme\PicPick\picpick.exe[588] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CopyFileExW] [120013B0] C:\Programme\1&1\1&1 Upload-Manager\ExplorerHook.dll (xxxxxxx xxxxxxxxx xxxxxxxxxxxx)
IAT C:\Programme\HP\HP UT\bin\hppusg.exe[612] @ C:\WINDOWS\system32\shell32.dll [KERNEL32.dll!CopyFileExW] [120013B0] C:\Programme\xxxx\xxx Upload-Manager\ExplorerHook.dll (xxxxxxxxx)
IAT C:\Programme\HP\ToolBoxFX\bin\HPTLBXFX.exe[664] @ C:\WINDOWS\system32\shell32.dll [KERNEL32.dll!CopyFileExW] [120013B0] C:\Programme\1&1\1&1 Upload-Manager\ExplorerHook.dll (xxxxxxxxx)
IAT C:\Programme\HP\HP Software Update\HPWuSchd2.exe[672] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CopyFileExW] [120013B0] C:\Programme\1&1\1&1 Upload-Manager\ExplorerHook.dll (xxxxxxxxxxxx)
IAT C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe[684] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CopyFileExW] [120013B0] C:\Programme\1&1\1&1 Upload-Manager\ExplorerHook.dll (xxxxxxxx)
IAT C:\Programme\Avira\AntiVir Desktop\avgnt.exe[1496] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CopyFileExW] [120013B0] C:\Programme\xxxxxxxx\ExplorerHook.dll (xxxxxxxxx)
IAT C:\WINDOWS\system32\ctfmon.exe[1564] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CopyFileExW] [120013B0] C:\Programme\xxxxxxxxxxxxxx)
IAT C:\Programme\DVBT\DetectTray.exe[1652] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CopyFileExW] [120013B0] C:\Programme\1&1\1&1 Upload-Manager\ExplorerHook.dll (xxxxxxxxxxxxx)
IAT C:\Programme\Spybot - Search & Destroy\TeaTimer.exe[1704] @ C:\WINDOWS\system32\shell32.dll [KERNEL32.dll!CopyFileExW] [120013B0] C:\Programme\1&1\1&1 Upload-Manager\ExplorerHook.dll (xxxxxxxxxxx)
IAT C:\Programme\xxxxxxxxxx\DAVSRV.EXE[1736] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CopyFileExW] [120013B0] C:\Programme\xxxxxxxxx\ExplorerHook.dll (xxxxxxxxxx)
IAT C:\WINDOWS\Explorer.EXE[1872] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CopyFileExW] [120013B0] C:\Programme\xxxxxxxxxxxx)
IAT C:\WINDOWS\system32\notepad.exe[1892] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CopyFileExW] [120013B0] C:\Programme\xxxxxxxxx)
IAT C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe[2052] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CopyFileExW] [120013B0] C:\Programme\xxxxxxxxxx)
IAT C:\Programme\Bluetooth Software\BTTray.exe[2072] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CopyFileExW] [120013B0] C:\Programme\xxxxxxxxxxxxxx)
IAT C:\Programme\Digital Research\EasyUPnP\EasyUPnP.exe[2228] @ C:\WINDOWS\system32\shell32.dll [KERNEL32.dll!CopyFileExW] [120013B0] C:\Programme\xxxxxxxxxxxxxxxxxxx)


Wie oder weiß jemand wie man das gelegentliche Popup Fenster wieder wegbekommt. Dieses kommt nur bei neuen Seitenbesuche.!!!!!!!!

Hallo und

bitte nen Vollscan mit Malwarebytes machen und Log posten. Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Doppelklick auf die OTL.exe
• Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
• Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
• Unter Extra Registry, wähle bitte Use SafeList
• Klicke nun auf Run Scan links oben
• Wenn der Scan beendet wurde werden 2 Logfiles erstellt
• Poste die Logfiles hier in den Thread.

Malware hatte nichts gefunden


OTL logfile created on: 12.05.2010 19:04:33 - Run 1
OTL by OldTimer - Version 3.2.4.1 Folder = C:\Dokumente und Einstellungen\Lippert\Eigene Dateien\downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 66,00% Memory free
3,00 Gb Paging File | 2,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 55,88 Gb Total Space | 4,37 Gb Free Space | 7,82% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive O: | 1015,00 Gb Total Space | 1014,90 Gb Free Space | 99,99% Space Free | Partition Type: FAT

Computer Name: LAPTOP
Current User Name: xxxxxx
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Dokumente und Einstellungen\xxxx\Eigene Dateien\downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
PRC - C:\Programme\PicPick\picpick.exe ()
PRC - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Programme\HP\ToolboxFX\bin\HPTLBXFX.exe (HP)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\1&1\1&1 Upload-Manager\DAVSRV.EXE (1&1 Internet AG)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Arecont Vision\Video Surveillance\LMService.exe (Arecont Vision)
PRC - C:\Programme\HP\HP UT\bin\hppusg.exe ()
PRC - C:\Programme\PopUp Killer\PopUpKiller.exe (xFX JumpStart)
PRC - C:\Programme\DVBT\DetectTray.exe ()
PRC - C:\Programme\Digital Research\EasyUPnP\EasyUPnP.exe ()
PRC - C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe (IVT Corporation)
PRC - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe ()
PRC - C:\Programme\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Programme\ZyDAS Technology Corporation\ZyDAS Wireless LAN\ZDConfig.exe ()
PRC - C:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE (Microsoft Corporation)
PRC - C:\Programme\Microsoft Office\OFFICE11\OUTLOOK.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\system32\brsvc01a.exe (brother Industries Ltd)
PRC - C:\Programme\Bluetooth Software\BTTray.exe (WIDCOMM Inc.)
PRC - C:\Programme\Bluetooth Software\BTStackServer.exe (WIDCOMM Inc.)
PRC - C:\WINDOWS\system32\brss01a.exe (brother Industries Ltd)


========== Modules (SafeList) ==========

MOD - C:\Dokumente und Einstellungen\xxxx\Eigene Dateien\downloads\OTL.exe (OldTimer Tools)
MOD - C:\Programme\1&1\1&1 Upload-Manager\EXPLORERHOOK.DLL (1&1 Internet AG)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (brmfrmps) -- File not found
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (Application Updater) -- C:\Programme\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (LMSrv) -- C:\Programme\Arecont Vision\Video Surveillance\LMService.exe (Arecont Vision)
SRV - (StkSSrv) -- C:\WINDOWS\system32\StkSSrv.dll (Syntek America Inc.)
SRV - (BlueSoleil Hid Service) -- C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe ()
SRV - (CFSvcs) -- C:\Programme\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (Brother XP spl Service) -- C:\WINDOWS\system32\brsvc01a.exe (brother Industries Ltd)


========== Driver Services (SafeList) ==========

DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (BtHidBus) -- C:\WINDOWS\System32\Drivers\BtHidBus.sys (IVT Corporation.)
DRV - (btnetBUs) -- C:\WINDOWS\system32\drivers\btnetBus.sys ()
DRV - (avmaura) -- C:\WINDOWS\system32\drivers\avmaura.sys (AVM Berlin)
DRV - (ui11rdr) -- C:\WINDOWS\system32\drivers\ui11rdr.SYS (1&1 Internet AG)
DRV - (IvtBtBUs) -- C:\WINDOWS\system32\drivers\IvtBtBus.sys (IVT Corporation.)
DRV - (MPE) -- C:\WINDOWS\system32\drivers\MPE.sys (Microsoft Corporation)
DRV - (mf) -- C:\WINDOWS\system32\drivers\mf.sys (Microsoft Corporation)
DRV - (acedrv11) -- C:\WINDOWS\system32\drivers\ACEDRV11.sys (Protect Software GmbH)
DRV - (EC168BDA) -- C:\WINDOWS\system32\drivers\EC168BDA.sys (e3C, Inc.)
DRV - (HPFXBULK) -- C:\WINDOWS\system32\drivers\hpfxbulk.sys (Hewlett Packard)
DRV - (SNPSTD3) USB PC Camera (SNPSTD3) -- C:\WINDOWS\system32\drivers\snpstd3.sys (Sonix Co. Ltd.)
DRV - (ialm) -- C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (agfusb) AGFEO USB Direkt TK-Suite (kein CAPI) -- C:\WINDOWS\system32\drivers\agfusb.sys (AGFEO GmbH & Co. KG)
DRV - (NWUSBPort) -- C:\WINDOWS\system32\drivers\nwusbser.sys (Novatel Wireless Inc.)
DRV - (NWUSBModem) -- C:\WINDOWS\system32\drivers\nwusbmdm.sys (Novatel Wireless Inc.)
DRV - (Aspi32) -- C:\WINDOWS\system32\drivers\ASPI32.SYS (Adaptec)
DRV - (FileDisk) -- C:\WINDOWS\system32\drivers\filedisk.sys (Bo Brantén)
DRV - (BlueletSCOAudio) -- C:\WINDOWS\system32\drivers\BlueletSCOAudio.sys (IVT Corporation)
DRV - (BlueletAudio) -- C:\WINDOWS\system32\drivers\blueletaudio.sys (IVT Corporation)
DRV - (Btcsrusb) -- C:\WINDOWS\system32\drivers\btcusb.sys (IVT Corporation)
DRV - (BTHidEnum) -- C:\WINDOWS\system32\drivers\vbtenum.sys ()
DRV - (StkMini) -- C:\WINDOWS\system32\drivers\StkMini.sys (Syntek America Inc.)
DRV - (CAMCHALA) -- C:\WINDOWS\system32\drivers\camc6hal.sys (Conexant Systems Inc.)
DRV - (CAMCAUD) -- C:\WINDOWS\system32\drivers\camc6aud.sys (Conexant Systems Inc.)
DRV - (BoiHwsetup) -- C:\WINDOWS\system32\drivers\BoiHwSetup.sys (Quanta Computer Corp)
DRV - (StkScan) -- C:\WINDOWS\system32\drivers\StkScan.sys (Syntek America Inc.)
DRV - (tfsnudfa) -- C:\WINDOWS\system32\dla\tfsnudfa.sys (Sonic Solutions)
DRV - (tfsnudf) -- C:\WINDOWS\system32\dla\tfsnudf.sys (Sonic Solutions)
DRV - (tfsnifs) -- C:\WINDOWS\system32\dla\tfsnifs.sys (Sonic Solutions)
DRV - (tfsncofs) -- C:\WINDOWS\system32\dla\tfsncofs.sys (Sonic Solutions)
DRV - (tfsnboio) -- C:\WINDOWS\system32\dla\tfsnboio.sys (Sonic Solutions)
DRV - (tfsnopio) -- C:\WINDOWS\system32\dla\tfsnopio.sys (Sonic Solutions)
DRV - (tfsnpool) -- C:\WINDOWS\system32\dla\tfsnpool.sys (Sonic Solutions)
DRV - (tfsndrct) -- C:\WINDOWS\system32\dla\tfsndrct.sys (Sonic Solutions)
DRV - (tfsndres) -- C:\WINDOWS\system32\dla\tfsndres.sys (Sonic Solutions)
DRV - (sscdbhk5) -- C:\WINDOWS\system32\drivers\sscdbhk5.sys (Sonic Solutions)
DRV - (ssrtln) -- C:\WINDOWS\system32\drivers\ssrtln.sys (Sonic Solutions)
DRV - (qkbfiltr) -- C:\WINDOWS\system32\drivers\qkbfiltr.sys (Quanta Computer, Inc.)
DRV - (qmofiltr) -- C:\WINDOWS\system32\drivers\qmofiltr.sys (Quanta Computer, Inc.)
DRV - (BTHidMgr) -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys (IVT Corporation)
DRV - (BT) -- C:\WINDOWS\system32\drivers\BtNetDrv.sys (IVT Corporation)
DRV - (drvmcdb) -- C:\WINDOWS\system32\drivers\drvmcdb.sys (Sonic Solutions)
DRV - (drvnddm) -- C:\WINDOWS\system32\drivers\drvnddm.sys (Sonic Solutions)
DRV - (VcommMgr) -- C:\WINDOWS\system32\drivers\VcommMgr.sys (IVT Corporation)
DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys (Realtek Semiconductor Corporation )
DRV - (w29n51) Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (VComm) -- C:\WINDOWS\system32\drivers\VComm.sys (IVT Corporation)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (WLAN) -- C:\WINDOWS\system32\drivers\WLANNDS.sys (IEEE 802.11b)
DRV - (BrSerWDM) Brother-Treiber (seriell) -- C:\WINDOWS\system32\drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (Netdevio) -- C:\WINDOWS\system32\drivers\Netdevio.sys (TOSHIBA Corporation.)
DRV - (BTWDNDIS) -- C:\WINDOWS\system32\drivers\btwdndis.sys (WIDCOMM Inc.)
DRV - (BTSERIAL) -- C:\WINDOWS\system32\drivers\btserial.sys ()
DRV - (BTSLBCSP) -- C:\WINDOWS\system32\drivers\btslbcsp.sys (WIDCOMM Inc.)
DRV - (BTKRNL) -- C:\WINDOWS\system32\drivers\btkrnl.sys (WIDCOMM Inc.)
DRV - (BTDriver) -- C:\WINDOWS\system32\drivers\btport.sys (WIDCOMM Inc.)
DRV - (BrUsbScn) Brother MFC-Scannertreiber (USB) -- C:\WINDOWS\system32\drivers\BrUsbScn.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) Brother MFC-nur-Fax-Modem (USB) -- C:\WINDOWS\system32\drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (brfilt) -- C:\WINDOWS\system32\drivers\BrFilt.sys (Brother Industries Ltd.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://fritz.box/
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSof1.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\SearchSettings.dll (Spigot, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = socks=127.0.0.1:9050

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=867034"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.4.1
FF - prefs.js..extensions.enabledItems: searchsettings@spigot.com:1.2.3
FF - prefs.js..extensions.enabledItems: {a93e9bfb-57a5-ce40-0402-961a8e2c0615}:4.6.6.7
FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p="
FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1"


FF - HKLM\software\mozilla\Firefox\extensions\\{5FE7198A-5950-4068-9FBF-1A60395CC4E9}: C:\Programme\1&1\1&1 SoftPhone\Firefox [2009.04.12 09:51:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.04.29 19:01:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.04.16 18:35:05 | 000,000,000 | ---D | M]

[2009.03.08 23:44:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Extensions
[2010.05.11 21:59:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\ehc7epyi.default\extensions
[2009.08.20 10:17:50 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\ehc7epyi.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.05.09 11:45:13 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\ehc7epyi.default\searchplugins\icqplugin-1.xml
[2010.03.14 09:30:52 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\ehc7epyi.default\searchplugins\icqplugin-10.xml
[2010.03.23 20:44:33 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\ehc7epyi.default\searchplugins\icqplugin-11.xml
[2010.04.06 18:08:14 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\ehc7epyi.default\searchplugins\icqplugin-12.xml
[2009.08.23 13:37:46 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\ehc7epyi.default\searchplugins\icqplugin-2.xml
[2009.10.19 14:05:07 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\ehc7epyi.default\searchplugins\icqplugin-3.xml
[2009.11.06 23:54:49 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\ehc7epyi.default\searchplugins\icqplugin-4.xml
[2009.12.17 07:11:19 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\ehc7epyi.default\searchplugins\icqplugin-5.xml
[2010.01.07 09:36:14 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\ehc7epyi.default\searchplugins\icqplugin-6.xml
[2010.01.14 22:55:52 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\ehc7epyi.default\searchplugins\icqplugin-7.xml
[2010.03.13 15:31:30 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\ehc7epyi.default\searchplugins\icqplugin-8.xml
[2010.03.13 21:33:34 | 000,000,656 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\ehc7epyi.default\searchplugins\icqplugin-9.xml
[2009.08.02 08:54:57 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\ehc7epyi.default\searchplugins\icqplugin.xml
[2010.05.11 21:59:55 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2009.03.02 01:36:32 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.04.28 21:06:10 | 000,000,000 | ---D | M] (z) -- C:\Programme\Mozilla Firefox\extensions\{a93e9bfb-57a5-ce40-0402-961a8e2c0615}
[2008.08.07 15:53:06 | 001,271,760 | ---- | M] (1 mal 1 Software GmbH) -- C:\Programme\Mozilla Firefox\plugins\NpFv501.dll
[2010.03.13 15:30:58 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.03.13 15:30:58 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.03.13 15:30:58 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.03.13 15:30:58 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.03.13 15:30:58 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSof1.dll (Conduit Ltd.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
O2 - BHO: (PDFCreator Toolbar Helper) - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (Google Inc.)
O2 - BHO: (Burn4Free Toolbar Helper) - {D187A56B-A33F-4CBE-9D77-459FC0BAE012} - C:\Programme\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll ()
O2 - BHO: (SearchSettings Class) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\SearchSettings.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (&Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKLM\..\Toolbar: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKLM\..\Toolbar: (Burn4Free Toolbar) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - C:\Programme\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll ()
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSof1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\ShellBrowser: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Burn4Free Toolbar) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - C:\Programme\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Programme\Softonic_Deutsch\tbSof1.dll (Conduit Ltd.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [HPPQVideo] C:\Programme\HP\ScheduledLaunch\HP Color LaserJet CP1510 Series\bin\hppschlnch.exe -r SOFTWARE\Hewlett-Packard\ScheduledLaunch\CLJ_CP1510_Series -f PQOptimizerVideo.xml File not found
O4 - HKLM..\Run: [HPUsageTracking] C:\Programme\HP\HP UT\bin\hppusg.exe ()
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [PicPick Start] C:\Programme\PicPick\picpick.exe ()
O4 - HKLM..\Run: [PopUpKiller] C:\Programme\PopUp Killer\PopUpKiller.exe (xFX JumpStart)
O4 - HKLM..\Run: [SearchSettings] C:\Programme\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [ToolBoxFX] C:\Programme\HP\ToolBoxFX\bin\HPTLBXFX.exe (HP)
O4 - HKLM..\Run: [Video Software Starter] C:\Programme\Arecont Vision\Video Surveillance\Starter.exe (Arecont Vision)
O4 - HKLM..\Run: [VirtuDrive] C:\Programme\1&1 Internet\VirtuDrive\virtudrv.exe (1&1 Internet AG)
O4 - HKCU..\Run: [1&1_1&1 Upload-Manager] C:\Programme\1&1\1&1 Upload-Manager\DAVSRV.EXE (1&1 Internet AG)
O4 - HKCU..\Run: [DetectTray] C:\Programme\DVBT\DetectTray.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BlueSoleil.lnk = C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe (IVT Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\Bluetooth Software\BTTray.exe (WIDCOMM Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\ZDConfig.lnk = C:\Programme\ZyDAS Technology Corporation\ZyDAS Wireless LAN\ZDConfig.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\Lippert\Startmenü\Programme\Autostart\DR-EasyUPnP.lnk = C:\Programme\Digital Research\EasyUPnP\EasyUPnP.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: add to &BOM - C:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta ()
O8 - Extra context menu item: In 1&&1 SoftPhone wählen - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\1&1\1&1 SoftPhone\ContextMenuHandler.html ()
O9 - Extra Button: IE-Spuren löschen - {6C7C0C9A-B51D-4ADB-A74D-C4E33744F866} - C:\Programme\TraXEx\Integration\TraXEx Internet Explorer.lnk ()
O9 - Extra Button: Löschautomat - {8DA7743F-9274-4BE8-899E-C0FF6ED61B00} - C:\Programme\TraXEx\Integration\TraXEx Löschautomat.lnk ()
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab (Reg Error: Key error.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1133175264979 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Lippert\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Lippert\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.08.08 18:09:51 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{e1eefc5b-8d86-11de-9534-0011671fbbf2}\Shell - "" = AutoRun
O33 - MountPoints2\{e1eefc5b-8d86-11de-9534-0011671fbbf2}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e1eefc5b-8d86-11de-9534-0011671fbbf2}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found
O33 - MountPoints2\{fa624a1b-9cf0-11dd-9331-0011e206f4b3}\Shell - "" = AutoRun
O33 - MountPoints2\{fa624a1b-9cf0-11dd-9331-0011e206f4b3}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fa624a1b-9cf0-11dd-9331-0011e206f4b3}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010.05.12 12:14:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2010.05.07 13:36:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Lippert\Eigene Dateien\neue Dekra Rechnungen mnatlich kneip
[2010.05.02 22:04:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\PopUp Killer
[2010.05.02 22:04:38 | 000,000,000 | ---D | C] -- C:\Programme\PopUp Killer
[2010.05.02 19:24:00 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy
[2010.05.02 19:24:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
[2010.04.29 18:28:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Lippert\Anwendungsdaten\Malwarebytes
[2010.04.29 18:28:36 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.04.29 18:28:32 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.04.29 18:28:32 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.04.29 18:28:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.04.28 23:06:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Lippert\Lokale Einstellungen\Anwendungsdaten\Threat Expert
[2010.04.28 22:51:13 | 001,640,400 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDCore.dll.old
[2010.04.28 21:24:15 | 000,000,000 | ---D | C] -- C:\Programme\Spyware Doctor
[2010.04.28 21:14:07 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2010.04.28 21:08:59 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\xxx\Recent
[2010.04.28 21:04:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\CE1D18472C99D60B881701AA7CBEBEB4
[2010.04.27 20:32:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Eigene Dateien\navi
[2010.04.15 22:29:26 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\browserchoice.exe
[2010.04.13 06:24:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxxx\Anwendungsdaten\Avira
[2010.04.13 06:23:50 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2010.04.13 06:23:45 | 000,124,784 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2010.04.13 06:23:45 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys
[2010.04.13 06:23:44 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys
[2010.04.13 06:23:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
[2007.03.12 12:41:52 | 000,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\vsnpstd3.dll
[2005.11.23 13:55:32 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\csnpstd3.dll
[15 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.05.12 19:03:03 | 007,340,032 | -H-- | M] () -- C:\Dokumente und Einstellungen\xxx\NTUSER.DAT
[2010.05.12 19:00:00 | 000,000,482 | ---- | M] () -- C:\WINDOWS\tasks\1-Click Maintenance.job
[2010.05.12 07:28:10 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.05.12 07:28:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.05.11 22:09:00 | 000,000,300 | -HS- | M] () -- C:\Dokumente und Einstellungen\xxx\ntuser.ini
[2010.05.09 20:39:48 | 000,208,384 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.07 13:23:35 | 000,096,768 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Eigene Dateien\Honorarabrechnung OG699295.....37.2009.doc
[2010.05.07 13:23:23 | 000,113,960 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Eigene Dateien\Honorarabrechnung OG699295.....37.2009.rtf
[2010.05.07 07:56:16 | 000,072,704 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Eigene Dateien\OG710662........19
[2010.05.06 21:21:04 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010.05.02 19:24:19 | 000,000,905 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\Spybot - Search & Destroy.lnk
[2010.05.01 15:59:08 | 000,000,831 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Startmenü\Programme\Autostart\DR-EasyUPnP.lnk
[2010.05.01 11:31:44 | 000,026,624 | ---- | M] () -- C:\Dokumente und Einstellungen\xxxx\Desktop\Telefonliste.xls
[2010.04.29 18:28:39 | 000,000,676 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.04.28 21:06:10 | 000,096,764 | ---- | M] () -- C:\WINDOWS\System32\a567eef9.exe
[2010.04.28 21:05:42 | 000,050,990 | ---- | M] () -- C:\WINDOWS\System32\dfytvtvmylytla.exe
[2010.04.20 20:24:49 | 000,051,712 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Eigene Dateien\OG710662........19.2010.xls
[2010.04.13 06:24:07 | 000,001,671 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira AntiVir Control Center.lnk
[15 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.05.07 13:23:35 | 000,096,768 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Eigene Dateien\Honorarabrechnung OG699295.....37.2009.doc
OG699295.....37.2009.rtf
[2010.05.07 07:57:43 | 000,051,712 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Eigene Dateien\OG710662........19.2010.xls
[2010.05.07 07:56:04 | 000,072,704 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Eigene Dateien\OG710662........19
[2010.05.02 19:24:19 | 000,000,905 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\Spybot - Search & Destroy.lnk
[2010.04.29 18:28:39 | 000,000,676 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.04.28 22:51:18 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll.old
[2010.04.28 21:06:10 | 000,096,764 | ---- | C] () -- C:\WINDOWS\System32\a567eef9.exe
[2010.04.28 21:05:17 | 000,050,990 | ---- | C] () -- C:\WINDOWS\System32\dfytvtvmylytla.exe
[2010.04.13 06:24:07 | 000,001,671 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira AntiVir Control Center.lnk
[2009.05.24 21:55:49 | 000,000,101 | ---- | C] () -- C:\WINDOWS\wiso.ini
[2009.05.12 21:14:49 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\nnr.dll
[2009.03.17 22:27:56 | 000,000,092 | ---- | C] () -- C:\WINDOWS\BsMobileModel.ini
[2009.03.14 12:48:08 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll
[2009.02.26 15:19:00 | 000,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009.02.26 15:19:00 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009.02.16 12:05:14 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4764.dll
[2009.02.13 21:28:32 | 000,015,873 | ---- | C] () -- C:\WINDOWS\System32\Inetde.dll
[2009.01.26 13:02:22 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2008.12.15 15:57:26 | 000,016,070 | ---- | C] () -- C:\WINDOWS\German2.ini
[2008.12.15 15:57:23 | 000,446,464 | ---- | C] () -- C:\WINDOWS\System32\Tx32.dll
[2008.12.15 15:57:23 | 000,000,151 | ---- | C] () -- C:\WINDOWS\System32\ic32.ini
[2008.12.07 13:44:54 | 000,030,088 | ---- | C] () -- C:\WINDOWS\System32\drivers\btnetBus.sys
[2008.11.23 23:36:33 | 000,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini
[2008.11.23 23:36:07 | 000,000,390 | ---- | C] () -- C:\WINDOWS\BRMFBIDI.INI
[2008.11.23 20:58:12 | 000,000,040 | ---- | C] () -- C:\WINDOWS\opt_2460.ini
[2008.11.23 20:39:01 | 000,000,469 | ---- | C] () -- C:\WINDOWS\brwmark.ini
[2008.11.23 20:39:01 | 000,000,267 | ---- | C] () -- C:\WINDOWS\Brpcfx.ini
[2008.11.23 20:39:01 | 000,000,079 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2008.11.06 18:37:32 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008.11.06 18:34:00 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008.11.06 18:34:00 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest
[2008.11.06 18:33:02 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2008.10.25 16:22:58 | 000,000,082 | ---- | C] () -- C:\WINDOWS\KTEL.INI
[2008.10.18 13:19:47 | 000,000,032 | ---- | C] () -- C:\WINDOWS\Menu.INI
[2008.10.11 20:57:10 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ZDTRLib.DLL
[2008.10.11 20:57:10 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\ZD12APP.dll
[2007.03.02 12:14:58 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2007.03.02 12:14:27 | 000,000,166 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini
[2007.03.02 12:14:01 | 000,000,685 | ---- | C] () -- C:\WINDOWS\hpntwksetup.ini
[2006.07.03 14:46:17 | 000,241,664 | ---- | C] () -- C:\WINDOWS\NwtGatewayDLL.dll
[2006.07.03 14:46:17 | 000,001,110 | ---- | C] () -- C:\WINDOWS\NwtGatewayConfig.ini
[2005.12.08 12:11:59 | 000,050,458 | ---- | C] () -- C:\WINDOWS\System32\interceptor.sys
[2005.08.09 10:14:00 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005.08.09 10:08:14 | 000,006,757 | ---- | C] () -- C:\WINDOWS\TcdsASC2.ini
[2005.08.09 09:53:59 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005.08.09 09:38:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NDSTray.INI
[2005.08.09 09:36:23 | 000,000,234 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005.08.09 09:34:43 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2005.08.09 09:34:43 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2005.08.09 09:34:43 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2005.08.09 09:34:43 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2005.08.09 09:34:43 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2005.08.09 09:34:43 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2005.08.09 09:30:28 | 000,012,402 | ---- | C] () -- C:\WINDOWS\HWSetupStr.ini
[2005.08.09 09:30:28 | 000,002,182 | R--- | C] () -- C:\WINDOWS\SVPW32Str.ini
[2005.08.09 09:24:46 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini
[2005.08.09 09:24:46 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll
[2005.08.09 09:24:46 | 000,009,358 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini
[2005.08.09 09:24:46 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini
[2005.08.08 18:13:05 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2005.08.08 17:57:10 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\ToshBIOS.dll
[2005.08.08 17:57:10 | 000,000,403 | -H-- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005.08.08 17:56:35 | 001,868,868 | ---- | C] () -- C:\WINDOWS\System32\RSA32_16.DLL
[2005.07.29 16:21:32 | 000,011,988 | ---- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys
[2005.07.12 14:44:00 | 000,015,872 | ---- | C] () -- C:\WINDOWS\System32\InsDrvZD64.DLL
[2005.06.30 13:15:40 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004.12.16 16:32:54 | 000,013,304 | ---- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys
[2004.11.11 21:08:36 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\tsbwls.dll
[2004.03.23 16:38:00 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\InsDrvZD.dll
[2004.02.27 17:36:18 | 000,015,498 | ---- | C] () -- C:\WINDOWS\snpstd3.ini
[2003.02.20 18:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002.04.16 11:29:58 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\HookDLL.dll
[2002.03.01 13:21:12 | 000,022,083 | ---- | C] () -- C:\WINDOWS\System32\drivers\btserial.sys
[2002.02.15 16:30:46 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\btsendto.dll
[2002.01.31 10:39:08 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\BtXpShell.dll
[2002.01.31 10:26:12 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\BtAudioHelper.dll
[2002.01.31 10:18:28 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
[2002.01.31 10:18:26 | 000,000,607 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2002.01.31 10:18:26 | 000,000,597 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest
[2001.07.06 17:30:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI

========== Alternate Data Streams ==========

@Alternate Data Stream - 135 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:7D43E156
@Alternate Data Stream - 118 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:9AB56A06
@Alternate Data Stream - 109 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A8ADE5D8
@Alternate Data Stream - 103 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMPFC5A2B2
< End of report >


OTL Extras logfile created on: 12.05.2010 19:04:34 - Run 1
OTL by OldTimer - Version 3.2.4.1 Folder = C:\Dokumente und Einstellungen\Lippert\Eigene Dateien\downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 66,00% Memory free
3,00 Gb Paging File | 2,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 55,88 Gb Total Space | 4,37 Gb Free Space | 7,82% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive O: | 1015,00 Gb Total Space | 1014,90 Gb Free Space | 99,99% Space Free | Partition Type: FAT

Computer Name: LAPTOP
Current User Name: Lippert
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.hta [@ = htafile] -- Reg Error: Key error. File not found
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNetisabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNetisabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"69:UDP" = 69:UDP:*:Enabled:CameraTFTPPort
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\setup\HPZnet01.exe" = D:\setup\HPZnet01.exe:*:Enabled:hpznet01.exe -- File not found
"D:\setup\hponicifs01.exe" = D:\setup\hponicifs01.exe:*:Enabled:hponicifs01.exe -- File not found
"C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe -- File not found
"C:\Programme\HP\Digital Imaging\bin\hpqste08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe -- File not found
"C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- File not found
"C:\Programme\HP\Digital Imaging\bin\hposfx08.exe" = C:\Programme\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- File not found
"C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- File not found
"C:\Programme\HP\Digital Imaging\bin\hpqscnvw.exe" = C:\Programme\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe -- File not found
"C:\Programme\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Programme\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe -- File not found
"C:\Programme\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe -- File not found
"C:\Programme\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe -- File not found
"C:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- File not found
"C:\Programme\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Programme\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe -- File not found
"C:\Programme\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Programme\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe -- File not found
"C:\Programme\HP\Digital Imaging\bin\hpoews01.exe" = C:\Programme\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- File not found
"C:\Programme\HP\Digital Imaging\bin\hpqnrs08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe -- File not found
"C:\Programme\AGFEO\Tk-Suite-Basic\tkserver\tkmedia.exe" = C:\Programme\AGFEO\Tk-Suite-Basic\tkserver\tkmedia.exe:*:Enabled:TK-Suite Media Transport -- (AGFEO)
"C:\Programme\AGFEO\Tk-Suite-Basic\tkserver\tksock.exe" = C:\Programme\AGFEO\Tk-Suite-Basic\tkserver\tksock.exe:*:Enabled:TK-Suite Server -- (AGFEO)
"C:\Programme\AGFEO\Tk-Suite-Basic\tools\ctimon.exe" = C:\Programme\AGFEO\Tk-Suite-Basic\tools\ctimon.exe:*:Enabled:TK-Suite Client -- (AGFEO)
"C:\Dokumente und Einstellungen\Lippert\Lokale Einstellungen\Apps\2.0\Z2BL74AX.XBX\7NALR27M.8YO\frit..tion_f8d772dfbb3f7453_0002.0001_0db5bf149dd7a141\fritzbox-usb-fernanschluss.exe" = C:\Dokumente und Einstellungen\Lippert\Lokale Einstellungen\Apps\2.0\Z2BL74AX.XBX\7NALR27M.8YO\frit..tion_f8d772dfbb3f7453_0002.0001_0db5bf149dd7a141\fritzbox-usb-fernanschluss.exe:*:Enabled:FRITZ!Box USB-Fernanschluss -- (AVM Berlin)
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\Dokumente und Einstellungen\Lippert\Lokale Einstellungen\Temp\_ISTMP1.DIR\_INS5576._MP" = C:\Dokumente und Einstellungen\Lippert\Lokale Einstellungen\Temp\_ISTMP1.DIR\_INS5576._MP:*:Enabled:InstallShield Engine -- File not found
"C:\Programme\FRITZ!fax\FriFax32.exe" = C:\Programme\FRITZ!fax\FriFax32.exe:*:Enabled:FRITZ!fax -- (AVM Berlin)
"C:\WINDOWS\system32\java.exe" = C:\WINDOWS\system32\java.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary -- (Sun Microsystems, Inc.)
"C:\Programme\Java\jre6\launch4j-tmp\JDownloader.exe" = C:\Programme\Java\jre6\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Java\jre6\bin\java.exe" = C:\Programme\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Programme\Mask Surf Pro\Tor\tor.exe" = C:\Programme\Mask Surf Pro\Tor\tor.exe:*:Enabled:Tor -- File not found
"C:\Programme\Toshiba\ConfigFree\CFXFER.exe" = C:\Programme\Toshiba\ConfigFree\CFXFER.exe:*:Enabled:ConfigFree SUMMIT Engine -- (TOSHIBA CORPORATION)
"C:\Programme\Arecont Vision\Video Surveillance\AVInstaller.exe" = C:\Programme\Arecont Vision\Video Surveillance\AVInstaller.exe:*:Enabled:CameraInstaller -- (Arecont Vision)
"C:\Programme\Arecont Vision\Video Surveillance\LocalMachine.exe" = C:\Programme\Arecont Vision\Video Surveillance\LocalMachine.exe:*:Enabled:CameraVideoViewer -- (Arecont Vision)
"C:\Programme\Arecont Vision\Video Surveillance\SnapShots.exe" = C:\Programme\Arecont Vision\Video Surveillance\SnapShots.exe:*:Enabled:CameraSnapShots -- (Arecont Vision)
"C:\Programme\ICQ6\ICQ.exe" = C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6 -- File not found
"C:\Programme\Mask Surf Pro\masksurf.exe" = C:\Programme\Mask Surf Pro\masksurf.exe:*:Enabled:Mask Surf Pro -- File not found
"C:\Dokumente und Einstellungen\Lippert\Lokale Einstellungen\Apps\2.0\Z2BL74AX.XBX\7NALR27M.8YO\frit..tion_f8d772dfbb3f7453_0002.0001_0db5bf169ed5c0c1\fritzbox-usb-fernanschluss.exe" = C:\Dokumente und Einstellungen\Lippert\Lokale Einstellungen\Apps\2.0\Z2BL74AX.XBX\7NALR27M.8YO\frit..tion_f8d772dfbb3f7453_0002.0001_0db5bf169ed5c0c1\fritzbox-usb-fernanschluss.exe:*:Enabled:FRITZ!Box USB-Fernanschluss -- (AVM Berlin)
"C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe" = C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil -- (IVT Corporation)
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{00C58EBE-223E-4AB6-8AE9-38F27F4420BD}" = WISO Sparbuch 2009
"{01814817-4502-4C66-825A-5E22D80ACD8E}" = USB 2.0 PC Camera
"{0456ebd7-5f67-4ab6-852e-63781e3f389c}" = Macromedia Flash Player
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{099D12EC-0321-4CAC-A0CC-33D020156FCD}" = Toshiba Utility
"{0C67F96B-8502-4503-9949-B1A8FF9A43DC}" = NetObjects Toolbox - Bonusanwendungen
"{0F51A262-1ADF-4914-B448-78AC58C4178A}" = BT500 Bluetooth Software 1.0
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{13F00518-807A-4B3A-83B0-A7CD90F3A398}" = MarketResearch
"{15047293-954F-45B2-8A7B-D7226D2B6931}" = SyncToy
"{15805DAF-22AD-4FCA-9469-78440B266046}" = hpzTLBXFX
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{223C0721-A6B0-4853-88C0-331029841734}" = HP Color LaserJet CP1510 Series 4.0
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java(TM) 6 Update 13
"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg
"{305C55E5-5AE0-40DF-BF4E-2E8901FD2454}" = Internet Camera
"{318AB667-3230-41B5-A617-CB3BF748D371}" = iTunes
"{3248F0A8-6813-11D6-A77B-00B0D0150020}" = J2SE Runtime Environment 5.0 Update 2
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3E4A5C6E-ADCF-444F-BBA5-4F1F6C4A172A}" = hppPQVideoCP1510
"{3EB6332B-AF02-457C-A31C-835458C5B48B}" = TOSHIBA Benutzerhandbücher
"{414C803A-6115-4DB6-BD4E-FD81EA6BC71C}" = Product_SF_Min_QFolder
"{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}" = HPSSupply
"{581CE7EA-A30D-11D6-8496-000000120103}" = ZyDAS Wireless LAN - USB
"{5D96E2B1-D9AC-46E0-9073-425C5F63E338}" = Touch and Launch
"{5F05C28D-DEA9-4AD6-A73A-064175988EAB}" = Search Settings v1.2.3
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{63D1A44F-E1FD-4460-BE0A-8745012F67EF}" = BlueSoleil
"{64212898-097F-4F3F-AECA-6D34A7EF82DF}" = TOSHIBA Zoom-Dienstprogramm
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6B67EB21-2EBB-4492-B3AD-6D96DC01B160}" = hppManualsCP1510
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{7ADCEEA0-AC82-4360-AD6B-CCF01B66F9DB}" = hppusgCP1510
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{818ABC3C-635C-4651-8183-D0E9640B7DD1}" = HP Update
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{91130407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Basic Edition 2003
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD for TOSHIBA
"{91A10407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office OneNote 2003
"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)
"{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{995F2783-8311-49BF-833E-DB659774B4F6}" = hppFonts
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A1CFBEF8-D9F6-4B2A-BDBE-7D8C0B0FE03A}" = Toshiba Hotkey Utility
"{A2A6D2EE-E775-470E-8D32-21394EBEE55A}" = NetObjects Fusion 11.0
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AB212B59-FF45-4C18-B369-F630CB268DAF}" = TMPGEnc 4.0 XPress
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{AF5D2EC6-8095-42CA-AB01-5FB6399281A1}" = Internet Camera
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B3773B5E-7911-4336-B6E6-2CF07FA01EAD}" = AV Video System
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B547CB8D-549A-436E-97B5-E79F911B11E2}" = SDP Downloader
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}" = TOSHIBA ConfigFree
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDC4FC15-480C-49C1-85DA-1CFBBFC6CD08}" = DVBT
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DF1AB1B2-4817-4A8F-A1C2-D533CABC00E2}" = NetObjects Fusion 10.0
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{EC4455AB-F155-4CC1-A4C5-88F3777F9886}" = Apple Mobile Device Support
"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack
"{F77890F3-774A-4CBE-A2E3-7BB0DC71D1FA}" = Toshiba Touchpad Utility
"{F7DC8BCA-F188-4166-ACD3-521FF003FEDC}" = hppTLBXFXCP1510
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT-Erweiterung für den Microsoft Windows XP-Assistenten zum Schreiben von CDs
"1&1 SoftPhone" = 1&1 SoftPhone
"1&1 Upload-Manager" = 1&1 Upload-Manager
"1&1 VirtuDrive" = 1&1 VirtuDrive
"a567eef9" = Contextual Tool Profithand
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AGFUSBINSTALL" = AGFEO USB Direkt TK-Suite (kein CAPI)
"Ashampoo Burning Studio 2009_is1" = Ashampoo Burning Studio 2009
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3
"AVS4YOU Video Converter 6_is1" = AVS Video Converter 6
"Biet-O-Matic v2.10.1" = Biet-O-Matic v2.10.1
"Burn4Free Toolbar" = Burn4Free Toolbar
"CNXT_AUDIO" = Conexant AC-Link Audio
"Core FTP LE 2.1" = Core FTP LE 2.1
"Defraggler" = Defraggler (remove only)
"dfytvtvmylytla" = Performance Solution Hotrevenue
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"EPSON Scanner" = EPSON Scan
"Flatcast_is1" = Flatcast 5.0
"FRITZ!fax" = AVM FRITZ!fax
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HPExtendedCapabilities" = HP Customer Participation Program 9.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"InstallShield_{099D12EC-0321-4CAC-A0CC-33D020156FCD}" = Toshiba Utility
"InstallShield_{F77890F3-774A-4CBE-A2E3-7BB0DC71D1FA}" = Toshiba Touchpad Utility
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NETcam" = Uninstall
"Network Camera MultiViewer" = Network Camera MultiViewer
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PC-Diagnose-Tool" = TOSHIBA PC-Diagnose-Tool
"PDFCreator Toolbar" = PDFCreator Toolbar
"Product_Name" = PopUp Killer
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"Registry First Aid_is1" = Registry First Aid
"SNC Installer" = SNC Installer
"Softonic_Deutsch Toolbar" = Softonic_Deutsch Toolbar
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"SystemRequirementsLab" = System Requirements Lab
"tksuite_tksuite_basic" = AGFEO TK-Suite Basic 3
"TraXEx_is1" = TraXEx 3.2
"VLC media player" = VLC media player 0.9.9
"web2date" = DATA BECKER web to date 5
"WIC" = Windows Imaging Component
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR
"WLAN network adaptor_WINDOWS" = IEEE 802.11b WLAN network adaptor for Windows
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Xvid_is1" = Xvid 1.1.2 final uninstall
"ZoomPlayer" = Zoom Player (remove only)
"ZoomPlayerLang" = Zoom Player deutsche Sprachdateien (entfernen)

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"93edd1682ad811a0" = Gini!
"f6791b188d8f3ff8" = AVM FRITZ!Box USB-Fernanschluss
"WinImage" = WinImage

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 15.03.2010 00:35:16 | Computer Name = LAPTOP | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung explorer.exe, Version 6.0.2900.5512, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

Error - 21.03.2010 04:21:11 | Computer Name = LAPTOP | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung OUTLOOK.EXE, Version 11.0.5510.0, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

Error - 21.03.2010 04:34:14 | Computer Name = LAPTOP | Source = Microsoft Office 11 | ID = 2000
Description = Accepted Safe Mode action : Microsoft Office Outlook.

Error - 21.03.2010 04:39:21 | Computer Name = LAPTOP | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung OUTLOOK.EXE, Version 11.0.5510.0, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

Error - 21.03.2010 12:06:37 | Computer Name = LAPTOP | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung OUTLOOK.EXE, Version 11.0.5510.0, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

Error - 21.03.2010 12:06:42 | Computer Name = LAPTOP | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung OUTLOOK.EXE, Version 11.0.5510.0, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

Error - 21.03.2010 12:15:22 | Computer Name = LAPTOP | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung OUTLOOK.EXE, Version 11.0.5510.0, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

Error - 28.04.2010 15:33:44 | Computer Name = LAPTOP | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung newupdate1142C.exe, Version 0.0.0.0, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

Error - 28.04.2010 23:08:42 | Computer Name = LAPTOP | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
Modul mshtml.dll, Version 8.0.6001.18904, Fehleradresse 0x00331b8a.

Error - 02.05.2010 10:38:57 | Computer Name = LAPTOP | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung firefox.exe, Version 1.9.2.3743, fehlgeschlagenes
Modul npswf32.dll, Version 10.0.42.34, Fehleradresse 0x00083bb6.

[ System Events ]
Error - 11.05.2010 14:53:43 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Brother Popup Suspend service for Resource manager" wurde
aufgrund folgenden Fehlers nicht gestartet: %%2

Error - 11.05.2010 14:53:43 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Syntek DC-112X Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%2

Error - 11.05.2010 14:54:59 | Computer Name = LAPTOP | Source = System Error | ID = 1003
Description = Fehlercode 100000d1, 1. Parameter 000006f2, 2. Parameter 00000002,
3. Parameter 00000000, 4. Parameter 000006f2.

Error - 11.05.2010 14:59:09 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AGFEO USB Direkt TK-Suite (kein CAPI)" wurde aufgrund
folgenden Fehlers nicht gestartet: %%1058

Error - 11.05.2010 14:59:10 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Brother Popup Suspend service for Resource manager" wurde
aufgrund folgenden Fehlers nicht gestartet: %%2

Error - 11.05.2010 14:59:10 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Syntek DC-112X Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%2

Error - 11.05.2010 15:00:30 | Computer Name = LAPTOP | Source = System Error | ID = 1003
Description = Fehlercode 10000050, 1. Parameter a5f46b3c, 2. Parameter 00000001,
3. Parameter a5d77c86, 4. Parameter 00000000.

Error - 12.05.2010 01:28:28 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AGFEO USB Direkt TK-Suite (kein CAPI)" wurde aufgrund
folgenden Fehlers nicht gestartet: %%1058

Error - 12.05.2010 01:28:28 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Brother Popup Suspend service for Resource manager" wurde
aufgrund folgenden Fehlers nicht gestartet: %%2

Error - 12.05.2010 01:28:28 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Syntek DC-112X Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%2


< End of report >

Wer weiß wie diese kleine Werbepop ups zu stande kommen.?
wie kann man diese deaktivieren?

grüße

Poste bitte trotzdem das Malwarebytes Log.

Hallo Arne,

hab mal Malwarebytes gescannt

siehe log
Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Datenbank Version: 4052

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12.05.2010 21:59:25
mbam-log-2010-05-12 (21-59-25).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 118124
Laufzeit: 5 Minute(n), 33 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Malwarebytes' Anti-Malware 1.45
Datenbank Version: 4052

Da stecken die Fehler. Version muss 1.46 sein und DB-Version 4091 oder höher.
Bitte updaten - auch die Datenbanken - und den Vollscan wiederholen.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4095

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

13.05.2010 11:19:24
mbam-log-2010-05-13 (11-19-24).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 255325
Laufzeit: 1 Stunde(n), 21 Minute(n), 26 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


Aber Avira meldete sich
Guard Malware gefunden
C/system Volume Information /...

Malwarebytes' Anti-Malware 1.46
Malwarebytes

Datenbank Version: 4095

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

13.05.2010 22:52:18
mbam-log-2010-05-13 (22-52-18).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 255505
Laufzeit: 1 Stunde(n), 40 Minute(n), 5 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Bitte mal den Avenger anwenden:

1.) Lade Dir von hier Avenger:
Swandog46's Public Anti-Malware Tools (Download, linksseitig)

2.) Entpack das zip-Archiv, führe die Datei "avenger.exe" aus (unter Vista per Rechtsklick => als Administrator ausführen). Die Haken unten wie abgebildet setzen:



3.) Kopiere Dir exakt die Zeilen aus dem folgenden Code-Feld:

files to delete:
C:\WINDOWS\System32\a567eef9.exe
C:\WINDOWS\System32\dfytvtvmylytla.exe
C:\WINDOWS\System32\nnr.dll
         

4.) Geh in "The Avenger" nun oben auf "Load Script", dort auf "Paste from Clipboard".

5.) Der Code-Text hier aus meinem Beitrag müsste nun unter "Input Script here" in "The Avenger" zu sehen sein.

6.) Falls dem so ist, klick unten rechts auf "Execute". Bestätige die nächste Abfrage mit "Ja", die Frage zu "Reboot now" (Neustart des Systems) ebenso.

7.) Nach dem Neustart erhältst Du ein LogFile von Avenger eingeblendet. Kopiere dessen Inhalt und poste ihn hier.

8.) Die Datei c:\avenger\backup.zip bei File-Upload.net hochladen und hier verlinken

Logfile of The Avenger Version 2.0, (c) by Swandog46
Swandog46's Public Anti-Malware Tools

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "C:\WINDOWS\System32\a567eef9.exe" not found!
Deletion of file "C:\WINDOWS\System32\a567eef9.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

File "C:\WINDOWS\System32\dfytvtvmylytla.exe" deleted successfully.
File "C:\WINDOWS\System32\nnr.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.