DR/FakePic.gen Malware, Bilder verschwunden

GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2010-12-16 16:55:31
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 SAMSUNG_SP2514N rev.VF100-41
Running: gmer.exe; Driver: C:\DOKUME~1\Admin\LOKALE~1\Temp\pxtdapoc.sys


---- System - GMER 1.0.15 ----

SSDT   F7E390EE                                                                      ZwCreateKey
SSDT   F7E390E4                                                                      ZwCreateThread
SSDT   F7E390F3                                                                      ZwDeleteKey
SSDT   F7E390FD                                                                      ZwDeleteValueKey
SSDT   F7E39102                                                                      ZwLoadKey
SSDT   F7E390D0                                                                      ZwOpenProcess
SSDT   F7E390D5                                                                      ZwOpenThread
SSDT   F7E3910C                                                                      ZwReplaceKey
SSDT   F7E39107                                                                      ZwRestoreKey
SSDT   F7E390F8                                                                      ZwSetValueKey

---- User code sections - GMER 1.0.15 ----

.text  C:\Programme\Mozilla Firefox\firefox.exe[2444] ntdll.dll!LdrLoadDll           7C9263C3 5 Bytes  JMP 004013F0 C:\Programme\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text  C:\Programme\Mozilla Firefox\firefox.exe[2444] kernel32.dll!CreateFileW       7C810800 5 Bytes  JMP 01102150 C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\FLVService\lib\FLVSrvLib.dll (FLV Service Library for Ask and Record Toolbar/Applian Technologies, Inc.)
.text  C:\Programme\Mozilla Firefox\firefox.exe[2444] kernel32.dll!GetTempFileNameW  7C8359E7 5 Bytes  JMP 011018E0 C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\FLVService\lib\FLVSrvLib.dll (FLV Service Library for Ask and Record Toolbar/Applian Technologies, Inc.)

---- Disk sectors - GMER 1.0.15 ----

Disk   \Device\Harddisk0\DR0                                                         sector 61: malicious code @ sector 0x1d1c4581 size 0x1af

---- EOF - GMER 1.0.15 ----
         

OTL logfile created on: 16.12.2010 17:06:09 - Run 2
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Dokumente und Einstellungen\All Users\Desktop\MFtools
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.023,00 Mb Total Physical Memory | 698,00 Mb Available Physical Memory | 68,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 89,00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 48,83 Gb Total Space | 22,42 Gb Free Space | 45,91% Space Free | Partition Type: NTFS
Drive D: | 465,75 Gb Total Space | 337,74 Gb Free Space | 72,51% Space Free | Partition Type: NTFS
Drive E: | 79,16 Gb Total Space | 5,46 Gb Free Space | 6,90% Space Free | Partition Type: NTFS
 
Computer Name: DIRK | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2010.12.15 21:06:21 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\All Users\Desktop\MFtools\OTL.exe
PRC - [2010.12.09 19:00:57 | 000,267,944 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.12.08 22:15:44 | 000,063,360 | ---- | M] (DivX, LLC) -- C:\Programme\DIVX\DivX Plus Web Player\DDMService.exe
PRC - [2010.12.08 20:17:46 | 001,226,608 | ---- | M] () -- C:\Programme\DIVX\DivX Update\DivXUpdate.exe
PRC - [2010.08.02 16:09:38 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2010.08.02 16:09:32 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.05.14 11:44:46 | 000,248,552 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2010.01.08 00:51:02 | 000,380,928 | ---- | M] (Spigot, Inc.) -- C:\Programme\Application Updater\ApplicationUpdater.exe
PRC - [2009.09.22 21:09:02 | 000,156,672 | ---- | M] (Applian Technologies, Inc.) -- C:\Programme\Replay Media Catcher\FLVSrvc.exe
PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.09.29 11:55:14 | 000,057,344 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) -- C:\Programme\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
PRC - [2005.11.11 14:07:00 | 000,090,112 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\soundman.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2010.12.16 16:27:52 | 000,012,800 | ---- | M] (Applian Technologies, Inc.) -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\FLVService\lib\FLVSrvLib.dll
MOD - [2010.12.15 21:06:21 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\All Users\Desktop\MFtools\OTL.exe
MOD - [2010.08.23 17:11:46 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2009.02.27 17:41:26 | 000,311,296 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010.12.09 19:00:57 | 000,267,944 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.11.20 11:03:54 | 000,068,096 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe -- (Macromedia Licensing Service)
SRV - [2010.08.02 16:09:38 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.01.08 00:51:02 | 000,380,928 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Programme\Application Updater\ApplicationUpdater.exe -- (Application Updater)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2010.12.09 19:00:58 | 000,135,096 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.11.22 19:02:32 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.06.17 15:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.06.17 15:26:52 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008.04.14 00:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2008.04.14 00:06:40 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2005.11.22 14:44:00 | 003,804,416 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcxwdm.sys -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2004.08.03 22:31:36 | 000,032,768 | ---- | M] (SiS Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sisnic.sys -- (SISNIC)
DRV - [2004.08.03 22:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2001.08.17 14:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)
DRV - [2000.07.24 01:01:00 | 000,019,537 | ---- | M] (Brother Industries Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\BrPar.sys -- (BrPar)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Programme\Freeware.de\tbFre0.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\SearchSettings.dll (Spigot, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "LEO Eng-Deu"
FF - prefs.js..browser.startup.homepage: "hxxp://www.web.de/fm"
FF - prefs.js..extensions.enabledItems: de-DE@dictionaries.addons.mozilla.org:1.0.1
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.2.1
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.658
FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.6
 
FF - HKLM\software\mozilla\Firefox\extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Programme\DivX\DivX Plus Web Player\firefox\html5video [2010.12.09 18:10:35 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Programme\DivX\DivX Plus Web Player\firefox\wpa [2010.12.09 18:10:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.12.12 21:49:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.12.12 21:49:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Programme\Mozilla Sunbird\components [2010.11.15 16:31:53 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Programme\Mozilla Sunbird\plugins [2010.12.09 18:10:35 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2010.12.11 22:23:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins [2010.12.09 18:10:35 | 000,000,000 | ---D | M]
 
[2010.11.15 16:26:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Extensions
[2010.11.14 18:16:26 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.11.15 16:26:14 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
[2010.11.14 18:16:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Extensions\MediaCoder
[2010.11.14 18:16:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Extensions\MediaCoder-Setup-Wizard
[2010.12.15 22:59:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\cyqo2ykd.default\extensions
[2010.11.14 18:22:55 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\cyqo2ykd.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.12.14 12:51:42 | 000,000,000 | ---D | M] (Freeware.de Community Toolbar) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\cyqo2ykd.default\extensions\{7e111a5c-3d11-4f56-9463-5310c3c69025}
[2010.11.14 18:22:55 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\cyqo2ykd.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}
[2010.12.09 23:07:51 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\cyqo2ykd.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010.11.14 18:22:55 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\cyqo2ykd.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}
[2010.12.14 07:06:22 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\cyqo2ykd.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.12.14 12:51:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\cyqo2ykd.default\extensions\engine@conduit.com
[2010.11.14 18:19:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\---cyqo2ykd.default\extensions
[2010.11.14 18:17:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\ej2t9k7c.default\extensions
[2010.11.14 18:16:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\zolq5tar.default\extensions
[2010.11.14 18:16:29 | 000,000,000 | ---D | M] (Web Developer) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\zolq5tar.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
[2010.11.14 18:16:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\zolq5tar.default\extensions\bkmrksync@nokia.com
[2010.11.14 18:16:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\zolq5tar.default\extensions\de-DE@dictionaries.addons.mozilla.org
[2010.11.14 18:16:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\zolq5tar.default\extensions\firebug@software.joehewitt.com
[2010.11.15 16:33:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Sunbird\Profiles\j52k675f.default\extensions
[2010.11.15 16:33:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Sunbird\Profiles\zozu9f8w.default\extensions
[2008.02.07 16:37:52 | 000,001,878 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\zolq5tar.default\searchplugins\aolsearch.xml
[2010.12.15 22:59:32 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.11.16 12:45:42 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010.09.15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.10.27 06:44:13 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.10.27 06:44:13 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.10.27 06:44:13 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.10.27 06:44:13 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.10.27 06:44:13 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2001.08.18 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DIVX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DIVX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Programme\Freeware.de\tbFre0.dll (Conduit Ltd.)
O2 - BHO: (SearchSettings Class) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\SearchSettings.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Programme\Freeware.de\tbFre0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Freeware.de Toolbar) - {7E111A5C-3D11-4F56-9463-5310C3C69025} - C:\Programme\Freeware.de\tbFre0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Ask and Record FLV Service] C:\Programme\Replay Media Catcher\FLVSrvc.exe (Applian Technologies, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DivX Download Manager] C:\Programme\DivX\DivX Plus Web Player\DDmService.exe (DivX, LLC)
O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [SearchSettings] C:\Programme\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\Admin\Startmenü\Programme\Autostart\Mozilla Sunbird.lnk = C:\Programme\Mozilla Sunbird\sunbird.exe (Mozilla)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\LUMIX Simple Viewer.lnk = C:\Programme\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe (Matsushita Electric Industrial Co., Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 253
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1289761714234 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.11.14 15:22:07 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - Services: "ERSvc"
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Admin^Startmenü^Programme^Autostart^OpenOffice.org 3.2.lnk - C:\Programme\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: MSMSGS - hkey= - key= - C:\Programme\Messenger\msmsgs.exe (Microsoft Corporation)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 2
 
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.I420 - C:\WINDOWS\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.iyuv - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: vidc.uyvy - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: vidc.yuy2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)
Drivers32: vidc.yvu9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvyu - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902053519425536)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.12.16 13:35:07 | 000,181,688 | ---- | C] (SoftwareNetz) -- C:\WINDOWS\snui.exe
[2010.12.16 13:35:04 | 000,000,000 | ---D | C] -- C:\Softwarenetz
[2010.12.16 13:34:07 | 000,000,000 | ---D | C] -- C:\Programme\Haushaltsbuch2
[2010.12.16 08:35:27 | 000,000,000 | ---D | C] -- C:\Programme\MSXML 4.0
[2010.12.15 21:31:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010.12.15 21:31:08 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT
[2010.12.15 21:24:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Malwarebytes
[2010.12.15 21:24:37 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.12.15 21:24:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.12.15 21:24:32 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.12.15 21:24:31 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.12.15 21:06:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Desktop\MFtools
[2010.12.15 21:05:19 | 000,000,000 | ---D | C] -- C:\Programme\Virenhelfer
[2010.12.15 20:13:52 | 000,000,000 | ---D | C] -- C:\Programme\DigitalImagaRecovery
[2010.12.15 15:58:53 | 000,000,000 | ---D | C] -- C:\Programme\Convar
[2010.12.15 15:58:52 | 000,516,784 | R--- | C] (Xceed Software Inc        (450) 442-2626        support@xceedsoft.com        www.xceedsoft.com) -- C:\WINDOWS\System32\XceedCry.dll
[2010.12.15 15:58:52 | 000,217,088 | ---- | C] (Dart Communications) -- C:\WINDOWS\System32\DartSock.dll
[2010.12.15 15:58:52 | 000,118,784 | ---- | C] (Dart Communications) -- C:\WINDOWS\System32\DartWeb.dll
[2010.12.15 13:24:16 | 000,000,000 | ---D | C] -- C:\Programme\SD-Formatter
[2010.12.15 12:47:17 | 000,090,112 | RHS- | C] (-) -- C:\WINDOWS\System32\TTADSSplitter.ax
[2010.12.15 12:47:17 | 000,090,112 | RHS- | C] (-) -- C:\WINDOWS\System32\TTADSDecoder.ax
[2010.12.15 12:47:16 | 000,278,528 | ---- | C] (Real Networks, Inc) -- C:\WINDOWS\System32\pncrt.dll
[2010.12.15 12:47:16 | 000,216,064 | RHS- | C] (MONOGRAM Multimedia, s.r.o.) -- C:\WINDOWS\System32\nbDX.dll
[2010.12.15 12:47:16 | 000,161,792 | RHS- | C] (Gabest) -- C:\WINDOWS\System32\RealMediaDX.ax
[2010.12.15 12:47:15 | 000,169,472 | RHS- | C] (Gabest) -- C:\WINDOWS\System32\MatroskaDX.ax
[2010.12.15 12:47:15 | 000,163,328 | RHS- | C] (Gabest) -- C:\WINDOWS\System32\flvDX.dll
[2010.12.15 12:47:15 | 000,031,232 | RHS- | C] (Hans Mayerl) -- C:\WINDOWS\System32\msfDX.dll
[2010.12.15 12:47:14 | 000,123,904 | RHS- | C] (CoreCodec) -- C:\WINDOWS\System32\AVCDX.ax
[2010.12.15 12:38:06 | 000,719,872 | ---- | C] (Abysmal Software) -- C:\WINDOWS\System32\devil.dll
[2010.12.15 12:38:06 | 000,369,152 | ---- | C] (The Public) -- C:\WINDOWS\System32\avisynth.dll
[2010.12.15 12:38:02 | 000,070,656 | ---- | C] (www.helixcommunity.org) -- C:\WINDOWS\System32\yv12vfw.dll
[2010.12.15 12:38:01 | 000,070,656 | ---- | C] (www.helixcommunity.org) -- C:\WINDOWS\System32\i420vfw.dll
[2010.12.15 12:37:56 | 000,000,000 | ---D | C] -- C:\Programme\AviSynth 2.5
[2010.12.15 12:37:41 | 000,186,880 | RHS- | C] (RadLight) -- C:\WINDOWS\System32\RLOgg.ax
[2010.12.15 12:37:41 | 000,092,672 | RHS- | C] (RadLight) -- C:\WINDOWS\System32\RLVorbisDec.ax
[2010.12.15 12:37:41 | 000,067,584 | RHS- | C] (RadLight, LLC) -- C:\WINDOWS\System32\RLTheoraDec.ax
[2010.12.15 12:37:40 | 000,179,200 | RHS- | C] (Gabest) -- C:\WINDOWS\System32\DiracSplitter.ax
[2010.12.15 12:36:45 | 000,000,000 | ---D | C] -- C:\Programme\SUPER
[2010.12.15 11:45:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\XMedia Recode
[2010.12.15 11:19:15 | 000,000,000 | ---D | C] -- C:\Programme\Xmedia-Recode
[2010.12.14 16:30:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Search Settings
[2010.12.14 16:30:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Dealio
[2010.12.14 16:29:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Lingo4u
[2010.12.14 13:28:51 | 000,000,000 | ---D | C] -- C:\.multiTH
[2010.12.14 13:09:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\HamsterSoft
[2010.12.14 12:51:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Freeware.de
[2010.12.14 12:51:28 | 000,000,000 | ---D | C] -- C:\Programme\Conduit
[2010.12.14 12:51:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Conduit
[2010.12.14 12:51:23 | 000,000,000 | ---D | C] -- C:\Programme\ConduitEngine
[2010.12.14 12:51:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\ConduitEngine
[2010.12.14 12:51:20 | 000,000,000 | ---D | C] -- C:\Programme\Freeware.de
[2010.12.14 12:51:06 | 000,139,264 | ---- | C] (hxxp://www.xvid.org) -- C:\WINDOWS\System32\xvid.ax
[2010.12.14 12:27:33 | 000,000,000 | ---D | C] -- C:\Programme\Search Settings
[2010.12.14 12:27:25 | 000,000,000 | ---D | C] -- C:\Programme\Dealio Toolbar
[2010.12.14 12:27:25 | 000,000,000 | ---D | C] -- C:\Programme\Application Updater
[2010.12.14 12:26:51 | 000,000,000 | ---D | C] -- C:\Programme\Free HD Converter
[2010.12.14 12:25:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\GetRightToGo
[2010.12.14 12:11:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\AVS4YOU
[2010.12.14 12:10:28 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\AVSMedia
[2010.12.14 12:10:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\umdf
[2010.12.14 12:09:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVS4YOU
[2010.12.14 12:06:09 | 000,000,000 | ---D | C] -- C:\Programme\AVCHD-Converter
[2010.12.14 00:18:28 | 000,000,000 | ---D | C] -- C:\finalburner
[2010.12.14 00:17:14 | 000,000,000 | ---D | C] -- C:\Programme\FinalBurner
[2010.12.13 11:20:02 | 000,000,000 | ---D | C] -- C:\Programme\Image Optimizer
[2010.12.12 17:04:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Desktop\EinladungLuc2011
[2010.12.10 20:45:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Desktop\SGA
[2010.12.10 18:00:33 | 000,156,672 | ---- | C] (Radioactive) -- C:\WINDOWS\System32\rmc_fixasf.exe
[2010.12.10 18:00:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Eigene Dateien\My Recordings
[2010.12.10 18:00:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\mdnslib
[2010.12.10 18:00:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Eigene Dateien\Ask and Record Toolbar
[2010.12.10 18:00:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\FLVService
[2010.12.10 18:00:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\Replay Media Catcher
[2010.12.10 18:00:01 | 000,000,000 | ---D | C] -- C:\Programme\Replay Media Catcher
[2010.12.10 17:58:34 | 000,000,000 | ---D | C] -- C:\Programme\MediaCatcher
[2010.12.10 17:49:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Temp
[2010.12.10 17:49:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Google
[2010.12.10 17:48:10 | 000,000,000 | ---D | C] -- C:\Programme\Google
[2010.12.10 15:05:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\dwhelper
[2010.12.09 22:17:36 | 000,000,000 | ---D | C] -- C:\Oscommerce
[2010.12.09 22:17:36 | 000,000,000 | ---D | C] -- C:\Joomla
[2010.12.09 22:17:36 | 000,000,000 | ---D | C] -- C:\CarSales
[2010.12.09 22:17:36 | 000,000,000 | ---D | C] -- C:\AGO
[2010.12.09 21:26:32 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\Admin\PrivacIE
[2010.12.09 18:10:39 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Admin\Eigene Dateien\Eigene Videos
[2010.12.09 18:10:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Local
[2010.12.09 18:10:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\DivX
[2010.12.09 18:10:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Eigene Dateien\DivX Movies
[2010.12.09 18:09:38 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\DivX Shared
[2010.12.09 18:08:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DivX
[2010.12.09 18:07:45 | 000,000,000 | ---D | C] -- C:\Programme\DIVX
[2010.12.08 18:01:03 | 000,000,000 | ---D | C] -- C:\Programme\KanalManager
[2010.12.06 19:33:12 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2010.12.06 19:26:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Leadertech
[2010.12.01 21:38:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\vlc
[2010.11.20 11:16:31 | 000,000,000 | ---D | C] -- C:\Programme\Dreamweaver MX
[2010.11.20 11:03:54 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Macromedia Shared
[2010.11.20 11:03:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision
[2010.11.20 11:00:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Application Data
[2010.11.19 09:49:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun
[2010.11.19 09:21:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Eigene Dateien\My Safes
[2010.11.19 09:20:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\PasswordSafe
[2010.11.19 09:18:55 | 000,000,000 | ---D | C] -- C:\Programme\Password Safe
[2010.11.17 18:08:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Panasonic
[2010.11.17 18:07:20 | 000,000,000 | ---D | C] -- C:\Programme\Panasonic
[2010.11.17 18:07:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\InstallShield
 
========== Files - Modified Within 30 Days ==========
 
[2010.12.16 16:54:00 | 000,001,208 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1292428093-179605362-839522115-1004UA.job
[2010.12.16 16:29:42 | 000,000,591 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\NTREGOPT.lnk
[2010.12.16 16:29:42 | 000,000,572 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\ERUNT.lnk
[2010.12.16 16:27:43 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.12.16 16:27:42 | 1073,274,880 | -HS- | M] () -- C:\hiberfil.sys
[2010.12.16 10:35:19 | 000,000,147 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\DRFakePic.gen - Alles abgarbeitet hier jetzt das defogger_disable wie gehts weiter - Trojaner-Board.URL
[2010.12.15 21:40:57 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\defogger_reenable
[2010.12.15 21:24:37 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.12.15 21:06:07 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\defogger.exe
[2010.12.15 21:06:05 | 000,288,107 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Gmer.zip
[2010.12.15 20:14:53 | 000,000,699 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Zero Assumption Recovery.lnk
[2010.12.15 18:14:05 | 000,000,154 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\noautoplay.reg
[2010.12.15 17:54:00 | 000,001,156 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1292428093-179605362-839522115-1004Core.job
[2010.12.15 15:28:58 | 000,035,840 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.12.15 15:20:38 | 000,134,072 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.12.15 14:38:58 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010.12.14 17:09:55 | 000,022,528 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Wolfgang Borchert+ Inhaltsangabe das Brot.doc
[2010.12.14 12:10:23 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2010.12.13 00:25:09 | 000,000,600 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\winscp.rnd
[2010.12.11 12:40:31 | 000,237,568 | ---- | M] () -- C:\WINDOWS\System32\rmc_rtspdl.dll
[2010.12.11 12:40:31 | 000,156,672 | ---- | M] (Radioactive) -- C:\WINDOWS\System32\rmc_fixasf.exe
[2010.12.09 19:00:58 | 000,135,096 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2010.12.08 14:19:17 | 000,000,137 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Samsung C-Serie Sendersortierung – Kanalmanager (z.B. UE46C770 , UE46C6820 , LE40C650 , LE40C750 ) Robin's Blog.URL
[2010.12.08 14:18:19 | 000,000,120 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Samsung LE37C650 - verschiedene Fragen (Senderbelegung) - Forum - AUDIO VIDEO FOTO BILD.URL
[2010.12.08 14:16:44 | 000,000,080 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Samsung Sendersortierung (Plasma, LCD, LED LCD – Model “C” 2010) Christine & Sven.URL
[2010.12.08 12:02:06 | 000,000,063 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Meine eBay Welt - alte-schinken.URL
[2010.12.07 19:13:00 | 000,000,155 | ---- | M] () -- C:\WINDOWS\Brownie.ini
[2010.12.05 19:58:36 | 000,000,354 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Eigene Dateien\Dateien(E).lnk
[2010.12.01 15:33:51 | 000,000,070 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\2246-Lions Club Ammerland Kalender.URL
[2010.11.29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.11.29 17:42:06 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.11.23 12:56:56 | 000,181,688 | ---- | M] (SoftwareNetz) -- C:\WINDOWS\snui.exe
[2010.11.22 19:02:32 | 000,061,960 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2010.11.17 18:07:20 | 000,000,671 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\LUMIX Simple Viewer.lnk
[2010.11.16 22:01:04 | 000,316,594 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2010.11.16 22:01:04 | 000,311,604 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.11.16 22:01:04 | 000,048,156 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2010.11.16 22:01:04 | 000,039,992 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
 
========== Files Created - No Company Name ==========
 
[2010.12.16 10:35:19 | 000,000,147 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\DRFakePic.gen - Alles abgarbeitet hier jetzt das defogger_disable wie gehts weiter - Trojaner-Board.URL
[2010.12.15 21:41:33 | 000,296,448 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\gmer.exe
[2010.12.15 21:40:57 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\defogger_reenable
[2010.12.15 21:31:08 | 000,000,591 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\NTREGOPT.lnk
[2010.12.15 21:31:08 | 000,000,572 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\ERUNT.lnk
[2010.12.15 21:24:37 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.12.15 21:06:07 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\defogger.exe
[2010.12.15 21:06:05 | 000,288,107 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Gmer.zip
[2010.12.15 20:14:53 | 000,000,699 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Zero Assumption Recovery.lnk
[2010.12.15 18:14:04 | 000,000,154 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\noautoplay.reg
[2010.12.15 15:58:52 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\Gif89.dll
[2010.12.15 15:58:52 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\DartWeb.oca
[2010.12.15 15:47:32 | 1073,274,880 | -HS- | C] () -- C:\hiberfil.sys
[2010.12.15 12:47:16 | 000,107,520 | RHS- | C] () -- C:\WINDOWS\System32\RLMPCDec.ax
[2010.12.15 12:47:16 | 000,070,656 | RHS- | C] () -- C:\WINDOWS\System32\RLAPEDec.ax
[2010.12.15 12:47:15 | 000,120,832 | RHS- | C] () -- C:\WINDOWS\System32\MPCDx.ax
[2010.12.15 12:47:15 | 000,097,280 | RHS- | C] () -- C:\WINDOWS\System32\FLACDX.ax
[2010.12.15 12:47:14 | 000,227,328 | RHS- | C] () -- C:\WINDOWS\System32\ac3DX.ax
[2010.12.15 12:38:06 | 000,408,576 | ---- | C] () -- C:\WINDOWS\System32\Smab.dll
[2010.12.15 12:38:02 | 000,066,560 | ---- | C] () -- C:\WINDOWS\MOTA113.exe
[2010.12.15 12:38:02 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2010.12.15 12:38:01 | 000,502,784 | ---- | C] () -- C:\WINDOWS\x2.64.exe
[2010.12.15 12:38:01 | 000,240,128 | ---- | C] () -- C:\WINDOWS\System32\x.264.exe
[2010.12.15 12:38:01 | 000,217,073 | ---- | C] () -- C:\WINDOWS\meta4.exe
[2010.12.15 12:37:41 | 000,051,712 | RHS- | C] () -- C:\WINDOWS\System32\RLSpeexDec.ax
[2010.12.15 12:37:40 | 000,175,104 | RHS- | C] () -- C:\WINDOWS\System32\CoreAAC.ax
[2010.12.15 12:37:40 | 000,081,920 | RHS- | C] () -- C:\WINDOWS\System32\aac_parser.ax
[2010.12.14 17:09:55 | 000,022,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Wolfgang Borchert+ Inhaltsangabe das Brot.doc
[2010.12.14 12:51:06 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010.12.14 12:51:05 | 000,758,018 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010.12.10 18:00:33 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\rmc_rtspdl.dll
[2010.12.10 17:49:36 | 000,001,208 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1292428093-179605362-839522115-1004UA.job
[2010.12.10 17:49:35 | 000,001,156 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1292428093-179605362-839522115-1004Core.job
[2010.12.08 14:19:17 | 000,000,137 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Samsung C-Serie Sendersortierung – Kanalmanager (z.B. UE46C770 , UE46C6820 , LE40C650 , LE40C750 ) Robin's Blog.URL
[2010.12.08 14:18:19 | 000,000,120 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Samsung LE37C650 - verschiedene Fragen (Senderbelegung) - Forum - AUDIO VIDEO FOTO BILD.URL
[2010.12.08 14:16:44 | 000,000,080 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Samsung Sendersortierung (Plasma, LCD, LED LCD – Model “C” 2010) Christine & Sven.URL
[2010.12.08 12:02:06 | 000,000,063 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Meine eBay Welt - alte-schinken.URL
[2010.12.01 15:33:51 | 000,000,070 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\2246-Lions Club Ammerland Kalender.URL
[2010.11.17 18:08:12 | 000,111,932 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat
[2010.11.17 18:08:12 | 000,031,053 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat
[2010.11.17 18:08:12 | 000,027,417 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat
[2010.11.17 18:08:12 | 000,026,154 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat
[2010.11.17 18:08:12 | 000,024,903 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat
[2010.11.17 18:08:12 | 000,021,390 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat
[2010.11.17 18:08:12 | 000,020,148 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat
[2010.11.17 18:08:12 | 000,013,732 | ---- | C] () -- C:\WINDOWS\System32\EPPICLocal_EN.cfg
[2010.11.17 18:08:12 | 000,011,811 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat
[2010.11.17 18:08:12 | 000,006,442 | ---- | C] () -- C:\WINDOWS\System32\EPPICLocal_IT.cfg
[2010.11.17 18:08:12 | 000,006,347 | ---- | C] () -- C:\WINDOWS\System32\EPPICLocal_PT.cfg
[2010.11.17 18:08:12 | 000,006,347 | ---- | C] () -- C:\WINDOWS\System32\EPPICLocal_BP.cfg
[2010.11.17 18:08:12 | 000,006,335 | ---- | C] () -- C:\WINDOWS\System32\EPPICLocal_GE.cfg
[2010.11.17 18:08:12 | 000,006,195 | ---- | C] () -- C:\WINDOWS\System32\EPPICLocal_FR.cfg
[2010.11.17 18:08:12 | 000,006,195 | ---- | C] () -- C:\WINDOWS\System32\EPPICLocal_CF.cfg
[2010.11.17 18:08:12 | 000,006,122 | ---- | C] () -- C:\WINDOWS\System32\EPPICLocal_DU.cfg
[2010.11.17 18:08:12 | 000,006,103 | ---- | C] () -- C:\WINDOWS\System32\EPPICLocal_ES.cfg
[2010.11.17 18:08:12 | 000,005,817 | ---- | C] () -- C:\WINDOWS\System32\EPPICLocal_KO.cfg
[2010.11.17 18:08:12 | 000,005,436 | ---- | C] () -- C:\WINDOWS\System32\EPPICLocal_SC.cfg
[2010.11.17 18:08:12 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat
[2010.11.17 18:08:12 | 000,002,889 | ---- | C] () -- C:\WINDOWS\System32\EPPICLocal_RU.cfg
[2010.11.17 18:08:12 | 000,002,426 | ---- | C] () -- C:\WINDOWS\System32\EPPICLocal_TC.cfg
[2010.11.17 18:08:12 | 000,001,146 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_DU.dat
[2010.11.17 18:08:12 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2010.11.17 18:08:12 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2010.11.17 18:08:12 | 000,001,136 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2010.11.17 18:08:12 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2010.11.17 18:08:12 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2010.11.17 18:08:12 | 000,001,120 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_IT.dat
[2010.11.17 18:08:12 | 000,001,107 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_GE.dat
[2010.11.17 18:08:12 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2010.11.17 18:08:12 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2010.11.17 18:07:20 | 000,000,671 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\LUMIX Simple Viewer.lnk
[2010.11.16 09:38:27 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\winscp.rnd
[2010.11.15 17:50:47 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL
[2010.11.15 17:33:24 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010.11.15 16:59:45 | 000,035,840 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.11.15 16:44:17 | 000,000,155 | ---- | C] () -- C:\WINDOWS\Brownie.ini
[2010.11.15 16:44:17 | 000,000,141 | ---- | C] () -- C:\WINDOWS\BRVIDEO.INI
[2010.11.15 16:44:17 | 000,000,040 | ---- | C] () -- C:\WINDOWS\BRDIAG.INI
[2010.11.15 16:44:11 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\BROSNMP.DLL
[2010.11.15 16:44:11 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\BRGSRC32.DLL
[2010.11.15 16:44:11 | 000,004,608 | ---- | C] () -- C:\WINDOWS\System32\BRGSRC16.DLL
[2010.11.15 16:44:09 | 000,008,975 | ---- | C] () -- C:\WINDOWS\HL-2030.INI
[2010.11.15 16:43:06 | 000,000,416 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2010.11.14 21:08:02 | 000,157,184 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2010.11.14 15:15:15 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2001.08.18 13:00:00 | 000,249,270 | ---- | C] () -- C:\WINDOWS\System32\_005195_.tmp.dll
[2001.08.18 13:00:00 | 000,022,040 | ---- | C] () -- C:\WINDOWS\System32\_005163_.tmp.dll
 
========== LOP Check ==========
 
[2010.12.14 16:30:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Dealio
[2010.12.14 22:41:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\GetRightToGo
[2010.12.14 13:09:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\HamsterSoft
[2010.12.06 19:26:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Leadertech
[2010.12.14 16:29:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Lingo4u
[2010.12.09 18:10:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Local
[2010.11.16 10:27:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\OpenOffice.org
[2010.11.17 18:08:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Panasonic
[2010.12.14 16:30:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Search Settings
[2010.11.14 18:26:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Thunderbird
[2010.12.15 11:45:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\XMedia Recode
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*.* >
[2010.11.14 15:22:07 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010.11.16 11:15:29 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2001.08.18 13:00:00 | 000,004,952 | RHS- | M] () -- C:\bootfont.bin
[2010.11.14 15:22:07 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010.12.16 16:27:42 | 1073,274,880 | -HS- | M] () -- C:\hiberfil.sys
[2010.11.14 15:22:07 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010.11.14 15:22:07 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010.11.14 16:28:07 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2010.11.14 19:57:48 | 000,251,712 | RHS- | M] () -- C:\ntldr
[2010.12.16 16:27:41 | 1610,612,736 | -HS- | M] () -- C:\pagefile.sys
 
< %systemroot%\system32\*.wt >
 
< %systemroot%\system32\*.ruy >
 
< %systemroot%\Fonts\*.com >
 
< %systemroot%\Fonts\*.dll >
 
< %systemroot%\Fonts\*.ini >
[2010.11.14 15:21:50 | 000,000,067 | ---- | M] () -- C:\WINDOWS\Fonts\desktop.ini
[6 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]
 
< %systemroot%\Fonts\*.ini2 >
 
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
 
< %systemroot%\REPAIR\*.bak1 >
 
< %systemroot%\REPAIR\*.ini >
 
< %systemroot%\system32\*.jpg >
 
< %systemroot%\*.scr >
 
< %systemroot%\*._sy >
 
< %APPDATA%\Adobe\Update\*.* >
 
< %ALLUSERSPROFILE%\Favorites\*.* >
 
< %APPDATA%\Microsoft\*.* >
 
< %PROGRAMFILES%\*.* >
 
< %APPDATA%\Update\*.* >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %systemroot%\Tasks\*.job /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2010.11.14 16:13:33 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2010.11.14 16:13:33 | 000,610,304 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2010.11.14 16:13:33 | 000,417,792 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\system32\user32.dll /md5 >
[2008.04.14 07:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< %systemroot%\system32\ws2_32.dll /md5 >
[2008.04.14 07:52:34 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=6A35E2D6F5F052C84EC2CEB296389439 -- C:\WINDOWS\system32\ws2_32.dll
 
< %systemroot%\system32\ws2help.dll /md5 >
[2008.04.14 07:52:34 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=C7D8A0517CBF16B84F657DE87EBE9D4B -- C:\WINDOWS\system32\ws2help.dll
 
 
< MD5 for: EXPLORER.EXE  >
[2004.08.04 00:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe
[2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\explorer.exe
 
< MD5 for: WINLOGON.EXE  >
[2004.08.04 00:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\winlogon.exe
[2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-12-16 07:35:29

< End of report >
         

OTL Extras logfile created on: 16.12.2010 16:58:03 - Run 1
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Dokumente und Einstellungen\All Users\Desktop\MFtools
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.023,00 Mb Total Physical Memory | 638,00 Mb Available Physical Memory | 62,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 85,00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 48,83 Gb Total Space | 22,42 Gb Free Space | 45,91% Space Free | Partition Type: NTFS
Drive D: | 465,75 Gb Total Space | 337,74 Gb Free Space | 72,51% Space Free | Partition Type: NTFS
Drive E: | 79,16 Gb Total Space | 5,46 Gb Free Space | 6,90% Space Free | Partition Type: NTFS
 
Computer Name: DIRK | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\WinSCP\WinSCP.exe" = C:\Programme\WinSCP\WinSCP.exe:*:Enabled:SFTP, FTP and SCP client -- (Martin Prikryl)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1A3E23D7-7A1E-43EC-B35D-EB8A31BED943}" = FinalBurner Free v2.9.0.151
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 22
"{2CDCCE7E-55D5-40CC-AEA0-ABA54713501F}" = LUMIX Simple Viewer
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3E885908-C639-4AD0-9FFD-4E623EE08E8B}" = Brother HL-2030
"{3F9FB449-93DB-4C47-BB5B-7334C4D1736E}" = SD Formatter
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F05C28D-DEA9-4AD6-A73A-064175988EAB}" = Search Settings v1.2.3
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.1 - Deutsch
"{C878CD69-85DB-426B-81A3-E71175AAEB91}" = Dealio Toolbar v4.0.2
"{C9A87D86-FDFD-418B-BF96-EF09320973B3}" = PC Inspector smart recovery
"{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}" = OpenOffice.org 3.2
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Illustrator 8.0" = Adobe Illustrator 8.0
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"conduitEngine" = Conduit Engine
"DivX Setup.divx.com" = DivX-Setup
"ERUNT_is1" = ERUNT 1.1j
"Freeware.de Toolbar" = Freeware.de Toolbar
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Mozilla Thunderbird (3.1.7)" = Mozilla Thunderbird (3.1.7)
"Password Safe" = Password Safe
"Replay Media Catcher 3.11" = Replay Media Catcher 3.11
"SUPER ©" = SUPER © Version 2010.bld.42 (Nov 7, 2010)
"VLC media player" = VLC media player 1.1.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR
"winscp3_is1" = WinSCP 4.1.8
"WMFDist11" = Windows Media Format 11 runtime
"XMedia Recode" = XMedia Recode 2.2.9.3
"Zero Assumption Recovery_is1" = Zero Assumption Recovery Version 9
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 11.12.2010 10:21:47 | Computer Name = DIRK | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x05289290.
 
Error - 11.12.2010 14:35:32 | Computer Name = DIRK | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x05769290.
 
Error - 14.12.2010 06:11:15 | Computer Name = DIRK | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x03a49290.
 
Error - 14.12.2010 17:42:43 | Computer Name = DIRK | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung tsmuxer.exe, Version 0.0.0.0, fehlgeschlagenes
 Modul tsmuxer.exe, Version 0.0.0.0, Fehleradresse 0x0006708b.
 
Error - 14.12.2010 17:42:55 | Computer Name = DIRK | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung tsmuxer.exe, Version 0.0.0.0, fehlgeschlagenes
 Modul tsmuxer.exe, Version 0.0.0.0, Fehleradresse 0x0006708b.
 
Error - 14.12.2010 17:43:12 | Computer Name = DIRK | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung tsmuxer.exe, Version 0.0.0.0, fehlgeschlagenes
 Modul tsmuxer.exe, Version 0.0.0.0, Fehleradresse 0x0006708b.
 
[ System Events ]
Error - 20.11.2010 07:07:17 | Computer Name = DIRK | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.
 
Error - 20.11.2010 07:07:17 | Computer Name = DIRK | Source = VolSnap | ID = 393230
Description = Die Schattenkopie von Volume "C:" wurde aufgrund eines E/A-Fehlers
 abgebrochen.
 
 
< End of report >