Hi alle mal zusammen.
Mein AVG Vierenprogramm meldet mir jetzt schon seit einer Woche täglich eine Infektion Namens Trojaner Cryptic.NP auf meinem Rechner an. Nach einigen versuchen den Trojaner zu löschen ist dies aber noch immer fehlgeschlagen.

Die angaben meines PC die CCleaner angibt lauten:
MS Windows 7 Home Premium 32-bit
Intel Core i5 CPU 750 @ 2.67GHz, 4,0 GB RAM ATI Readon HD 5700 Series

Mein AVG Vierenprogramm gibt mir diese Meldung
Trojaner Cryptic.NP
Details:
Prozessname: c:\users\****\App Data\Local\Temp\DBBD.tmp
Prozess ID 4856

Dann habe ich noch einen Suchlauf mit Maleware1.46 gemacht, da ich gesehen habe das ihr mit diesem Programm arbeitet.

Hier ist die Logdatei zu dem Suchlauf.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4096

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

14.05.2010 07:07:46
mbam-log-2010-05-14 (07-07-46).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|J:\|)
Durchsuchte Objekte: 195514
Laufzeit: 20 Minute(n), 17 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 2
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 2
Infizierte Verzeichnisse: 5
Infizierte Dateien: 44

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
C:\Windows\System32\d3d932.dll (Trojan.Tracur) -> No action taken.
C:\Users\Hoffmann\AppData\Roaming\3F62.tmp (Trojan.Tracur) -> No action taken.

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\.fsharproj (Trojan.Tracur) -> No action taken.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur) -> Data: c:\windows\system32\d3d932.dll -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur) -> Data: system32\d3d932.dll -> No action taken.

Infizierte Verzeichnisse:
C:\ProgramData\604384458 (Rogue.WindowsSmartSecurity) -> No action taken.
C:\Users\***\AppData\Roaming\SystemProc (Trojan.Agent) -> No action taken.
C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D} (Worm.Prolaco.M) -> No action taken.
C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome (Worm.Prolaco.M) -> No action taken.
C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content (Worm.Prolaco.M) -> No action taken.

Infizierte Dateien:
C:\Windows\System32\d3d932.dll (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Roaming\3F62.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\4B6F.tmp (Trojan.Tracur) -> No action taken.
C:\Users\Hoffmann\AppData\Local\Temp\4F81.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\51EA.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\5B41.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\670D.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\6720.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\7120.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\76E7.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\8F76.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\8FCB.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\9487.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\97D6.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\9882.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\A730.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\BE18.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\C37C.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\C515.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\C5A3.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\CDAE.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\D00A.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\E511.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\E63F.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\E9D2.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\ECA0.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\F114.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Local\Temp\F3AF.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Roaming\EEE7.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Roaming\4BA5.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Roaming\674C.tmp (Trojan.Tracur) -> No action taken.
C:\Users\***\AppData\Roaming\CA11.tmp (Trojan.Tracur) -> No action taken.
C:\ProgramData\authfwcfg32.dll (Trojan.Tracur) -> No action taken.
C:\ProgramData\AuthFWWizFwk32.dll (Trojan.Tracur) -> No action taken.
C:\ProgramData\ctl3d3232.dll (Trojan.Tracur) -> No action taken.
C:\ProgramData\D3DCompiler_3332.dll (Trojan.Tracur) -> No action taken.
C:\ProgramData\d3dx10_4132.dll (Trojan.Tracur) -> No action taken.
C:\ProgramData\d3dx9_2932.dll (Trojan.Tracur) -> No action taken.
C:\Windows\System32\CardGames32.dll (Trojan.Tracur) -> No action taken.
C:\Windows\System32\D3DCompiler_3432.dll (Trojan.Tracur) -> No action taken.
C:\Windows\System32\d3dim32.dll (Trojan.Tracur) -> No action taken.
C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest (Worm.Prolaco.M) -> No action taken.
C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf (Worm.Prolaco.M) -> No action taken.
C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul (Worm.Prolaco.M) -> No action taken.

ich hoffe ich habe die angaben richtig geschrieben, und hoffe das ihr mir Helfen Könnt.

Gruss goerdi

Hallo und

Hast Du alle Funde entfernt?

Hallo Arne.
Ich habe eben mal kurz im Malewareprogramm auf alle Vieren entfernen gecklickt aber die ganzen Trojaner und Würmer sind noch da.

Ich bin jetzt nochmal nen Scan mit Malewarebytes durschlaufen am lassen und dann sehe ich mal wieviel das Programm nochmal findet.
Nach einer minute sind schon 3 Infektionen gefunden worden

Waren die Angeben richtig die ichj gemacht habe?

Gruss Gerhard

Du solltest die Funde ja auch mit Malwarebytes entfernen, das hast Du offensichtlich nicht gemacht, deswegen steht ja auch im 1. Logfile "no action taken"

Hallo Arne.

Ich habe nachdem Scan die Infektionen sofort gelöscht. Jetzt ist auch alles gelöscht und es wurden bei einem erneuten Scan nachdem ich den PC neu gestartet habe nichts mehr gefunden.

Beim ersten löschvorgang mit Malewarebytes hat malewarebytes 40 Infektionen gelöscht. Dies abe ich aber irgendwie nicht richtig gesehen.
Beim ersten mal habe ich wohl auch einige Fehler gemacht, wie z.B. den PC nicht neu gestartet.

Du und die Seite habt mir trotzdem sehr gegholfen, denn gestern war ich noch ratlos und heute bin ich um einiges schlauer geworden.

Eine Frage hätte ich doch noch. Ist Malewarebytes gratis oder ist das ein Programm welches ich nach einger zeit kaufen mluss wenn ich es weiterhin benutzen will?
Und könnte ich Malewarebytes durch AVG ersetzen?
Welches Programm hat den besten Schutz gegen Infektionen?

Nochmal vielen dank
Gruss Gerhard

Bitte mach noch Logs mit otl.exe

Eine Frage hätte ich doch noch. Ist Malewarebytes gratis oder ist das ein Programm welches ich nach einger zeit kaufen mluss wenn ich es weiterhin benutzen will?

Nein, malwarebytes free ist freeware. Du hast da aber keinen Echtzeitscanner.

Und könnte ich Malewarebytes durch AVG ersetzen?

Würde ich nicht machen, weil die Version mit Echtzeitschutz von MBAM Geld kostet.

Welches Programm hat den besten Schutz gegen Infektionen?

Es gibt nicht das ultimative Programm. Sicherheit musst Du "leben" !!
Halte Dich am besten grob an diese fünf Regeln:

1) Sei misstrauisch im Internet und v.a. bei unbekannten E-Mails, sei vorsichtig bei der Herausgabe persönlicher Daten!!
2) Halte Windows und alle verwendeten Programme immer aktuell
3) Führe regelmäßig Backups auf externe Medien durch
4) Arbeite mit eingeschränkten Rechten
5) Nutze sichere Programme wie zB Opera oder Firefox zum Surfen statt den IE, zum Mailen Thunderbird statt Outlook Express - E-Mails nur als reinen text anzeigen lassen

Alles noch genauer erklärt steht hier => Kompromittierung unvermeidbar?

Hallo

hier die beiden Log-Files.
OTL txt:

OTL logfile created on: 15.05.2010 18:54:01 - Run 1
OTL by OldTimer - Version 3.2.4.1 Folder = C:\Users\Hoffmann\Downloads
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 64,00% Memory free
7,00 Gb Paging File | 6,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931,41 Gb Total Space | 899,38 Gb Free Space | 96,56% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 465,76 Gb Total Space | 196,18 Gb Free Space | 42,12% Space Free | Partition Type: NTFS

Computer Name: HOFFMANN-PC
Current User Name: Hoffmann
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Hoffmann\Downloads\OTL.exe File not found
PRC - C:\Programme\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Programme\LimeWire\LimeWire.exe (Lime Wire, LLC)
PRC - C:\Programme\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation)
PRC - C:\Programme\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft Office\Office10\WINWORD.EXE (Microsoft Corporation)
PRC - C:\Programme\Microsoft Office\Office10\OUTLOOK.EXE (Microsoft Corporation)
PRC - C:\Programme\TechniSat DVB\bin\Server4PC.exe (TechniSat Digital, S.A.)
PRC - C:\Windows\System32\XSrvSetup.exe ()
PRC - C:\Programme\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (avg9emc) -- C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9wd) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (AVG Security Toolbar Service) -- C:\Programme\AVG\AVG9\Toolbar\ToolbarBroker.exe ()
SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (JMB36X) -- C:\Windows\System32\XSrvSetup.exe ()
SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX-Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (AvgTdiX) -- C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) -- C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) -- C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (SKYNET) -- C:\Windows\System32\drivers\SkyNET.sys (TechniSat Digital, S.A.)
DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (JRAID) -- C:\Windows\system32\DRIVERS\jraid.sys (JMicron Technology Corp.)
DRV - (nusb3xhc) -- C:\Windows\System32\drivers\nusb3xhc.sys (NEC Electronics Corporation)
DRV - (nusb3hub) -- C:\Windows\System32\drivers\nusb3hub.sys (NEC Electronics Corporation)
DRV - (AtiHdmiService) -- C:\Windows\System32\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV - (RTL8167) -- C:\Windows\System32\drivers\Rt86win7.sys (Realtek )
DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) -- C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) -- C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) -- C:\Windows\system32\DRIVERS\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) -- C:\Windows\System32\drivers\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) -- C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) -- C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) -- C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de-de.facebook.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 4D 01 DF D5 DC D0 CA 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 98 0F DD 18 A2 BB D5 45 A3 E3 0A 8F C2 93 44 9E [binary data]
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Programme\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.facebook.de"
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.6.8.107

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.19 22:38:54 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.04.19 22:38:54 | 000,000,000 | ---D | M]

[2010.05.02 15:20:08 | 000,000,000 | ---D | M] -- C:\Users\Hoffmann\AppData\Roaming\mozilla\Extensions
[2010.05.02 15:20:08 | 000,000,000 | ---D | M] -- C:\Users\Hoffmann\AppData\Roaming\mozilla\Extensions\mozswing@mozswing.org
[2010.05.14 18:52:02 | 000,000,000 | ---D | M] -- C:\Users\Hoffmann\AppData\Roaming\mozilla\Firefox\Profiles\cw9c4r6r.default\extensions
[2010.05.02 15:45:21 | 000,000,000 | ---D | M] -- C:\Users\Hoffmann\AppData\Roaming\mozilla\Firefox\Profiles\cw9c4r6r.default\extensions\toolbar@ask.com
[2010.05.14 12:56:10 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.04.01 18:54:38 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.04.01 18:54:38 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.04.01 18:54:38 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.04.01 18:54:38 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.04.01 18:54:38 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (no name) - {18DD0F98-BBA2-45D5-A3E3-0A8FC293449e} - C:\ProgramData\cngprovider32.dll File not found
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Programme\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (LimeWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Programme\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (LimeWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Programme\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (LimeWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Programme\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [ Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe File not found
O4 - Startup: C:\Users\Hoffmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Programme\LimeWire\LimeWire.exe (Lime Wire, LLC)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Programme\AVG\AVG9\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - AppInit_DLLs: (C:\Windows\system32\d3d932.dll) - C:\Windows\System32\d3d932.dll File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2007.07.05 15:25:32 | 000,000,047 | ---- | M] () - J:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010.05.15 18:51:53 | 000,570,880 | ---- | C] (OldTimer Tools) -- C:\Users\Hoffmann\Desktop\OTL.exe
[2010.05.14 07:16:25 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2010.05.13 14:26:57 | 000,000,000 | ---D | C] -- C:\Programme\trend micro
[2010.05.13 14:26:57 | 000,000,000 | ---D | C] -- C:\rsit
[2010.05.13 14:22:58 | 000,000,000 | ---D | C] -- C:\Users\Hoffmann\AppData\Roaming\Malwarebytes
[2010.05.13 14:22:53 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.05.13 14:22:53 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.05.13 14:22:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.05.13 14:22:52 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.05.06 17:42:13 | 000,000,000 | -H-D | C] -- C:\$AVG
[2010.05.02 15:34:09 | 000,000,000 | -HSD | C] -- C:\ProgramData\SysWoW32
[2010.05.02 15:34:09 | 000,000,000 | ---D | C] -- C:\Users\Hoffmann\AppData\Roaming\WinRAR
[2010.05.02 15:24:52 | 000,000,000 | ---D | C] -- C:\Users\Hoffmann\AppData\Local\AskToolbar
[2010.05.02 15:20:14 | 000,000,000 | ---D | C] -- C:\Users\Hoffmann\Documents\LimeWire
[2010.05.02 15:19:30 | 000,000,000 | ---D | C] -- C:\Users\Hoffmann\AppData\Roaming\LimeWire
[2010.05.02 15:19:17 | 000,000,000 | ---D | C] -- C:\Programme\Ask.com
[2010.05.02 15:18:57 | 000,000,000 | ---D | C] -- C:\Programme\LimeWire
[2010.05.02 13:44:22 | 000,000,000 | ---D | C] -- C:\Programme\iTunes
[2010.05.02 13:44:22 | 000,000,000 | ---D | C] -- C:\Programme\iPod
[2010.05.02 13:43:14 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour
[2010.04.30 21:19:14 | 000,000,000 | ---D | C] -- C:\ProgramData\eMule
[2010.04.27 21:46:56 | 001,037,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\lsasrv.dll
[2010.04.27 21:46:56 | 000,133,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ksecpkg.sys
[2010.04.20 20:05:59 | 000,000,000 | ---D | C] -- C:\Users\Hoffmann\AppData\Roaming\Media Player Classic
[2010.04.19 22:38:53 | 000,278,528 | ---- | C] (Real Networks, Inc) -- C:\Windows\System32\pncrt.dll
[2010.04.19 22:38:53 | 000,185,920 | ---- | C] (RealNetworks, Inc.) -- C:\Windows\System32\rmoc3260.dll
[2010.04.19 22:38:53 | 000,006,656 | ---- | C] (RealNetworks, Inc.) -- C:\Windows\System32\pndx5016.dll
[2010.04.19 22:38:53 | 000,005,632 | ---- | C] (RealNetworks, Inc.) -- C:\Windows\System32\pndx5032.dll
[2010.04.19 22:38:52 | 000,839,680 | ---- | C] (hxxp://www.mp3dev.org/) -- C:\Windows\System32\lameACM.acm
[2010.04.19 22:38:52 | 000,217,088 | ---- | C] (www.helixcommunity.org) -- C:\Windows\System32\yv12vfw.dll
[2010.04.19 22:38:52 | 000,151,552 | ---- | C] (fccHandler) -- C:\Windows\System32\ac3acm.acm
[2010.04.19 22:38:51 | 000,685,056 | ---- | C] (DivX, Inc.) -- C:\Windows\System32\divx.dll
[2010.04.19 22:38:51 | 000,090,112 | ---- | C] (DivX, Inc.) -- C:\Windows\System32\dpl100.dll
[2010.04.19 22:38:49 | 000,000,000 | ---D | C] -- C:\Programme\K-Lite Codec Pack
[2010.04.19 21:59:25 | 000,000,000 | ---D | C] -- C:\Programme\DVBViewer TE2
[2010.04.19 19:07:54 | 000,000,000 | ---D | C] -- C:\Users\Hoffmann\Office Genuine Advantage
[3 C:\Users\Hoffmann\AppData\Roaming\*.tmp files -> C:\Users\Hoffmann\AppData\Roaming\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.05.15 18:54:51 | 001,310,720 | -HS- | M] () -- C:\Users\Hoffmann\NTUSER.DAT
[2010.05.15 18:51:53 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Users\Hoffmann\Desktop\OTL.exe
[2010.05.15 18:35:31 | 000,014,816 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.05.15 18:35:31 | 000,014,816 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.05.15 18:34:08 | 001,472,002 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.05.15 18:34:08 | 000,643,628 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.05.15 18:34:08 | 000,606,992 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.05.15 18:34:08 | 000,126,188 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.05.15 18:34:08 | 000,103,370 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.05.15 18:33:49 | 060,009,113 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm
[2010.05.15 18:28:16 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.05.15 18:28:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.05.15 18:28:08 | 2815,025,152 | -HS- | M] () -- C:\hiberfil.sys
[2010.05.14 12:56:36 | 002,667,127 | -H-- | M] () -- C:\Users\Hoffmann\AppData\Local\IconCache.db
[2010.05.14 12:56:36 | 000,003,785 | -HS- | M] () -- C:\Users\Hoffmann\AppData\Roaming\02000000c7715bfb899P.manifest
[2010.05.14 12:55:08 | 000,000,817 | ---- | M] () -- C:\ProgramData\372525997
[2010.05.14 09:04:44 | 000,283,648 | ---- | M] () -- C:\ProgramData\certmgr32.dll
[2010.05.14 08:04:41 | 000,283,648 | ---- | M] () -- C:\ProgramData\catsrvps32.dll
[2010.05.14 07:19:51 | 000,000,040 | ---- | M] () -- C:\Users\Hoffmann\AppData\Roaming\46b44caa
[2010.05.14 07:16:26 | 000,001,835 | ---- | M] () -- C:\Users\Hoffmann\Desktop\CCleaner.lnk
[2010.05.13 14:22:56 | 000,000,983 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.05.13 13:57:08 | 000,000,981 | -HS- | M] () -- C:\ProgramData\1180965885
[2010.05.13 13:56:49 | 000,000,051 | -HS- | M] () -- C:\Users\Hoffmann\AppData\Roaming\02000000c7715bfb899C.manifest
[2010.05.13 13:56:49 | 000,000,011 | -HS- | M] () -- C:\Users\Hoffmann\AppData\Roaming\02000000c7715bfb899S.manifest
[2010.05.13 13:56:49 | 000,000,011 | -HS- | M] () -- C:\Users\Hoffmann\AppData\Roaming\02000000c7715bfb899O.manifest
[2010.05.02 15:34:09 | 000,000,113 | ---- | M] () -- C:\ProgramData\sl663062895
[2010.05.02 15:33:54 | 000,203,776 | -HS- | M] () -- C:\ProgramData\unrar.exe
[2010.05.02 15:20:15 | 000,001,823 | ---- | M] () -- C:\Users\Hoffmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk
[2010.05.02 15:19:01 | 000,001,865 | ---- | M] () -- C:\Users\Hoffmann\Desktop\LimeWire 5.5.8.lnk
[2010.05.02 13:44:31 | 000,002,429 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.04.29 12:19:24 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.04.29 12:19:14 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.04.26 19:58:15 | 000,242,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgtdix.sys
[2010.04.19 21:59:29 | 000,000,957 | ---- | M] () -- C:\Users\Hoffmann\Desktop\DVBViewer TE2.lnk
[3 C:\Users\Hoffmann\AppData\Roaming\*.tmp files -> C:\Users\Hoffmann\AppData\Roaming\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.05.14 09:04:44 | 000,283,648 | ---- | C] () -- C:\ProgramData\certmgr32.dll
[2010.05.14 08:04:41 | 000,283,648 | ---- | C] () -- C:\ProgramData\catsrvps32.dll
[2010.05.14 07:16:26 | 000,001,835 | ---- | C] () -- C:\Users\Hoffmann\Desktop\CCleaner.lnk
[2010.05.13 14:22:56 | 000,000,983 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.05.09 17:56:20 | 000,000,040 | ---- | C] () -- C:\Users\Hoffmann\AppData\Roaming\46b44caa
[2010.05.02 15:34:18 | 000,000,981 | -HS- | C] () -- C:\ProgramData\1180965885
[2010.05.02 15:34:17 | 000,000,817 | ---- | C] () -- C:\ProgramData\372525997
[2010.05.02 15:34:09 | 000,000,113 | ---- | C] () -- C:\ProgramData\sl663062895
[2010.05.02 15:33:54 | 000,203,776 | -HS- | C] () -- C:\ProgramData\unrar.exe
[2010.05.02 15:33:40 | 000,003,785 | -HS- | C] () -- C:\Users\Hoffmann\AppData\Roaming\02000000c7715bfb899P.manifest
[2010.05.02 15:33:40 | 000,000,051 | -HS- | C] () -- C:\Users\Hoffmann\AppData\Roaming\02000000c7715bfb899C.manifest
[2010.05.02 15:33:40 | 000,000,011 | -HS- | C] () -- C:\Users\Hoffmann\AppData\Roaming\02000000c7715bfb899S.manifest
[2010.05.02 15:33:40 | 000,000,011 | -HS- | C] () -- C:\Users\Hoffmann\AppData\Roaming\02000000c7715bfb899O.manifest
[2010.05.02 15:20:15 | 000,001,823 | ---- | C] () -- C:\Users\Hoffmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk
[2010.05.02 15:19:01 | 000,001,865 | ---- | C] () -- C:\Users\Hoffmann\Desktop\LimeWire 5.5.8.lnk
[2010.05.02 13:44:31 | 000,002,429 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.04.19 22:38:53 | 000,165,376 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2010.04.19 22:38:53 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2010.04.19 22:38:52 | 000,881,664 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2010.04.19 22:38:52 | 000,205,824 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2010.04.19 22:38:52 | 000,000,414 | ---- | C] () -- C:\Windows\System32\lame_acm.xml
[2010.04.19 22:38:51 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2010.04.19 22:38:50 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2010.04.19 22:38:50 | 000,000,547 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll.manifest
[2010.04.19 21:59:29 | 000,000,957 | ---- | C] () -- C:\Users\Hoffmann\Desktop\DVBViewer TE2.lnk
[2010.04.10 15:43:50 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2010.04.05 20:49:48 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.03.31 15:43:46 | 000,073,728 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2010.03.31 15:40:55 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
[2009.08.03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.19 20:06:22 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
< End of report >

Extras.TXT

OTL Extras logfile created on: 15.05.2010 18:54:01 - Run 1
OTL by OldTimer - Version 3.2.4.1 Folder = C:\Users\Hoffmann\Downloads
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 64,00% Memory free
7,00 Gb Paging File | 6,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931,41 Gb Total Space | 899,38 Gb Free Space | 96,56% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 465,76 Gb Total Space | 196,18 Gb Free Space | 42,12% Space Free | Partition Type: NTFS

Computer Name: HOFFMANN-PC
Current User Name: Hoffmann
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{059A00AC-1205-423C-91C7-7E6168D804DA}" = MainConcept DTV Decoder Standard
"{134007CC-7026-46C2-B46F-40D9FD2AF385}" = Technisat DVB-VC80 Redistributable Modules
"{1C80931B-D271-A7E5-06D8-60C4D6DCCE69}" = Catalyst Control Center Graphics Previews Common
"{1FCA1E50-EB4B-1722-1605-721CECC3B6D7}" = Catalyst Control Center Graphics Light
"{1FF713E1-FE5E-4AD0-9C8C-B2E877846B45}" = Catalyst Control Center - Branding
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20C42E1C-A610-A423-C59A-432EFDFA6D97}" = ccc-utility
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23549DB2-183A-C2F1-F12A-4B20F386129A}" = CCC Help Greek
"{267D1BAE-B645-CC3E-468B-1E94846CB003}" = CCC Help Portuguese
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{382CC0FC-CC76-8BF1-D595-9172077A67AD}" = CCC Help Japanese
"{38E84C0B-74F8-2CD7-8401-9A9638676061}" = CCC Help Spanish
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = Gigabyte Raid Cinfigurer
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{4511950B-88F9-302E-77F2-C953EF8045F8}" = Catalyst Control Center HydraVision Full
"{49FDA7D8-B293-2E8B-19F3-0F10C110C4CC}" = CCC Help French
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5217C537-271A-0628-11CE-A8AFB79D8773}" = CCC Help Finnish
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{5DB65884-C963-4454-AABA-4CA3089281FA}" = NVIDIA PhysX
"{5E1DE2DE-71B7-5C37-A8D2-949C143C863D}" = Catalyst Control Center Graphics Previews Vista
"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{663F286D-DABF-F3D1-ECAB-6F3BF3B190CC}" = CCC Help Swedish
"{72326BD4-7E8C-D36E-AC40-084595B034F6}" = CCC Help Korean
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{87BB78C4-F36D-4D93-A7C7-F80F18219848}" = AMD DnD V1.0.19
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows Vista and Later
"{8A253629-0511-4854-8B4E-46E57E66005C}" = Bonjour
"{8DC58529-0378-E6F7-2FC1-3CC62F4F01FF}" = CCC Help Thai
"{8E5EAB78-59D0-9C95-4907-E50E359E7E5E}" = HydraVision
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{9041E63C-4B43-3E1A-F316-38FE2E6C614A}" = CCC Help Russian
"{93F22EEC-DAD6-1D0D-E208-03FDA1B58F01}" = Catalyst Control Center InstallProxy
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{98DA6BEA-8C70-EF24-730C-7695D1176256}" = CCC Help Czech
"{9D608D83-6198-F009-1B50-3A55F937E305}" = CCC Help Chinese Standard
"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support
"{A09E489C-BF64-FC3C-C823-9C5FDD19FE28}" = CCC Help Norwegian
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3 - Deutsch
"{AD0EE5BD-B8C0-9ACB-678A-C1AD9AC0BA60}" = ccc-core-static
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B2580E5E-F617-EAE5-04B2-0C49FAC1E24F}" = Catalyst Control Center Graphics Full Existing
"{BBF0A67B-5DBA-452F-9D2E-6F168BC226E4}" = Need for Speed™ SHIFT
"{BF24E54D-77C1-CDF8-054C-133FBB71EE90}" = Catalyst Control Center Graphics Full New
"{C07A746C-E1A1-C0C3-A30C-EFB5ECE184C3}" = Catalyst Control Center Core Implementation
"{C2C60D9F-0D6E-188C-1ADE-9DC3BF6ADA93}" = CCC Help Hungarian
"{C2F9FF21-946D-8907-A45B-DF1414F43316}" = Catalyst Control Center Localization All
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C849A1C0-B8CB-1BB0-62BB-362C2851FD0F}" = CCC Help German
"{C9018568-C473-4BE3-49B0-D2DC974519C4}" = CCC Help Chinese Traditional
"{CB15CAEF-32C9-1217-84A1-63B3017CAD05}" = ATI AVIVO Codecs
"{CF2C9A13-51A0-5640-0F57-76EC9A404D89}" = CCC Help Italian
"{D032A7F0-8B5C-4603-8B46-235025D5F9C1}" = TechniSat DVB-PC TV Star
"{D1144D23-122B-35C1-9B51-25580A159117}" = CCC Help Turkish
"{D5A9DA4B-E4F9-FB49-017D-769FC540F1F0}" = EA Download Manager UI
"{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver
"{D80F2034-D389-736D-761C-68E114450D10}" = ATI Catalyst Install Manager
"{D9BEB973-E4E0-18A8-3910-EB7A5D93C93C}" = CCC Help Danish
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EE8E5082-A83B-CFDA-964D-1F9F134F6D2E}" = CCC Help Dutch
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6F8D4EB-19B5-F561-B3FA-39467F65943F}" = CCC Help English
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{F937EBB7-E475-DE6C-6CE7-46BDF5B12A4B}" = CCC Help Polish
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AVG9Uninstall" = AVG Free 9.0
"CCleaner" = CCleaner
"com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Download Manager UI
"DVBViewer TE2_is1" = DVBViewer TE2
"EA Download Manager" = EA Download Manager
"InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 5.8.3
"LimeWire" = LimeWire 5.5.8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"WinLiveSuite_Wave3" = Windows Live Essentials

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 14.05.2010 08:54:06 | Computer Name = Hoffmann-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 5990

Error - 14.05.2010 08:54:07 | Computer Name = Hoffmann-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 14.05.2010 08:54:07 | Computer Name = Hoffmann-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7004

Error - 14.05.2010 08:54:07 | Computer Name = Hoffmann-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7004

Error - 14.05.2010 08:54:08 | Computer Name = Hoffmann-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 14.05.2010 08:54:08 | Computer Name = Hoffmann-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8003

Error - 14.05.2010 08:54:08 | Computer Name = Hoffmann-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8003

Error - 14.05.2010 08:54:09 | Computer Name = Hoffmann-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 14.05.2010 08:54:09 | Computer Name = Hoffmann-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9001

Error - 14.05.2010 08:54:09 | Computer Name = Hoffmann-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9001

[ System Events ]
Error - 02.05.2010 07:44:25 | Computer Name = Hoffmann-PC | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
des Dienstes "Apple Mobile Device" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen,
ist fehlgeschlagen. Fehler: %%1056

Error - 02.05.2010 07:48:57 | Computer Name = Hoffmann-PC | Source = DCOM | ID = 10010
Description =

Error - 09.05.2010 08:11:33 | Computer Name = Hoffmann-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst Schedule erreicht.

Error - 09.05.2010 09:27:15 | Computer Name = Hoffmann-PC | Source = Microsoft-Windows-HAL | ID = 12
Description = Der Speicher wurde beim letzten Leistungsübergang des Systems von
der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte
Firmware verfügbar ist.

Error - 09.05.2010 11:20:39 | Computer Name = Hoffmann-PC | Source = DCOM | ID = 10010
Description =

Error - 11.05.2010 11:56:55 | Computer Name = Hoffmann-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst ShellHWDetection erreicht.

Error - 11.05.2010 11:57:25 | Computer Name = Hoffmann-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst wuauserv erreicht.

Error - 11.05.2010 15:58:23 | Computer Name = Hoffmann-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst lmhosts erreicht.

Error - 14.05.2010 03:14:21 | Computer Name = Hoffmann-PC | Source = Microsoft-Windows-HAL | ID = 12
Description = Der Speicher wurde beim letzten Leistungsübergang des Systems von
der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte
Firmware verfügbar ist.

Error - 14.05.2010 08:54:10 | Computer Name = Hoffmann-PC | Source = Microsoft-Windows-HAL | ID = 12
Description = Der Speicher wurde beim letzten Leistungsübergang des Systems von
der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte
Firmware verfügbar ist.


< End of report >

Ich denke dann müsste ja jetzt alles in Ordnung sein.

Gruss Gerhard

Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
O2 - BHO: (no name) - {18DD0F98-BBA2-45D5-A3E3-0A8FC293449e} - C:\ProgramData\cngprovider32.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (LimeWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Programme\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (LimeWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Programme\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (LimeWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O20 - AppInit_DLLs: (C:\Windows\system32\d3d932.dll) - C:\Windows\System32\d3d932.dll File not found
[2010.05.14 12:55:08 | 000,000,817 | ---- | M] () -- C:\ProgramData\372525997
[2010.05.14 09:04:44 | 000,283,648 | ---- | M] () -- C:\ProgramData\certmgr32.dll
[2010.05.14 08:04:41 | 000,283,648 | ---- | M] () -- C:\ProgramData\catsrvps32.dll
[2010.05.14 07:19:51 | 000,000,040 | ---- | M] () -- C:\Users\Hoffmann\AppData\Roaming\46b44caa
[2010.05.13 13:57:08 | 000,000,981 | -HS- | M] () -- C:\ProgramData\1180965885
[2010.05.13 13:56:49 | 000,000,051 | -HS- | M] () -- C:\Users\Hoffmann\AppData\Roaming\02000000c7715bfb899C.manifest
[2010.05.13 13:56:49 | 000,000,011 | -HS- | M] () -- C:\Users\Hoffmann\AppData\Roaming\02000000c7715bfb899S.manifest
[2010.05.13 13:56:49 | 000,000,011 | -HS- | M] () -- C:\Users\Hoffmann\AppData\Roaming\02000000c7715bfb899O.manifest
[2010.05.02 15:34:09 | 000,000,113 | ---- | M] () -- C:\ProgramData\sl663062895
:Commands
[purity]
[resethosts]
[emptytemp]
         

Klick dann auf den Button Run Fixes!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Hi. Sorry für die Verspätung. Hatte den PC während der ganzen Woche nich benutzt da ich keine Zeit hatte.

Ich habe das wie von dir beschrieben gemacht.
Dies ist das ergebniss.

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DD0F98-BBA2-45D5-A3E3-0A8FC293449e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18DD0F98-BBA2-45D5-A3E3-0A8FC293449e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
C:\Programme\Ask.com\GenericAskToolbar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ deleted successfully.
C:\Programme\AVG\AVG9\Toolbar\IEToolbar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
File C:\Programme\AVG\AVG9\Toolbar\IEToolbar.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\Windows\system32\d3d932.dll deleted successfully.
C:\ProgramData\372525997 moved successfully.
File C:\ProgramData\certmgr32.dll not found.
File C:\ProgramData\catsrvps32.dll not found.
C:\Users\Hoffmann\AppData\Roaming\46b44caa moved successfully.
C:\ProgramData\1180965885 moved successfully.
C:\Users\Hoffmann\AppData\Roaming\02000000c7715bfb899C.manifest moved successfully.
C:\Users\Hoffmann\AppData\Roaming\02000000c7715bfb899S.manifest moved successfully.
C:\Users\Hoffmann\AppData\Roaming\02000000c7715bfb899O.manifest moved successfully.
C:\ProgramData\sl663062895 moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 41620 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Hoffmann
->Temp folder emptied: 1831400 bytes
->Temporary Internet Files folder emptied: 5977361 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 63080082 bytes
->Flash cache emptied: 42838 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 68,00 mb


OTL by OldTimer - Version 3.2.4.1 log created on 05212010_232546

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


Gruss goerdi

Ok. Dann mach mal jetzt nen Durchgang mti CF:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

• Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

• Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

• Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

• Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
  Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

• Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.