Hallo zusammen!

Habe auch das Problem mit dem Trojaner TR/Kazy.mekml.1
Könnt ihr mir eventuell weiter helfen?
Alle Ordner sind weg, kann nicht mehr auf die Festplatte zugreifen.
Danke schonmal vorweg!!

Ich habe schonmal im vorweg OTL drüberlaufen lassen. Folgendes kam beiweg:

OTL.txtOTL Logfile:

OTL logfile created on: 24.04.2011 13:04:14 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = E:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 75,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 298,09 Gb Total Space | 148,00 Gb Free Space | 49,65% Space Free | Partition Type: NTFS
Drive E: | 1,97 Gb Total Space | 1,96 Gb Free Space | 99,61% Space Free | Partition Type: FAT
 
Computer Name: TECRA | User Name: M.Schattke | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - E:\OTL.exe (OldTimer Tools)
PRC - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\YnnAflICEeXU.exe (WinTrust)
PRC - C:\Programme\Danfoss Drives\VLT Motion Control Tool\MCT 10 Set-up Software\MCTServ.exe ()
PRC - C:\Programme\Gemeinsame Dateien\Siemens\S7IEPG\s7oiehsx.exe (SIEMENS AG)
PRC - C:\Programme\Gemeinsame Dateien\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe (SIEMENS AG)
PRC - C:\Programme\Gemeinsame Dateien\Siemens\S7UBTOOX\S7ubTstx.exe (SIEMENS AG)
PRC - C:\Programme\Siemens\Step7\S7BIN\s7asysvx.exe (SIEMENS AG)
PRC - C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
PRC - C:\Programme\Gemeinsame Dateien\Siemens\SWS\almsrv\almsrvx.exe (SIEMENS AG)
PRC - C:\Programme\Siemens\Automation\Portal V10\Bin\Siemens.Automation.ObjectFrame.FileStorage.Server.exe (Siemens AG)
PRC - C:\FSP_5000_RPS\RAMV\Tools\TransferToolNet.exe (Bosch)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\FSP_5000_RPS\RAMV\Tools\TransferTool.exe (Bosch)
PRC - C:\Programme\TrueSuite Access Manager\CssSvr.exe (Arachnoid Biometrics Identification Group Corp.)
PRC - C:\Programme\TrueSuite Access Manager\PwdBank.exe (Arachnoid Biometrics Identification Group)
PRC - C:\Programme\TrueSuite Access Manager\FpNotifier.exe (AuthenTec, Inc)
PRC - C:\WINDOWS\system32\TAMSvr.exe (AuthenTec Inc.)
PRC - C:\Programme\Gemeinsame Dateien\Siemens\ALMPanelPlugin\ALMPanelPlugin.exe (Siemens AG)
PRC - C:\Programme\TrueSuite Access Manager\usbnotify.exe ()
PRC - C:\Programme\Toshiba\3GUty\tw3gsvc.exe (TOSHIBA CORPORATION)
PRC - C:\Programme\Toshiba\3GUty\tw3gctrl.exe (TOSHIBA CORPORATION)
PRC - C:\WINDOWS\system32\TFNF5.exe (TOSHIBA Corp.)
PRC - C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\Toshiba\TPHM\TPCHSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\Toshiba\TME3\TMERzCtl.exe (TOSHIBA)
PRC - C:\WINDOWS\system32\ThpSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Intel\Privacy Icon\UNS\UNS.exe (Intel Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Intel\Privacy Icon\PrivacyIconClient.exe (Intel Corporation)
PRC - C:\Programme\Intel\AMT\LMS.exe (Intel Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\attrib.exe (Microsoft Corporation)
PRC - c:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
PRC - C:\WINDOWS\system32\TODDSrv.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\system32\TPSMain.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\system32\TPSBattM.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
PRC - C:\Programme\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)
PRC - C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbsrv9.exe (iAnywhere Solutions, Inc.)
PRC - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation)
PRC - C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems)
PRC - C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corporation)
PRC - C:\Programme\Toshiba\TAudEffect\TAudEff.exe (TOSHIBA)
PRC - C:\Programme\Toshiba\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - C:\Programme\Toshiba\TME3\TMESRV31.exe (TOSHIBA)
PRC - C:\Programme\Toshiba\TOSHIBA Controls\TFncKy.exe (TOSHIBA Corporation)
PRC - C:\Programme\Toshiba\DualPointUtility\TEDTray.exe (TOSHIBA)
PRC - C:\Programme\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
PRC - C:\Programme\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Programme\Toshiba\TME3\TMEEJME.exe (TOSHIBA)
 
 
========== Modules (SafeList) ==========
 
MOD - E:\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\nview.dll ()
MOD - C:\WINDOWS\system32\nvwrsde.dll (NVIDIA Corporation)
MOD - C:\WINDOWS\system32\nvwddi.dll (NVIDIA Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (MCT10 Service) -- C:\Programme\Danfoss Drives\VLT Motion Control Tool\MCT 10 Set-up Software\MCTServ.exe ()
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (s7oiehsx) -- C:\Programme\Gemeinsame Dateien\Siemens\S7IEPG\s7oiehsx.exe (SIEMENS AG)
SRV - (S7TraceServiceX) -- C:\Programme\Gemeinsame Dateien\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe (SIEMENS AG)
SRV - (s7asysvx) -- C:\Programme\Siemens\Step7\S7BIN\s7asysvx.exe (SIEMENS AG)
SRV - (almservice) -- C:\Programme\Gemeinsame Dateien\Siemens\sws\almsrv\almsrvx.exe (SIEMENS AG)
SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Programme\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (McComponentHostService) -- C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (osppsvc) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (TransferToolNet) -- C:\FSP_5000_RPS\RAMV\Tools\TransferToolNet.exe (Bosch)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (FsUsbExService) -- C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (TransferTool) -- C:\FSP_5000_RPS\RAMV\Tools\TransferTool.exe (Bosch)
SRV - (FingerprintServer) -- C:\WINDOWS\system32\FpLogonServ.exe (AuthenTec,Inc)
SRV - (Authentec memory manager) -- C:\WINDOWS\system32\TAMSvr.exe (AuthenTec Inc.)
SRV - (TW3GSVC) -- C:\Programme\Toshiba\3GUty\tw3gsvc.exe (TOSHIBA CORPORATION)
SRV - (TNaviSrv) -- C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
SRV - (TPCHSrv) -- C:\Programme\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation)
SRV - (Thpsrv) -- C:\WINDOWS\system32\ThpSrv.exe (TOSHIBA Corporation)
SRV - (UNS) Intel(R) -- C:\Programme\Gemeinsame Dateien\Intel\Privacy Icon\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel(R) -- C:\Programme\Intel\AMT\LMS.exe (Intel Corporation)
SRV - (TOSHIBA Bluetooth Service) -- c:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (TODDSrv) -- C:\WINDOWS\system32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (OpcEnum) -- C:\WINDOWS\system32\OpcEnum.exe (OPC Foundation)
SRV - (AgereModemAudio) -- C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems)
SRV - (Tmesrv) -- C:\Programme\TOSHIBA\TME3\Tmesrv31.exe (TOSHIBA)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (CFSvcs) -- C:\Programme\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (s7otsadx) -- C:\WINDOWS\System32\Drivers\s7otsadx.sys (SIEMENS AG)
DRV - (s7otranx) -- C:\WINDOWS\System32\Drivers\s7otranx.sys (SIEMENS AG)
DRV - (s7osmcax) -- C:\WINDOWS\System32\Drivers\s7osmcax.sys (SIEMENS AG)
DRV - (S7opcsrtx) PROFINET IO RT-Protocol (LLDP) -- C:\WINDOWS\system32\drivers\s7opcsrtx.sys (SIEMENS AG)
DRV - (s7odpx2x) -- C:\WINDOWS\System32\Drivers\S7odpx2x.sys (SIEMENS AG)
DRV - (Peakcan) -- C:\WINDOWS\system32\drivers\PEAKCAN.SYS (PEAK-System Technik GmbH, Darmstadt, Germany)
DRV - (S7OUPC2X) -- C:\WINDOWS\system32\drivers\s7oupc2x.sys (SIEMENS AG)
DRV - (UsbserFilt) -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdnsu) -- C:\WINDOWS\system32\drivers\nmwcdnsu.sys (Nokia)
DRV - (nmwcdnsuc) -- C:\WINDOWS\system32\drivers\nmwcdnsuc.sys (Nokia)
DRV - (SNTIE) SIMATIC Industrial Ethernet (ISO) -- C:\WINDOWS\system32\drivers\SNTIE.SYS (SIEMENS AG)
DRV - (Dpmtrcdd) -- C:\WINDOWS\system32\drivers\dpmtrcdd.sys (SIEMENS AG)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (FTDIBUS) -- C:\WINDOWS\system32\drivers\ftdibus.sys (FTDI Ltd.)
DRV - (FTSER2K) -- C:\WINDOWS\system32\drivers\ftser2k.sys (FTDI Ltd.)
DRV - (FsUsbExDisk) -- C:\WINDOWS\system32\FsUsbExDisk.Sys ()
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (fwkbdrtm) -- C:\WINDOWS\System32\drivers\fwkbdrtm.sys (Siemens AG)
DRV - (s7snsrtx) -- C:\WINDOWS\system32\drivers\s7snsrtx.sys (SIEMENS AG)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (USBModem) -- C:\WINDOWS\system32\drivers\lgusbmodem.sys (LG Electronics Inc.)
DRV - (UsbDiag) -- C:\WINDOWS\system32\drivers\lgusbdiag.sys (LG Electronics Inc.)
DRV - (usbbus) -- C:\WINDOWS\system32\drivers\lgusbbus.sys (LG Electronics Inc.)
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor) -- C:\WINDOWS\system32\drivers\atswpdrv.sys (AuthenTec, Inc.)
DRV - (AlfaFF) -- C:\WINDOWS\system32\Drivers\AlfaFF.sys (Alfa Corporation)
DRV - (toshgps) -- C:\WINDOWS\system32\drivers\toshgps.sys (Ericsson AB)
DRV - (toshunic) Toshiba F3507g Mobile Broadband Network Adapter (WDM) -- C:\WINDOWS\system32\drivers\toshunic.sys (MCCI Corporation)
DRV - (toshmdm2) -- C:\WINDOWS\system32\drivers\toshmdm2.sys (MCCI Corporation)
DRV - (toshmdm) -- C:\WINDOWS\system32\drivers\toshmdm.sys (MCCI Corporation)
DRV - (toshcard) -- C:\WINDOWS\system32\drivers\toshcard.sys (MCCI Corporation)
DRV - (toshbus) Toshiba F3507g Mobile Broadband Device driver (WDM) -- C:\WINDOWS\system32\drivers\toshbus.sys (MCCI Corporation)
DRV - (toshnd5) Toshiba F3507g Mobile Broadband Network Adapter (NDIS) -- C:\WINDOWS\system32\drivers\toshnd5.sys (MCCI Corporation)
DRV - (toshmdfl2) -- C:\WINDOWS\system32\drivers\toshmdfl2.sys (MCCI Corporation)
DRV - (toshmdfl) -- C:\WINDOWS\system32\drivers\toshmdfl.sys (MCCI Corporation)
DRV - (Sony_EricssonWWSC) -- C:\WINDOWS\system32\drivers\toshscard.sys (Sony Ericsson)
DRV - (tos_sps32) -- C:\WINDOWS\system32\DRIVERS\tos_sps32.sys (TOSHIBA Corporation)
DRV - (TVALZFL) -- C:\WINDOWS\system32\drivers\TVALZFL.sys (TOSHIBA Corporation)
DRV - (NETw5x32) Intel(R) -- C:\WINDOWS\system32\drivers\NETw5x32.sys (Intel Corporation)
DRV - (tosrfbd) -- C:\WINDOWS\system32\drivers\tosrfbd.sys (TOSHIBA CORPORATION)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (e1yexpress) Intel(R) -- C:\WINDOWS\system32\drivers\e1y5132.sys (Intel Corporation)
DRV - (HECI) Intel(R) -- C:\WINDOWS\system32\drivers\HECI.sys (Intel Corporation)
DRV - (tosporte) -- C:\WINDOWS\system32\drivers\tosporte.sys (TOSHIBA Corporation)
DRV - (Tosrfhid) -- C:\WINDOWS\system32\drivers\Tosrfhid.sys (TOSHIBA Corporation.)
DRV - (rimmptsk) -- C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (TosRfSnd) -- C:\WINDOWS\system32\drivers\TosRfSnd.sys (TOSHIBA Corporation)
DRV - (Thpdrv) -- C:\WINDOWS\system32\DRIVERS\thpdrv.sys (TOSHIBA Corporation)
DRV - (guardian2) -- C:\WINDOWS\system32\drivers\oz776.sys (O2Micro)
DRV - (usbmp) -- C:\WINDOWS\system32\drivers\usbmp.sys (Bosch GmbH, Germany)
DRV - (UVCFTR) -- C:\WINDOWS\system32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
DRV - (tosrfbnp) -- C:\WINDOWS\system32\drivers\tosrfbnp.sys (TOSHIBA Corporation)
DRV - (Tosrfusb) -- C:\WINDOWS\system32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV - (Tosrfcom) -- C:\WINDOWS\system32\drivers\tosrfcom.sys (TOSHIBA Corporation)
DRV - (Thpevm) -- C:\WINDOWS\system32\DRIVERS\Thpevm.SYS (TOSHIBA Corporation)
DRV - (rismxdp) -- C:\WINDOWS\system32\drivers\rixdptsk.sys (REDC)
DRV - (rimsptsk) -- C:\WINDOWS\system32\drivers\rimsptsk.sys (REDC)
DRV - (IFXTPM) -- C:\WINDOWS\system32\drivers\ifxtpm.sys (Infineon Technologies AG)
DRV - (sscdmdm) -- C:\WINDOWS\system32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdmdfl) -- C:\WINDOWS\system32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\WINDOWS\system32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (tdudf) -- C:\WINDOWS\system32\drivers\tdudf.sys (TOSHIBA Corporation)
DRV - (tdcmdpst) -- C:\WINDOWS\system32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (TEchoCan) -- C:\WINDOWS\system32\drivers\TEchoCan.sys (TOSHIBA Corporation)
DRV - (trudf) -- C:\WINDOWS\system32\drivers\trudf.sys (TOSHIBA Corporation)
DRV - (TVALZ) -- C:\WINDOWS\system32\DRIVERS\TVALZ.SYS (TOSHIBA Corporation)
DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (tosrfec) -- C:\WINDOWS\system32\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV - (toshidpt) -- C:\WINDOWS\system32\drivers\Toshidpt.sys (TOSHIBA Corporation.)
DRV - (dpmcslv) -- C:\WINDOWS\System32\drivers\dpmcslv.sys (Siemens AG)
DRV - (S7OUTS2X) -- C:\WINDOWS\system32\drivers\s7outs2x.sys (SIEMENS AG)
DRV - (tosrfnds) -- C:\WINDOWS\system32\drivers\tosrfnds.sys (TOSHIBA Corporation.)
DRV - (Sentinel) -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS (Rainbow Technologies, Inc.)
DRV - (TMEI3E) -- C:\WINDOWS\system32\drivers\TMEI3E.sys (Toshiba Corporation)
DRV - (ApfiltrService) -- C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (Netdevio) -- C:\WINDOWS\system32\drivers\Netdevio.sys (TOSHIBA Corporation.)
DRV - (s7oefs_x) -- C:\WINDOWS\System32\drivers\s7oefs_x.sys (SIEMENS AG)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050
IE - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVD1.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Search"
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.0.14
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.733
 
FF - HKLM\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Programme\Nokia\Nokia PC Suite 7\bkmrksync\ [2010.10.10 14:35:10 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.18\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.04.01 15:50:47 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.18\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.04.01 15:50:47 | 000,000,000 | -H-D | M]
 
[2010.01.19 17:13:07 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Mozilla\Extensions
[2011.04.22 12:17:40 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Mozilla\Firefox\Profiles\qwv8mqoi.default\extensions
[2010.07.06 11:11:34 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Mozilla\Firefox\Profiles\qwv8mqoi.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.08.05 08:53:32 | 000,000,000 | -H-D | M] (DVDVideoSoftTB Toolbar) -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Mozilla\Firefox\Profiles\qwv8mqoi.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.07.06 12:03:36 | 000,000,000 | -H-D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Mozilla\Firefox\Profiles\qwv8mqoi.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.08.05 10:05:17 | 000,000,881 | -H-- | M] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Mozilla\Firefox\Profiles\qwv8mqoi.default\searchplugins\conduit.xml
[2010.01.19 17:12:51 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.10.10 14:35:10 | 000,000,000 | -H-D | M] (PC Sync 2 Synchronisation Extension) -- C:\PROGRAMME\NOKIA\NOKIA PC SUITE 7\BKMRKSYNC
[2009.12.22 05:57:54 | 000,001,392 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2009.12.22 05:57:54 | 000,002,344 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2009.12.22 05:57:54 | 000,006,805 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2009.12.22 05:57:54 | 000,001,178 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2009.12.22 05:57:54 | 000,000,801 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2008.04.14 14:00:00 | 000,000,820 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVD1.dll (Conduit Ltd.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVD1.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\tbDVD1.dll (Conduit Ltd.)
O4 - HKLM..\Run: [000StTHK] C:\WINDOWS\System32\000StTHK.exe ()
O4 - HKLM..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BCSSync] C:\Programme\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [DpUtil] C:\Programme\Toshiba\DualPointUtility\TEDTray.exe (TOSHIBA)
O4 - HKLM..\Run: [FingerPrintNotifer] C:\Programme\TrueSuite Access Manager\FpNotifier.exe (AuthenTec, Inc)
O4 - HKLM..\Run: [ITSecMng] C:\Programme\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)
O4 - HKLM..\Run: [NDSTray.exe]  File not found
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NPSStartup]  File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVRotateSysTray] C:\WINDOWS\System32\nvsysrot.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NWEReboot]  File not found
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [picon] C:\Programme\Gemeinsame Dateien\Intel\Privacy Icon\PrivacyIconClient.exe (Intel Corporation)
O4 - HKLM..\Run: [PwdBank] C:\Programme\TrueSuite Access Manager\PwdBank.exe (Arachnoid Biometrics Identification Group)
O4 - HKLM..\Run: [S7UB Start] C:\Programme\Gemeinsame Dateien\Siemens\S7ubtoox\s7ubtstx.exe (SIEMENS AG)
O4 - HKLM..\Run: [SiemensAutomationFileStorage]  File not found
O4 - HKLM..\Run: [TAudEffect] C:\Programme\TOSHIBA\TAudEffect\TAudEff.exe (TOSHIBA)
O4 - HKLM..\Run: [TFncKy]  File not found
O4 - HKLM..\Run: [TFNF5] C:\WINDOWS\System32\TFNF5.exe (TOSHIBA Corp.)
O4 - HKLM..\Run: [ThpSrv] C:\WINDOWS\System32\thpsrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TMERzCtl.EXE] C:\Programme\TOSHIBA\TME3\TMERzCtl.EXE (TOSHIBA)
O4 - HKLM..\Run: [TMESRV.EXE] C:\Programme\TOSHIBA\TME3\TMESRV31.EXE (TOSHIBA)
O4 - HKLM..\Run: [TOSDCR] C:\WINDOWS\System32\TOSDCR.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TOSHIBA_3G_UTY] C:\Programme\Toshiba\3GUty\tw3gctrl.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [TosHKCW.exe] C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPSODDCtl] C:\WINDOWS\System32\TPSODDCtl.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [UsbMonitor] C:\Programme\TrueSuite Access Manager\usbnotify.exe ()
O4 - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122..\Run: [AutoStartNPSAgent] C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122..\Run: [ISUSPM] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation)
O4 - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122..\Run: [PC Suite Tray] C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122..\Run: [TOSCDSPD] C:\Programme\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O4 - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122..\Run: [YnnAflICEeXU] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\YnnAflICEeXU.exe (WinTrust)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Bluetooth Manager.lnk = C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk = C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1851379012-1242461590-2316183665-1122\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Free YouTube Download - C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\npjpi160_06.dll (Sun Microsystems, Inc.)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = PUS.local
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\ATFUS: DllName - C:\WINDOWS\system32\FpWinLogonNp.dll - C:\WINDOWS\system32\FpWinlogonNp.dll (AuthenTec,Inc)
O20 - Winlogon\Notify\TosBtNP: DllName - TosBtNP.dll - C:\WINDOWS\System32\TosBtNP.dll (TOSHIBA CORPORATION)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.07.21 14:21:57 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\Shell\AutoRun\command - "" = G:\USBAutoRun.exe
O33 - MountPoints2\{ab86bb8a-1fd5-11e0-9188-00037a7397ad}\Shell\AutoRun\command - "" = E:\Launcher.exe
O33 - MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
O33 - MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun\command - "" = E:\VMC_PBStarter.exe
O33 - MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun\command - "" = E:\VMC_PBStarter.exe
O33 - MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Bluetooth Manager.lnk - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe - (TOSHIBA CORPORATION.)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - c:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Camera Assistant Software - hkey= - key= - C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
MsConfig - StartUpReg: DDWMon - hkey= - key= - C:\Programme\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe ()
MsConfig - StartUpReg: SmoothView - hkey= - key= - C:\Programme\Toshiba\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe (TOSHIBA Corporation)
MsConfig - StartUpReg: topi - hkey= - key= - C:\Programme\TOSHIBA\Toshiba Online Product Information\topi.exe (TOSHIBA)
MsConfig - StartUpReg: TPCHWMsg - hkey= - key= -  File not found
MsConfig - StartUpReg: WinCC flexible Smart Start - hkey= - key= - C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008\HmiSmartStart.exe (SIEMENS AG)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {0E8AF1C0-D275-11d2-B803-0000F81E8383} - Windows Script Version 5.0
ActiveX: {0E8AF1C1-D275-11d2-B803-0000F81E8383} - Windows Script Version 5.0
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {10ABA7E0-3236-11d2-B7B0-0000F81E8383} - Windows Script Version 5.0
ActiveX: {10ABA7E1-3236-11d2-B7B0-0000F81E8383} - Windows Script Version 5.0
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - 
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Unable to start service SrService!
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.04.24 13:05:24 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Recent
[2011.04.22 19:08:20 | 000,004,224 | -H-- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\beep.sys
[2011.04.22 19:06:24 | 000,569,344 | -H-- | C] (WinTrust) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\YnnAflICEeXU.exe
[2011.04.13 16:43:19 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Eigene Dateien\Subsoil DVD
[2009.06.15 14:48:43 | 000,570,128 | -H-- | C] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\dao350.dll
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.04.24 12:54:59 | 000,001,158 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.04.24 12:52:03 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.04.24 12:51:53 | 3216,216,064 | -HS- | M] () -- C:\hiberfil.sys
[2011.04.24 11:09:03 | 000,910,664 | -H-- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.04.24 11:09:03 | 000,794,382 | -H-- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.04.24 11:09:03 | 000,316,468 | -H-- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.04.24 11:09:03 | 000,277,142 | -H-- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.04.24 11:03:48 | 000,189,645 | -H-- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011.04.22 19:06:24 | 000,569,344 | -H-- | M] (WinTrust) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\YnnAflICEeXU.exe
[2011.04.21 22:52:46 | 000,000,116 | -H-- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011.04.14 10:42:58 | 000,325,112 | -H-- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.04.13 22:00:18 | 000,001,374 | -H-- | M] () -- C:\WINDOWS\imsins.BAK
[2011.04.09 17:43:18 | 000,034,816 | -H-- | M] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.04.09 07:34:40 | 009,452,962 | -H-- | M] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Desktop\073_Kirche_MatzeSabrina_poest.rar
[2011.04.01 16:11:57 | 000,000,906 | -H-- | M] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Desktop\DVDVideoSoft Free Studio.lnk
[2011.04.01 16:11:43 | 000,001,023 | -H-- | M] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Desktop\Free YouTube to MP3 Converter.lnk
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.04.24 12:24:36 | 3216,216,064 | -HS- | C] () -- C:\hiberfil.sys
[2011.04.09 07:34:37 | 009,452,962 | -H-- | C] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Desktop\073_Kirche_MatzeSabrina_poest.rar
[2011.04.01 16:11:51 | 000,000,906 | -H-- | C] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Desktop\DVDVideoSoft Free Studio.lnk
[2011.04.01 16:11:43 | 000,001,023 | -H-- | C] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Desktop\Free YouTube to MP3 Converter.lnk
[2011.03.10 15:50:10 | 000,000,077 | -H-- | C] () -- C:\WINDOWS\HmiSRT.ini
[2011.01.21 14:06:58 | 000,028,672 | -H-- | C] () -- C:\WINDOWS\System32\nnr.dll
[2011.01.03 18:26:15 | 000,000,008 | -H-- | C] () -- C:\WINDOWS\System32\nvModes.dat
[2010.11.07 12:58:06 | 000,000,123 | -H-- | C] () -- C:\WINDOWS\fsp5000rps.sys
[2010.06.24 17:38:49 | 000,110,592 | -H-- | C] () -- C:\WINDOWS\System32\FsUsbExDevice.Dll
[2010.06.24 17:38:49 | 000,036,608 | -H-- | C] () -- C:\WINDOWS\System32\FsUsbExDisk.Sys
[2010.06.24 17:38:39 | 000,002,528 | -H-- | C] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\$_hpcst$.hpc
[2010.05.19 19:33:38 | 000,626,636 | -H-- | C] () -- C:\WINDOWS\System32\drivers\fw_5711.bin
[2010.03.08 20:17:34 | 000,417,792 | -H-- | C] () -- C:\WINDOWS\System32\sn_regbase.dll
[2010.02.25 15:06:00 | 000,010,764 | -H-- | C] () -- C:\Programme\Dlist.lst
[2010.02.25 15:04:17 | 000,086,016 | -H-- | C] () -- C:\Programme\wkstn.mdb
[2010.01.19 17:13:00 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\nsreg.dat
[2010.01.18 19:58:28 | 000,000,151 | -H-- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2009.11.19 14:27:34 | 000,018,432 | -H-- | C] () -- C:\WINDOWS\System32\ep5711k.dll
[2009.11.19 14:27:26 | 000,021,504 | -H-- | C] () -- C:\WINDOWS\System32\ep5711j.dll
[2009.10.13 15:24:28 | 000,152,624 | -H-- | C] () -- C:\WINDOWS\System32\WIN2PDFS.DLL
[2009.10.13 15:24:28 | 000,015,360 | -H-- | C] () -- C:\WINDOWS\System32\WIN2PDFM.DLL
[2009.10.13 15:24:28 | 000,000,993 | -H-- | C] () -- C:\WINDOWS\1way.ini
[2009.09.14 12:09:29 | 000,034,816 | -H-- | C] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.09.10 15:42:05 | 000,000,116 | -H-- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009.09.04 11:33:03 | 000,000,092 | -H-- | C] () -- C:\WINDOWS\System32\ftdiun2k.ini
[2009.09.04 10:58:29 | 000,000,400 | -H-- | C] () -- C:\WINDOWS\ODBC.INI
[2009.09.02 11:47:46 | 000,000,147 | -H-- | C] () -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2009.09.02 10:55:17 | 000,000,027 | -H-- | C] () -- C:\WINDOWS\Pcan.ini
[2009.09.02 10:50:20 | 000,016,451 | -H-- | C] () -- C:\WINDOWS\System32\OPCmessages.dll
[2009.09.02 10:50:12 | 000,000,027 | -H-- | C] () -- C:\WINDOWS\System32\pcan.ini
[2009.09.02 10:50:05 | 000,075,264 | -H-- | C] () -- C:\WINDOWS\System32\callrproxy.dll
[2009.06.15 13:46:26 | 000,062,976 | -H-- | C] () -- C:\WINDOWS\System32\scpw32a.dll
[2009.06.15 13:46:26 | 000,060,928 | -H-- | C] () -- C:\WINDOWS\System32\scpbw32a.dll
[2009.06.15 13:46:16 | 000,032,256 | -H-- | C] () -- C:\WINDOWS\System32\_UNODBC.dll
[2009.06.12 09:36:20 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\tosOBEX.INI
[2009.02.25 05:44:36 | 000,036,624 | -H-- | C] () -- C:\WINDOWS\System32\s7200L2.dll
[2008.12.15 10:11:14 | 000,979,785 | -H-- | C] () -- C:\WINDOWS\System32\drivers\fpga5711.bin
[2008.08.19 05:22:09 | 001,630,208 | -H-- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2008.08.19 05:22:05 | 001,703,936 | -H-- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008.08.19 05:22:05 | 001,019,904 | -H-- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008.08.19 05:21:58 | 000,466,944 | -H-- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008.08.19 05:21:50 | 001,486,848 | -H-- | C] () -- C:\WINDOWS\System32\nview.dll
[2008.08.19 05:21:46 | 001,339,392 | -H-- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2008.08.19 05:21:32 | 000,442,368 | -H-- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2008.08.19 05:21:26 | 000,425,984 | -H-- | C] () -- C:\WINDOWS\System32\keystone.exe
[2008.07.21 15:48:27 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\smscfg.ini
[2008.07.21 15:36:15 | 000,000,562 | -H-- | C] () -- C:\WINDOWS\TBTdetect.ini
[2008.07.21 15:18:31 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008.07.21 15:18:01 | 000,325,112 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008.07.21 15:01:49 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\NDSTray.INI
[2008.07.21 14:51:13 | 000,128,113 | -H-- | C] () -- C:\WINDOWS\System32\csellang.ini
[2008.07.21 14:51:13 | 000,045,056 | -H-- | C] () -- C:\WINDOWS\System32\csellang.dll
[2008.07.21 14:51:13 | 000,010,146 | -H-- | C] () -- C:\WINDOWS\System32\tosmreg.ini
[2008.07.21 14:51:13 | 000,007,671 | -H-- | C] () -- C:\WINDOWS\System32\cseltbl.ini
[2008.07.21 14:47:56 | 000,024,576 | -H-- | C] () -- C:\WINDOWS\System32\000StTHK.exe
[2008.07.21 14:47:48 | 000,049,152 | -H-- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2008.07.21 14:47:35 | 000,007,104 | -H-- | C] () -- C:\WINDOWS\System32\drivers\HDACfg.dat
[2008.07.21 14:37:47 | 000,028,672 | -H-- | C] () -- C:\WINDOWS\System32\ToshBIOS.dll
[2008.07.21 14:36:10 | 000,000,849 | -H-- | C] () -- C:\WINDOWS\orun32.ini
[2008.07.21 14:35:46 | 000,159,744 | -H-- | C] () -- C:\WINDOWS\MakeMrk.exe
[2008.07.21 14:35:46 | 000,000,083 | -H-- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2008.07.21 14:23:10 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2008.07.21 14:20:40 | 000,021,740 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008.07.21 14:14:43 | 000,910,664 | -H-- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2008.07.21 14:14:43 | 000,316,468 | -H-- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2008.07.21 14:14:43 | 000,269,480 | -H-- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2008.07.21 14:14:43 | 000,034,478 | -H-- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2008.07.21 14:14:41 | 000,794,382 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008.07.21 14:14:41 | 000,277,142 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008.07.21 14:14:41 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008.07.21 14:14:41 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008.07.21 14:14:41 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008.07.21 14:14:40 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
[2008.07.21 14:14:40 | 000,004,598 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat
[2008.07.21 14:14:40 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
[2008.07.21 14:14:38 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008.07.21 14:14:38 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[2008.07.21 14:14:35 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008.07.21 14:14:35 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2007.12.21 16:46:32 | 000,118,784 | -H-- | C] () -- C:\WINDOWS\System32\TosBtAcc.dll
[2007.10.25 17:26:10 | 000,005,632 | -H-- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2005.07.22 21:30:18 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\TosCommAPI.dll
[2005.06.10 08:46:52 | 000,049,152 | RH-- | C] () -- C:\WINDOWS\System32\FDT100.dll
[2005.04.21 10:02:28 | 000,029,184 | -H-- | C] () -- C:\WINDOWS\System32\SP32W.DLL
[2000.03.13 14:12:54 | 000,128,512 | -H-- | C] () -- C:\WINDOWS\System32\IBSUBC32.dll
[1999.11.08 14:55:46 | 000,057,344 | -H-- | C] () -- C:\WINDOWS\System32\S7oformx.dll
[1999.11.08 14:55:34 | 000,032,768 | -H-- | C] () -- C:\WINDOWS\System32\s7oformx.exe
[1999.07.16 13:37:56 | 000,136,704 | -H-- | C] () -- C:\WINDOWS\System32\TDCTRL.dll
[1996.12.19 14:37:38 | 000,103,360 | -H-- | C] () -- C:\WINDOWS\System32\S7OSC16X.DLL
[1996.12.19 14:36:48 | 000,014,848 | -H-- | C] () -- C:\WINDOWS\System32\S7OSC32X.DLL
 
========== LOP Check ==========
 
[2009.06.12 17:27:16 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\toshiba
[2009.06.12 17:27:16 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Administrator.PUS\Anwendungsdaten\toshiba
[2011.03.09 12:49:25 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Danfoss Drives
[2010.10.10 14:32:56 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2010.06.24 17:40:21 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2009.09.09 15:03:42 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PKWARE
[2011.01.14 13:04:33 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SEW
[2009.06.15 09:57:08 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Siemens
[2009.06.15 09:56:17 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Siemens AG
[2009.06.12 08:54:25 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TOSHIBA
[2009.06.12 17:27:17 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[2009.06.12 17:27:16 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Default User\Anwendungsdaten\toshiba
[2009.06.15 10:02:38 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke\Anwendungsdaten\SIEMENS AG
[2009.06.12 17:27:16 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke\Anwendungsdaten\toshiba
[2010.07.06 14:14:10 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\DVDVideoSoftIEHelpers
[2010.10.11 08:13:49 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Nokia
[2010.10.10 14:36:34 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\PC Suite
[2009.09.09 15:03:42 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\PKWARE
[2011.04.24 13:02:24 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\PriceGong
[2010.06.24 17:38:38 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Samsung
[2011.03.09 16:19:39 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Siemens
[2009.10.20 12:55:21 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\SIEMENS AG
[2009.12.05 21:50:28 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\toshiba
[2009.06.12 08:52:29 | 000,000,258 | -H-- | M] () -- C:\WINDOWS\Tasks\Registrierungserinnerung 1.job
[2009.06.12 08:52:29 | 000,000,258 | -H-- | M] () -- C:\WINDOWS\Tasks\Registrierungserinnerung 2.job
[2009.06.12 08:52:29 | 000,000,258 | -H-- | M] () -- C:\WINDOWS\Tasks\Registrierungserinnerung 3.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2009.09.10 15:35:18 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Adobe
[2010.08.29 21:04:35 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Ahead
[2010.11.21 18:31:58 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\dvdcss
[2010.07.06 14:14:10 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\DVDVideoSoftIEHelpers
[2009.10.19 10:50:35 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Help
[2009.06.12 17:27:10 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Identities
[2009.06.12 17:27:10 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\InstallShield
[2009.09.10 15:36:17 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Macromedia
[2009.09.24 08:05:29 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Macrovision
[2010.09.29 21:55:44 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Microsoft
[2010.01.19 17:13:07 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Mozilla
[2010.10.11 08:13:49 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Nokia
[2010.10.10 14:36:34 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\PC Suite
[2009.09.09 15:03:42 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\PKWARE
[2011.04.24 13:02:24 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\PriceGong
[2010.06.24 17:38:38 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Samsung
[2011.03.09 16:19:39 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Siemens
[2009.10.20 12:55:21 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\SIEMENS AG
[2009.06.12 17:27:10 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\Sun
[2009.12.05 21:50:28 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\toshiba
[2011.04.22 19:08:54 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\vlc
[2010.05.11 16:17:34 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\M.Schattke.PUS\Anwendungsdaten\WinRAR
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.04.14 14:00:00 | 020,108,202 | -H-- | M] () .cab file -- C:\I386\sp3.cab:AGP440.sys
[2008.04.14 14:00:00 | 020,108,202 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.04.14 14:00:00 | 020,108,202 | -H-- | M] () .cab file -- C:\I386\sp3.cab:atapi.sys
[2008.04.14 14:00:00 | 020,108,202 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 14:00:00 | 000,096,512 | -H-- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 14:00:00 | 000,056,320 | -H-- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2008.04.14 14:00:00 | 001,036,800 | -H-- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2008.04.15 17:54:16 | 000,388,120 | -H-- | M] (Intel Corporation) MD5=8D58627FEF3F8767665D9F4DC91CBD97 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2008.04.15 17:53:44 | 000,312,344 | -H-- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2008.04.15 17:53:44 | 000,312,344 | -H-- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\WINDOWS\OemDir\iaStor.sys
[2008.04.15 17:53:44 | 000,312,344 | -H-- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\WINDOWS\system32\drivers\iaStor.sys
[2008.04.15 17:53:44 | 000,312,344 | -H-- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\WINDOWS\system32\DRVSTORE\iaAHCI_E7EB69FF3449D216602D0D37A1D73969621673A9\iaStor.sys
[2008.04.15 17:53:44 | 000,312,344 | -H-- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\iaStor.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 14:00:00 | 000,407,040 | -H-- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 14:00:00 | 000,187,904 | -H-- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.04.14 14:00:00 | 000,580,096 | -H-- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 14:00:00 | 000,026,624 | -H-- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2008.04.14 14:00:00 | 000,513,024 | -H-- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.04.14 14:00:00 | 000,012,032 | -H-- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.07.21 16:17:28 | 000,094,208 | -H-- | M] () -- C:\WINDOWS\system32\config\default.sav
[2008.07.21 16:17:28 | 001,093,632 | -H-- | M] () -- C:\WINDOWS\system32\config\software.sav
[2008.07.21 16:17:28 | 000,471,040 | -H-- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.03.08 05:31:44 | 000,348,160 | -H-- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll
[2009.03.08 05:31:38 | 000,216,064 | -H-- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll
[3 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 
< End of report >
         

--- --- ---

Extras.txtOTL Logfile:

OTL Extras logfile created on: 24.04.2011 13:04:25 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = E:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 75,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 298,09 Gb Total Space | 148,00 Gb Free Space | 49,65% Space Free | Partition Type: NTFS
Drive E: | 1,97 Gb Total Space | 1,96 Gb Free Space | 99,61% Space Free | Partition Type: FAT
 
Computer Name: TECRA | User Name: M.Schattke | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_USERS\S-1-5-21-1851379012-1242461590-2316183665-1122\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"4410:TCP" = 4410:TCP:LocalSubNet:Enabled:Automation License Management
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"4410:TCP" = 4410:TCP:LocalSubNet:Enabled:Automation License Management
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008\TraceServer.exe" = C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008\TraceServer.exe:*:Enabled:WinCC flexible  - Trace Server -- (SIEMENS AG)
"C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbsrv9.exe" = C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbsrv9.exe:*:Enabled:Adaptive Server Anywhere Network Server -- (iAnywhere Solutions, Inc.)
"C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbeng9.exe" = C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbeng9.exe:*:Enabled:Adaptive Server Anywhere Database Engine -- (iAnywhere Solutions, Inc.)
"C:\WINDOWS\system32\s7otbxsx.exe" = C:\WINDOWS\system32\s7otbxsx.exe:*:Enabled:SIEMENS STEP7 Block Administration -- (SIEMENS AG)
"C:\Programme\Siemens\Step7\S7INF\S7usiapx.exe" = C:\Programme\Siemens\Step7\S7INF\S7usiapx.exe:*:Enabled:SIEMENS STEP7 S7InfoBox -- (SIEMENS AG)
"C:\Programme\Siemens\Step7\S7BIN\S7tgtopx.exe" = C:\Programme\Siemens\Step7\S7BIN\S7tgtopx.exe:*:Enabled:SIEMENS STEP7 SIMATIC Manager -- (SIEMENS AG)
"C:\Programme\Microsoft Office\Office14\GROOVE.EXE" = C:\Programme\Microsoft Office\Office14\GROOVE.EXE:*:Enabled:Microsoft SharePoint Workspace -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office14\ONENOTE.EXE" = C:\Programme\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE" = C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbsrv9.exe" = C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbsrv9.exe:*:Enabled:Adaptive Server Anywhere Network Server -- (iAnywhere Solutions, Inc.)
"C:\Programme\Siemens\Step7\S7BIN\S7tgtopx.exe" = C:\Programme\Siemens\Step7\S7BIN\S7tgtopx.exe:*:Enabled:SIEMENS STEP7 SIMATIC Manager -- (SIEMENS AG)
"C:\Programme\Siemens\Step7\S7INF\S7usiapx.exe" = C:\Programme\Siemens\Step7\S7INF\S7usiapx.exe:*:Enabled:SIEMENS STEP7 S7InfoBox -- (SIEMENS AG)
"C:\WINDOWS\system32\s7otbxsx.exe" = C:\WINDOWS\system32\s7otbxsx.exe:*:Enabled:SIEMENS STEP7 Block Administration -- (SIEMENS AG)
"C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008\HmiES.exe" = C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008\HmiES.exe:*:Enabled:SIMATIC WinCC flexible 2008 Application -- (SIEMENS AG)
"C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008\TraceServer.exe" = C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008\TraceServer.exe:*:Enabled:SIMATIC WinCC flexible 2008 Trace Server -- (SIEMENS AG)
"C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\MiniWeb.exe" = C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\MiniWeb.exe:*:Disabled:WinCC flexible RT Module MiniWeb -- (Siemens AG)
"C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe" = C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe:*:Disabled:WinCC flexible RT Module SmartServer -- (Siemens AG)
"C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\HmiLoad.exe" = C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\HmiLoad.exe:*:Enabled:WinCC flexible RT Module HmiLoad -- (Siemens AG)
"C:\Programme\Samsung\Samsung New PC Studio\npsasvr.exe" = C:\Programme\Samsung\Samsung New PC Studio\npsasvr.exe:*:Enabled:KTF MUSIC AoD Server -- (PeeringPortal)
"C:\Programme\Samsung\Samsung New PC Studio\npsvsvr.exe" = C:\Programme\Samsung\Samsung New PC Studio\npsvsvr.exe:*:Enabled:KTF MUSIC VoD Server -- (PeeringPortal)
"C:\Programme\RAMV\Tools\TrafoShell.exe" = C:\Programme\RAMV\Tools\TrafoShell.exe:*:Enabled:Configuration Transformer Shell for Magic Panel
"C:\FSP_5000_RPS\RAMV\Tools\TrafoShell.exe" = C:\FSP_5000_RPS\RAMV\Tools\TrafoShell.exe:*:Enabled:Configuration Transformer Shell for Magic Panel -- (BOSCH Security Systems GmbH)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{047BC977-015A-4339-B571-44CA33901F63}" = TIA Portal Single SetupPackage - HWConfig Single SetupPackage  V10.5 + SP2
"{0577A2AA-DEA0-4D40-8372-4211102D43E4}" = TOSHIBA Mic Effect
"{068B2432-7CF2-449C-97A6-95E16E7F4880}" = OZ776 SCR Driver V1.1.4.202
"{06960058-76A9-405D-8833-6D38BFC66979}" = OPC .NET API 2.00 Redistributables
"{089DD780-DB3F-4CDB-A0C2-111360247298}" = PC Connectivity Solution
"{0934A6DC-CFEF-45B3-89D7-D5F69008C4D2}" = MotionStudio 5.60
"{0D61D68B-DF5E-4635-82C7-B0C53F0A581B}" = Microsoft SQL Server 2005 Backward compatibility
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{13153F10-CAE7-4C15-A0B0-C51B9BA3CAAA}_is1" = fit zur schriftlichen Jägerprüfung
"{134A51EB-1BBB-4249-BAF5-494C3D186A06}" = PKZIP Server for Windows 12.40.0008
"{1ADAC261-0A9B-4672-A048-A423F5ACA4D2}" = MCT 10 Set-up Software
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{1C971EE3-B4C4-4367-9676-57549919C6CE}" = TOSHIBA Benutzerhandbücher
"{1E63ACB5-D45E-4856-8FC9-78F4B0D7BB80}" = TOSHIBA Sicherheits-Assistent
"{1E8250AD-CC1B-43A4-9E75-321806D6F256}" = WinCC flexible Graphics
"{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}" = Nokia PC Suite
"{2290A680-4083-410A-ADCC-7092C67FC052}" = Toshiba Online Product Information
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (WINCCFLEXEXPRESS)
"{2C38F661-26B7-445D-B87D-B53FE2D3BD42}" = TOSHIBA PC Diagnostic Tool
"{310358D8-48D1-4B35-A984-7DE3E88B6469}" = SEW-Communication-Server
"{31C1839C-7967-469C-921D-0BEB49AC0652}" = Totally Integrated Automation Portal V10 -  TIA Portal Single SetupPackage  V10.5 + SP2
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java(TM) 6 Update 6
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba
"{37F822E3-B56D-4131-8E3D-0A6753DFB8A5}" = TIA Portal Single SetupPackage - S7BASUCL  V10.5 + SP12
"{3A52E924-A331-4020-9E70-0270B37E8899}" = TOSHIBA F3507g Mobile Broadband Device
"{3B8D9FA4-745C-47C9-962D-4ABE6ACE136B}" = TOSHIBA Mobile Extension3
"{3EABECB0-B86C-4206-9EAC-D1A230270A30}" = Presto! BizCard5 SE
"{3EB30640-F847-4F59-AF74-837D0FD02B73}" = TIA Portal Single SetupPackage - WinCC Single SetupPackage  V10.5 + SP2
"{400830CA-F056-4BBE-80A3-9DF9CA4FB889}" = TOSHIBA Direct Disc Writer
"{42590FE2-6BD0-429E-8F83-B490B5E51564}" = Simatic WinCC flexible 2008 SP1  
"{4323A3CF-D66F-46BC-AD16-B94D7BF05CF1}" = TOSHIBA Dienstprogramm für duales Zeigegerät
"{4FD4E004-E0C0-40BB-9BB6-9AD65EC2169E}" = NetObjects Fusion 11.0
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{56190F69-01D3-46CA-9861-43377C5E9B87}" = TOSHIBA Utilities
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.54.05
"{5CB1636F-2342-4AEC-A7B2-95E9EBE48F0C}" = FSP-5000-RPS
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{64212898-097F-4F3F-AECA-6D34A7EF82DF}" = TOSHIBA Zoom-Dienstprogramm
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{69449DE8-2C9E-478A-9CD5-CE501A0CBABD}" = Hardware Support Package for KTP400 Basic KTP600 Basic V1.3 + SP1  
"{6A2D840F-065F-40F7-8F92-9EE1188EDD9B}" = MOVITOOLS® 4.90
"{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6DEF11C0-35FF-4160-A543-FDD336C4DAE5}" = Microsoft SQL Server 2005 Express Edition (WINCCPLUS)
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75F9DAD1-792C-44E9-B48B-2E22C76E0CBF}" = OPC Core Components Redistributable
"{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}" = Microsoft SQL Server Native Client
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7862BAD8-A379-4128-8AA1-EFD5A9603C53}" = Wireless Hotkey
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{7F3B0E97-447F-4199-84E3-7745BAA2E497}" = TOSHIBA Cooling Performance Diagnostic Tool
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{90140000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 14
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91510407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Visio Professional 2003
"{943D9211-567E-4DD1-83AD-9A25A6FB0E92}" = TOSHIBA Wireless Manager
"{94A90C69-71C1-470A-88F5-AA47ECC96B40}" = TOSHIBA HDD Protection
"{978F72CE-7286-4703-AE43-E5DAA5445E7E}" = SIMATIC TS Adapter IE V1.0  
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9ACBDDE2-DD2D-4103-8ECE-D1A9F7F03D1A}" = TOSHIBA Power Saver
"{9B9856F7-FB16-4EDF-81FF-6382D0733D8F}" = Prosave V7.4 incl. SP4  
"{9BB69D0F-1369-4DBD-99A9-1BC228ED1031}" = Nero 7 Essentials
"{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}" = TOSHIBA PC Health Monitor
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A2075A09-28AA-4D30-9BCC-82EAD9FA51BD}" = TrueSuite Access Manager
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A4A4567C-5C29-4756-992D-F84D8250C435}" = VC User 71 RTL X86 ---
"{A6690C0E-B96E-4F0F-A8EB-D5B332454AC6}" = TOSHIBA Controls
"{ABE2EE7E-11F7-4374-B86B-CB75A5F276B0}" = TIA Portal Single SetupPackage - WINCCBASUCL  V10.5 + SP12
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{B05827EB-0CE5-460A-83D4-5A78779DC707}" = SIMATIC TeleService V6.1  
"{B1060346-9388-4C5B-AA52-176C39819E43}" = Microsoft .NET Compact Framework 2.0 SP2
"{B3372270-9C79-42D7-BF46-00755A0C1A87}" = SIMATIC  STEP 7 V5.5  
"{B5761811-28F3-4257-B537-815C5EEF472C}" = Vodafone Mobile Connect Lite
"{B5C5E1E0-BC7F-11D4-9D38-F29C8700CB4C}" = LUST DriveManager
"{BBF5493A-05FB-4449-90DE-84A61EB78154}" = TOSHIBA SD Memory Boot Utility
"{BCB4C18A-ACA6-4383-8688-E19933A705DD}" = Microsoft SOAP Toolkit 3.0
"{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}" = TOSHIBA ConfigFree
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C0FC3B56-E345-40CD-A5CB-7EB791CE3E74}" = TOSHIBA Password Utility
"{C111BA56-9ACF-42FD-92D6-ED75618AB22E}" = SIMATIC S7-PCT V2.1  
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCC02FDD-3A54-11D6-92A8-00A0245B3AC6}" = SIMATIC HMI Symbol Library
"{CCC15FDD-3A54-11D6-92A8-00A0245B3AC6}" = SIMATIC HMI ProSave
"{CCC16FDD-3A54-11D6-92A8-00A0245B3AC6}" = SIMATIC WinCC flexible OCX
"{CCC22ADD-3A54-11D6-92A8-00A0245B3AC6}" = SIMATIC SCL Compiler
"{CCC22FDD-3A54-11D6-92A8-00A0245B3AC6}" = SIMATIC HMI License Manager Panel Plugin
"{CCC59FDD-3A54-11D6-92A8-00A0245B3AC6}" = SIMATIC WinCC flexible Tag Simulator
"{CCC60FDD-3A54-11D6-92A8-00A0245B3AC6}" = SIMATIC WinCC flexible Simulator
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D8CE69B0-9274-4b8c-BA49-0FF6A20A3C65}" = SAMSUNG SYMBIAN USB Download Driver
"{DC62C484-A0B2-421A-9A0F-1ABFE1E10D71}" = TIA Portal Single SetupPackage - STEP 7 Single SetupPackage  V10.5 + SP2
"{DD304638-64D4-43C9-8B8F-48BE23564791}" = Presto! BizCard 5 SE (Deutsche Version)
"{E487EE7D-EAAA-4E2A-9116-E3B477D8A74F}" = TOSHIBA USB Sleep and Charge Utility
"{E7084B89-69E0-46B3-A118-8F99D06988CD}" = Microsoft SQL Server VSS Writer
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E85D273D-7191-4232-99C8-FA1703A384D1}" = Siemens Automation License Manager V5.0 + SP1  
"{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F1D4FDEE-BB94-4C17-8BB0-AC06DAF854BD}" = TIA Portal Single SetupPackage - HW Module Base Package  V10.5 + HF1
"{F42A5B5F-0772-49C9-881D-28C95C42C3DB}" = Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista
"{F5546185-7698-4B2A-9E34-0FA7D39D0193}" = SIMATIC WinCC flexible Runtime 2008 SP1  
"{FA02ACAC-9E14-4878-A257-92A22A647C2C}" = LG USB Modem Drivers
"{FC4C645F-8EBC-4F1E-A517-D1505B43A374}" = TOSHIBA Wireless Key Logon
"3134FEF0E1D959EC0CC2E458C94B7057B2AC0CC9" = Windows-Treiberpaket - FTDI CDM Driver Package (10/22/2009 2.06.00)
"34EA302E7F4CBD17A19E33BBCB72363234956D7E" = Windows-Treiberpaket - Nokia Modem  (06/09/2010 4.5)
"4BC3EC2E4BABE05848AA433680B60D3B274AEA2A" = Windows-Treiberpaket - SEW-EURODRIVE GmbH & Co. KG (libusb0) LibUsbDevices  (11/20/2005 20051120)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"88EB56038379B8B7DCFB4D2448A60F52E064B265" = Windows-Treiberpaket - FTDI CDM Driver Package (10/22/2009 2.06.00)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"COMBIVIS5" = COMBIVIS 5
"Communication Module Runtime_is1" = Communication Module Runtime Alpha 24 (0.8.1012.0301)
"DRIVEMANAGER" = Lust DRIVEMANAGER
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"E24870CB6AA1C3511635FF9020A3E9471287FBE7" = Windows-Treiberpaket - MobileTop (sshpmdm) Modem  (01/26/2008 2.6.0.0)
"EEEE705096F837B7907659F100C9FE6DA001970F" = Windows-Treiberpaket - Nokia Modem  (06/09/2010 7.01.0.7)
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free YouTube Download_is1" = Free YouTube Download 2.8
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.35.324
"FSD" = FSD
"FTDICOMM" = FTDI USB Serial Converter Drivers
"Global Drive Control V4.7" = Global Drive Control V4.7
"Global Drive Loader  -  2.2" = Global Drive Loader  -  2.2
"Global Drive Oscilloscope -  1.2" = Global Drive Oscilloscope -  1.2
"GRAPH 7" = SIMATIC S7-GRAPH V5.0
"HECI" = Intel(R) Management Engine Interface
"ie8" = Windows Internet Explorer 8
"InstallShield_{068B2432-7CF2-449C-97A6-95E16E7F4880}" = OZ776 SCR Driver V1.1.4.202
"InstallShield_{2C38F661-26B7-445D-B87D-B53FE2D3BD42}" = TOSHIBA PC-Diagnose-Tool
"InstallShield_{42590FE2-6BD0-429E-8F83-B490B5E51564}" = SIMATIC WinCC flexible 2008 SP1 
"InstallShield_{56190F69-01D3-46CA-9861-43377C5E9B87}" = TOSHIBA Dienstprogramme
"InstallShield_{5CB1636F-2342-4AEC-A7B2-95E9EBE48F0C}" = FSP-5000-RPS
"InstallShield_{7F3B0E97-447F-4199-84E3-7745BAA2E497}" = TOSHIBA Kühlleistungs-Diagnosetool
"InstallShield_{9ACBDDE2-DD2D-4103-8ECE-D1A9F7F03D1A}" = TOSHIBA Power Saver
"InstallShield_{C0FC3B56-E345-40CD-A5CB-7EB791CE3E74}" = TOSHIBA Passwort-Utility
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"Lenze Communication" = Lenze Communication
"LOGO!Soft Comfort V6.1" = LOGO!Soft Comfort V6.1
"McAfee Security Scan" = McAfee Security Scan Plus
"MESOL" = Intel® Active-Management-Technologie
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mobile Partner" = Mobile Partner
"Mozilla Firefox (3.5.18)" = Mozilla Firefox (3.5.18)
"Nokia PC Suite" = Nokia PC Suite
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"PC Adapter USB" = SIMATIC PC Adapter USB V1.2
"PEAK OEM-Treiber" = PEAK OEM-Treiber
"PROSet" = Intel(R) Network Connections Drivers
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"SAMSUNG Mobile Modem V2" = SAMSUNG Mobile Modem V2 Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software
"SCL" = SIMATIC S7-SCL V5.3 + SP1
"SEW MotionStudio Uninstall" = MOVITOOLS-MotionStudio
"Siemens  Totally Integrated Automation Portal V10" = Siemens  Totally Integrated Automation Portal V10
"SLABCOMM&10C4&EA60" = Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)
"TDspBtn" = TOSHIBA Utility zum Bildschirmwechsel
"TFNF5" = TOSHIBA Hotkey Utility für Anzeigegeräte
"TME" = Deinstallationsprogamm für TOSHIBA Mobile Extension3
"tools 8000" = tools 8000
"TOSHIBA Software Modem" = TOSHIBA Software Modem
"TS Adapter II" = SIMATIC TS Adapter II V1.1
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.3
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Win2PDF_is1" = Win2PDF 3.20.1
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WindowsScriptHost" = Microsoft Windows Script Host
"WinRAR archiver" = WinRAR
"WTSS7Library" = SIMATIC TeleService S7-Library V6.1
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
         

--- --- ---


So habe dann jetzt auch Malwarebytes durchsuchen lassen. Hier die Berichte:

mbam-log:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6433

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

24.04.2011 20:53:08
mbam-log-2011-04-24 (20-52-58).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|W:\|X:\|Y:\|Z:\|)
Durchsuchte Objekte: 452073
Laufzeit: 3 Stunde(n), 3 Minute(n), 59 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 3
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicherprozesse:
c:\dokumente und einstellungen\all users\anwendungsdaten\ynnafliceexu.exe (Trojan.FakeAlert) -> 3908 -> No action taken.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YnnAflICEeXU (Trojan.FakeAlert) -> Value: YnnAflICEeXU -> No action taken.

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\dokumente und einstellungen\all users\anwendungsdaten\ynnafliceexu.exe (Trojan.FakeAlert) -> No action taken.
c:\dokumente und einstellungen\m.schattke.pus\lokale einstellungen\Temp\jar_cache63001.tmp (Trojan.FakeAlert) -> No action taken.
c:\system volume information\_restore{dc2da2ea-21ed-457b-93c3-d3405bd437b8}\rp344\a0057944.exe (Trojan.FakeAlert) -> No action taken.
c:\system volume information\_restore{dc2da2ea-21ed-457b-93c3-d3405bd437b8}\rp344\a0057980.exe (Trojan.FakeAlert) -> No action taken.


Hoffe das das schon alles etwas weiter hilft.
Bitte um schnelle Antwort!
Danke schonmal vorweg!
MfG Oemmel

Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.

Hallo!
Nein mehr Logs habe ich leider nicht. Bin auf dem Gebiet auch ein Neuling. Also in der Logdatei ist nur eins sichtbar.
Oder habe ich dann was falsch gemacht?
Danke im Vorraus!
MfG Oemmel

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
[2011.04.22 19:06:24 | 000,569,344 | -H-- | C] (WinTrust) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\YnnAflICEeXU.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.07.21 14:21:57 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\Shell - "" = AutoRun
O33 - MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\Shell\AutoRun\command - "" = G:\USBAutoRun.exe
O33 - MountPoints2\{ab86bb8a-1fd5-11e0-9188-00037a7397ad}\Shell\AutoRun\command - "" = E:\Launcher.exe
O33 - MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
O33 - MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun\command - "" = E:\VMC_PBStarter.exe
O33 - MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun\command - "" = E:\VMC_PBStarter.exe
O33 - MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
O33 - MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\Shell - "" = AutoRun
O33 - MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\Shell\AutoRun\command - "" = E:\StartVMCLite.exe
:Commands
[purity]
[resethosts]
[emptytemp]
         

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

So das habe ich dann schonmal gemacht mit dem Fix OTL.
Hier ist das File:

All processes killed
========== OTL ==========
File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\YnnAflICEeXU.exe not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19a13668-a840-11de-8fa6-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19a13668-a840-11de-8fa6-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{19a13668-a840-11de-8fa6-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19a13668-a840-11de-8fa6-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19a13669-a840-11de-8fa6-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19a13669-a840-11de-8fa6-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{19a13669-a840-11de-8fa6-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19a13669-a840-11de-8fa6-00037a7397ad}\ not found.
File F:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20b335c2-01a6-11df-8fec-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20b335c2-01a6-11df-8fec-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20b335c2-01a6-11df-8fec-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20b335c2-01a6-11df-8fec-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{722742e4-b106-11df-90f5-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{722742e4-b106-11df-90f5-028037ec0200}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{722742e4-b106-11df-90f5-028037ec0200}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{722742e4-b106-11df-90f5-028037ec0200}\ not found.
File G:\USBAutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ab86bb8a-1fd5-11e0-9188-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ab86bb8a-1fd5-11e0-9188-00037a7397ad}\ not found.
File E:\Launcher.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dd4d35da-b895-11de-8fb4-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dd4d35da-b895-11de-8fb4-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd4d35da-b895-11de-8fb4-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dd4d35da-b895-11de-8fb4-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dd4d35db-b895-11de-8fb4-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dd4d35db-b895-11de-8fb4-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd4d35db-b895-11de-8fb4-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dd4d35db-b895-11de-8fb4-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e6e44c34-b181-11de-8fac-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e6e44c34-b181-11de-8fac-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6e44c34-b181-11de-8fac-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e6e44c34-b181-11de-8fac-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e6e44c35-b181-11de-8fac-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e6e44c35-b181-11de-8fac-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6e44c35-b181-11de-8fac-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e6e44c35-b181-11de-8fac-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e71ea992-a761-11de-8fa4-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e71ea992-a761-11de-8fa4-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e71ea992-a761-11de-8fa4-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e71ea992-a761-11de-8fa4-00037a7397ad}\ not found.
File C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e98294cd-0213-11df-8fef-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e98294cd-0213-11df-8fef-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e98294cd-0213-11df-8fef-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e98294cd-0213-11df-8fef-00037a7397ad}\ not found.
File F:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db12-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db12-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db12-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db12-a827-11de-8fa5-00037a7397ad}\ not found.
File E:\VMC_PBStarter.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db13-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db13-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db13-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db13-a827-11de-8fa5-00037a7397ad}\ not found.
File E:\VMC_PBStarter.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db15-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db15-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec75db15-a827-11de-8fa5-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec75db15-a827-11de-8fa5-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb98f666-01b3-11df-8fed-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb98f666-01b3-11df-8fed-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb98f666-01b3-11df-8fed-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb98f666-01b3-11df-8fed-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb98f667-01b3-11df-8fed-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb98f667-01b3-11df-8fed-00037a7397ad}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb98f667-01b3-11df-8fed-00037a7397ad}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb98f667-01b3-11df-8fed-00037a7397ad}\ not found.
File E:\StartVMCLite.exe not found.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 49152 bytes

User: Administrator.PUS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 49286 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 49286 bytes

User: LocalService
->Temp folder emptied: 65536 bytes
->Temporary Internet Files folder emptied: 386949 bytes

User: M.Schattke
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 1310 bytes

User: M.Schattke.PUS
->Temp folder emptied: 89323147 bytes
->Temporary Internet Files folder emptied: 27872368 bytes
->Java cache emptied: 2309957 bytes
->FireFox cache emptied: 85824057 bytes
->Flash cache emptied: 15632 bytes

User: M6FE4~1~SCH

User: MSCHAT~1~PUS

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 66 bytes
%systemroot% .tmp files removed: 3261 bytes
%systemroot%\System32 .tmp files removed: 8197 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 32484629 bytes
RecycleBin emptied: 2874733686 bytes

Total Files Cleaned = 2.969,00 mb


OTL by OldTimer - Version 3.2.22.3 log created on 04262011_204423

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_2b4.dat not found!
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_514.dat not found!

Registry entries deleted on Reboot...

Wie muss ich weiter gehen?
Danke schön im Vorraus!!

MfG Oemmel

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen!

OK hier die Log von Kaspersky:

2011/04/27 16:58:40.0796 5896 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/04/27 16:58:41.0078 5896 ================================================================================
2011/04/27 16:58:41.0078 5896 SystemInfo:
2011/04/27 16:58:41.0078 5896
2011/04/27 16:58:41.0078 5896 OS Version: 5.1.2600 ServicePack: 3.0
2011/04/27 16:58:41.0078 5896 Product type: Workstation
2011/04/27 16:58:41.0078 5896 ComputerName: TECRA
2011/04/27 16:58:41.0078 5896 UserName: M.Schattke
2011/04/27 16:58:41.0078 5896 Windows directory: C:\WINDOWS
2011/04/27 16:58:41.0078 5896 System windows directory: C:\WINDOWS
2011/04/27 16:58:41.0078 5896 Processor architecture: Intel x86
2011/04/27 16:58:41.0078 5896 Number of processors: 2
2011/04/27 16:58:41.0078 5896 Page size: 0x1000
2011/04/27 16:58:41.0078 5896 Boot type: Normal boot
2011/04/27 16:58:41.0078 5896 ================================================================================
2011/04/27 16:58:41.0265 5896 Initialize success
2011/04/27 16:58:48.0296 2184 ================================================================================
2011/04/27 16:58:48.0296 2184 Scan started
2011/04/27 16:58:48.0296 2184 Mode: Manual;
2011/04/27 16:58:48.0296 2184 ================================================================================
2011/04/27 16:58:48.0609 2184 ACPI (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/04/27 16:58:48.0671 2184 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/04/27 16:58:48.0718 2184 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/04/27 16:58:48.0781 2184 AFD (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys
2011/04/27 16:58:48.0828 2184 AgereSoftModem (ce91b158fa490cf4c4d487a4130f4660) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
2011/04/27 16:58:48.0906 2184 AlfaFF (4490b8bdf38750458eb9b24835fda8fe) C:\WINDOWS\system32\Drivers\AlfaFF.sys
2011/04/27 16:58:48.0953 2184 ApfiltrService (3ed81e8b4709d13e5a38db2d8e792b28) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
2011/04/27 16:58:48.0968 2184 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/04/27 16:58:49.0046 2184 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/04/27 16:58:49.0171 2184 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/04/27 16:58:49.0187 2184 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/04/27 16:58:49.0218 2184 ATSWPDRV (4e6833f9591dc6a37e70dc188793f5be) C:\WINDOWS\system32\DRIVERS\ATSwpDrv.sys
2011/04/27 16:58:49.0250 2184 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/04/27 16:58:49.0359 2184 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys
2011/04/27 16:58:49.0406 2184 avgntflt (14fe36d8f2c6a2435275338d061a0b66) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
2011/04/27 16:58:49.0453 2184 avipbb (6d52060b59e7d79cd2a044b6add1f1ef) C:\WINDOWS\system32\DRIVERS\avipbb.sys
2011/04/27 16:58:49.0468 2184 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/04/27 16:58:49.0484 2184 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/04/27 16:58:49.0500 2184 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/04/27 16:58:49.0531 2184 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/04/27 16:58:49.0546 2184 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/04/27 16:58:49.0562 2184 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/04/27 16:58:49.0640 2184 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/04/27 16:58:49.0687 2184 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/04/27 16:58:49.0796 2184 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/04/27 16:58:49.0843 2184 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
2011/04/27 16:58:49.0984 2184 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
2011/04/27 16:58:50.0000 2184 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/04/27 16:58:50.0031 2184 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/04/27 16:58:50.0093 2184 dpmcslv (0bd72e62c3974c4f5e4372dba971901b) C:\WINDOWS\system32\drivers\dpmcslv.sys
2011/04/27 16:58:50.0140 2184 Dpmtrcdd (01275752a9bbaabac8ac306985fac300) C:\WINDOWS\system32\DRIVERS\dpmtrcdd.sys
2011/04/27 16:58:50.0171 2184 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/04/27 16:58:50.0218 2184 e1yexpress (96967facc0307093b9098f817a4409e6) C:\WINDOWS\system32\DRIVERS\e1y5132.sys
2011/04/27 16:58:50.0281 2184 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/04/27 16:58:50.0312 2184 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/04/27 16:58:50.0343 2184 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
2011/04/27 16:58:50.0359 2184 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/04/27 16:58:50.0390 2184 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/04/27 16:58:50.0453 2184 FsUsbExDisk (790a4ca68f44be35967b3df61f3e4675) C:\WINDOWS\system32\FsUsbExDisk.SYS
2011/04/27 16:58:50.0468 2184 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/04/27 16:58:50.0531 2184 FTDIBUS (b7aa8283ec551d3a3b924e520e0621a7) C:\WINDOWS\system32\drivers\ftdibus.sys
2011/04/27 16:58:50.0703 2184 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/04/27 16:58:50.0734 2184 FTSER2K (596d31583ce332b5514520d74837f434) C:\WINDOWS\system32\drivers\ftser2k.sys
2011/04/27 16:58:50.0781 2184 fwkbdrtm (1587bd21f05076687d2896396fcbab7d) C:\WINDOWS\system32\drivers\fwkbdrtm.sys
2011/04/27 16:58:50.0812 2184 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/04/27 16:58:50.0859 2184 guardian2 (c0bdab85f3e8b2138c513255e2bcc4d8) C:\WINDOWS\system32\Drivers\oz776.sys
2011/04/27 16:58:50.0890 2184 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/04/27 16:58:50.0953 2184 HECI (2df64415a28ce036ac6acec7645a996f) C:\WINDOWS\system32\DRIVERS\HECI.sys
2011/04/27 16:58:51.0000 2184 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/04/27 16:58:51.0062 2184 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/04/27 16:58:51.0218 2184 hwdatacard (8adf5ef39e896a65beded878494ee2b6) C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys
2011/04/27 16:58:51.0281 2184 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/04/27 16:58:51.0328 2184 iaStor (db0cc620b27a928d968c1a1e9cd9cb87) C:\WINDOWS\system32\drivers\iaStor.sys
2011/04/27 16:58:51.0343 2184 IFXTPM (667cfdb801df771f47b7c39373c2d850) C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS
2011/04/27 16:58:51.0359 2184 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/04/27 16:58:51.0531 2184 IntcAzAudAddService (febb470bf0de4dbebbf72b79df993c5f) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/04/27 16:58:51.0718 2184 intelppm (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/04/27 16:58:51.0750 2184 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/04/27 16:58:51.0765 2184 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/04/27 16:58:51.0765 2184 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/04/27 16:58:51.0812 2184 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/04/27 16:58:51.0828 2184 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/04/27 16:58:51.0843 2184 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/04/27 16:58:51.0859 2184 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/04/27 16:58:51.0890 2184 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/04/27 16:58:51.0937 2184 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/04/27 16:58:51.0984 2184 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/04/27 16:58:52.0046 2184 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/04/27 16:58:52.0062 2184 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
2011/04/27 16:58:52.0078 2184 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/04/27 16:58:52.0109 2184 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/04/27 16:58:52.0125 2184 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/04/27 16:58:52.0156 2184 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/04/27 16:58:52.0218 2184 MRxSmb (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/04/27 16:58:52.0343 2184 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/04/27 16:58:52.0375 2184 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/04/27 16:58:52.0390 2184 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/04/27 16:58:52.0406 2184 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/04/27 16:58:52.0421 2184 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/04/27 16:58:52.0437 2184 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/04/27 16:58:52.0437 2184 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/04/27 16:58:52.0453 2184 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/04/27 16:58:52.0500 2184 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/04/27 16:58:52.0500 2184 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/04/27 16:58:52.0515 2184 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/04/27 16:58:52.0531 2184 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/04/27 16:58:52.0546 2184 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/04/27 16:58:52.0609 2184 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/04/27 16:58:52.0625 2184 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/04/27 16:58:52.0656 2184 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/04/27 16:58:52.0671 2184 Netdevio (1265eb253ed4ebe4acb3bd5f548ff796) C:\WINDOWS\system32\DRIVERS\netdevio.sys
2011/04/27 16:58:52.0812 2184 NETw5x32 (0888844230083ce3b47395102bca8207) C:\WINDOWS\system32\DRIVERS\NETw5x32.sys
2011/04/27 16:58:53.0000 2184 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/04/27 16:58:53.0046 2184 nmwcd (c3963d85b721a7f80d8a55f4e2867a3a) C:\WINDOWS\system32\drivers\ccdcmb.sys
2011/04/27 16:58:53.0093 2184 nmwcdc (3859c69a77793180548802dac9f34a38) C:\WINDOWS\system32\drivers\ccdcmbo.sys
2011/04/27 16:58:53.0156 2184 nmwcdnsu (338f83ee9cb9e15eeacf0cbb90218cbf) C:\WINDOWS\system32\drivers\nmwcdnsu.sys
2011/04/27 16:58:53.0203 2184 nmwcdnsuc (d15bac979144fb69ed28f97b2dd84d48) C:\WINDOWS\system32\drivers\nmwcdnsuc.sys
2011/04/27 16:58:53.0234 2184 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/04/27 16:58:53.0265 2184 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/04/27 16:58:53.0359 2184 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/04/27 16:58:53.0578 2184 nv (47458b1993b62cb98702dcf8165df916) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/04/27 16:58:53.0906 2184 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/04/27 16:58:53.0921 2184 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/04/27 16:58:53.0953 2184 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/04/27 16:58:53.0984 2184 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
2011/04/27 16:58:54.0000 2184 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/04/27 16:58:54.0015 2184 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/04/27 16:58:54.0062 2184 pccsmcfd (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
2011/04/27 16:58:54.0078 2184 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/04/27 16:58:54.0093 2184 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/04/27 16:58:54.0109 2184 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/04/27 16:58:54.0234 2184 Peakcan (41d43e6d2bd13e7db1998dead7279121) C:\WINDOWS\system32\Drivers\Peakcan.sys
2011/04/27 16:58:54.0296 2184 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/04/27 16:58:54.0312 2184 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/04/27 16:58:54.0328 2184 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/04/27 16:58:54.0390 2184 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/04/27 16:58:54.0406 2184 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/04/27 16:58:54.0421 2184 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/04/27 16:58:54.0437 2184 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/04/27 16:58:54.0484 2184 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/04/27 16:58:54.0484 2184 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/04/27 16:58:54.0531 2184 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/04/27 16:58:54.0546 2184 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/04/27 16:58:54.0578 2184 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/04/27 16:58:54.0703 2184 rimmptsk (c2ef513bbe069f0d4ee0938a76f975d3) C:\WINDOWS\system32\DRIVERS\rimmptsk.sys
2011/04/27 16:58:54.0718 2184 rimsptsk (c398bca91216755b098679a8da8a2300) C:\WINDOWS\system32\DRIVERS\rimsptsk.sys
2011/04/27 16:58:54.0750 2184 rismxdp (2a2554cb24506e0a0508fc395c4a1b42) C:\WINDOWS\system32\DRIVERS\rixdptsk.sys
2011/04/27 16:58:54.0796 2184 s7odpx2x (4d32eb360791def1ead57cefbfe0adcf) C:\WINDOWS\System32\Drivers\S7odpx2x.sys
2011/04/27 16:58:54.0843 2184 s7oefs_x (f4e4348f0ecc78a61a190e447eb2467d) C:\WINDOWS\System32\drivers\s7oefs_x.sys
2011/04/27 16:58:54.0890 2184 S7opcsrtx (b5ceca2a3654e6e38ff795e485fbaeb1) C:\WINDOWS\system32\DRIVERS\s7opcsrtx.sys
2011/04/27 16:58:54.0953 2184 s7osmcax (d92ce0ed46fd55a705e7b0d4308e6c99) C:\WINDOWS\System32\Drivers\s7osmcax.sys
2011/04/27 16:58:55.0046 2184 s7otranx (201edaa9b5ea9953e8bb4744f1c814f4) C:\WINDOWS\System32\Drivers\s7otranx.sys
2011/04/27 16:58:55.0234 2184 s7otsadx (60b2a377cdec2f2c2eae5b02ded2f7e4) C:\WINDOWS\System32\Drivers\s7otsadx.sys
2011/04/27 16:58:55.0281 2184 S7OUPC2X (67fa72287eb80c47fd68227276e0478c) C:\WINDOWS\system32\DRIVERS\s7oupc2x.sys
2011/04/27 16:58:55.0343 2184 S7OUTS2X (4c65f1fbc44c685d539b5cadd1950722) C:\WINDOWS\system32\DRIVERS\s7outs2x.sys
2011/04/27 16:58:55.0406 2184 s7snsrtx (1b2666464be6719e1122c53eba487dd6) C:\WINDOWS\system32\DRIVERS\s7snsrtx.sys
2011/04/27 16:58:55.0453 2184 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
2011/04/27 16:58:55.0468 2184 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/04/27 16:58:55.0515 2184 Sentinel (d23fc3f409fdbb2a5c230abc137c4b45) C:\WINDOWS\System32\Drivers\SENTINEL.SYS
2011/04/27 16:58:55.0531 2184 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/04/27 16:58:55.0546 2184 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/04/27 16:58:55.0562 2184 sffdisk (0fa803c64df0914b41f807ea276bf2a6) C:\WINDOWS\system32\DRIVERS\sffdisk.sys
2011/04/27 16:58:55.0578 2184 sffp_sd (c17c331e435ed8737525c86a7557b3ac) C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
2011/04/27 16:58:55.0593 2184 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
2011/04/27 16:58:55.0609 2184 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/04/27 16:58:55.0687 2184 SNTIE (977ee8bba2db440fcac1bf2b8af1e7bf) C:\WINDOWS\system32\DRIVERS\sntie.sys
2011/04/27 16:58:55.0828 2184 Sony_EricssonWWSC (c159ec2ff2c1d8f83bfb005e15adf7df) C:\WINDOWS\system32\DRIVERS\toshscard.sys
2011/04/27 16:58:55.0859 2184 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/04/27 16:58:55.0890 2184 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/04/27 16:58:55.0937 2184 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/04/27 16:58:55.0968 2184 sscdbus (d6870895fe46a464a19141440eb6cc1e) C:\WINDOWS\system32\DRIVERS\sscdbus.sys
2011/04/27 16:58:55.0984 2184 sscdmdfl (0fe167362e4689b716cdc8d93adedda8) C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys
2011/04/27 16:58:56.0015 2184 sscdmdm (55a15707e32b6709242ad127e62ca55a) C:\WINDOWS\system32\DRIVERS\sscdmdm.sys
2011/04/27 16:58:56.0078 2184 ssmdrv (5ec550b8952882ee856b862cf648522d) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2011/04/27 16:58:56.0140 2184 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/04/27 16:58:56.0156 2184 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/04/27 16:58:56.0156 2184 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/04/27 16:58:56.0234 2184 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/04/27 16:58:56.0390 2184 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/04/27 16:58:56.0421 2184 tdcmdpst (2f8bfbdb5824c71f672779b4b8cf8b01) C:\WINDOWS\system32\DRIVERS\tdcmdpst.sys
2011/04/27 16:58:56.0437 2184 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/04/27 16:58:56.0453 2184 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/04/27 16:58:56.0500 2184 tdudf (f56a9327c58ff985616c5e197472932c) C:\WINDOWS\system32\DRIVERS\tdudf.sys
2011/04/27 16:58:56.0531 2184 TEchoCan (65855534483d0c1330703100b31cac00) C:\WINDOWS\system32\DRIVERS\TEchoCan.sys
2011/04/27 16:58:56.0562 2184 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/04/27 16:58:56.0593 2184 Thpdrv (f4846d3a19da42efd57efc816f1b2a62) C:\WINDOWS\system32\DRIVERS\thpdrv.sys
2011/04/27 16:58:56.0593 2184 Thpevm (beeca51c9ef368a1038e455278e4715e) C:\WINDOWS\system32\DRIVERS\Thpevm.SYS
2011/04/27 16:58:56.0609 2184 TMEI3E (684bfb1e9abb05d3f48c53f3cd16a3e6) C:\WINDOWS\system32\Drivers\TMEI3E.SYS
2011/04/27 16:58:56.0656 2184 toshbus (b917441f0f8ae5c2e2fda5a8fd30c5de) C:\WINDOWS\system32\DRIVERS\toshbus.sys
2011/04/27 16:58:56.0718 2184 toshcard (0265937f18e11810ab4533fed4bddda0) C:\WINDOWS\system32\DRIVERS\toshcard.sys
2011/04/27 16:58:56.0781 2184 toshgps (086e3cb76c68d66ccb04f70dfc94b122) C:\WINDOWS\system32\DRIVERS\toshgps.sys
2011/04/27 16:58:56.0937 2184 toshidpt (e362d54fd394999c4178936396664e57) C:\WINDOWS\system32\drivers\Toshidpt.sys
2011/04/27 16:58:56.0953 2184 toshmdfl (d3705e9e71ba6cb24efa9640e72f06eb) C:\WINDOWS\system32\DRIVERS\toshmdfl.sys
2011/04/27 16:58:56.0968 2184 toshmdfl2 (5b7ce10f4ca0238c16614b5c4bb2e365) C:\WINDOWS\system32\DRIVERS\toshmdfl2.sys
2011/04/27 16:58:57.0000 2184 toshmdm (627c02ebb15328d232fe32db669cf144) C:\WINDOWS\system32\DRIVERS\toshmdm.sys
2011/04/27 16:58:57.0062 2184 toshmdm2 (04190c7cd02ce5fcc4afb09fc4998d36) C:\WINDOWS\system32\DRIVERS\toshmdm2.sys
2011/04/27 16:58:57.0078 2184 toshnd5 (b8a93861509b167359e390c7a871f7fc) C:\WINDOWS\system32\DRIVERS\toshnd5.sys
2011/04/27 16:58:57.0093 2184 toshunic (1a11f66a40786a5c8b66068e0c6f1760) C:\WINDOWS\system32\DRIVERS\toshunic.sys
2011/04/27 16:58:57.0140 2184 tosporte (2c15b4856f929ac7dd144044d8334b54) C:\WINDOWS\system32\DRIVERS\tosporte.sys
2011/04/27 16:58:57.0187 2184 tosrfbd (cd6e9c27adc6b37b0b3df29cc83e15a7) C:\WINDOWS\system32\DRIVERS\tosrfbd.sys
2011/04/27 16:58:57.0218 2184 tosrfbnp (181e217a7a326817d97946d045b3cb46) C:\WINDOWS\system32\Drivers\tosrfbnp.sys
2011/04/27 16:58:57.0250 2184 Tosrfcom (e90ace3b4fa7a85f992bc21eb779c407) C:\WINDOWS\system32\Drivers\tosrfcom.sys
2011/04/27 16:58:57.0296 2184 tosrfec (5c4103544612e5011ef46301b93d1aa6) C:\WINDOWS\system32\DRIVERS\tosrfec.sys
2011/04/27 16:58:57.0312 2184 Tosrfhid (d3f87c46c7c9e5db99fbd3d17121b891) C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys
2011/04/27 16:58:57.0328 2184 tosrfnds (c52fd27b9adf3a1f22cb90e6bcf9b0cb) C:\WINDOWS\system32\DRIVERS\tosrfnds.sys
2011/04/27 16:58:57.0359 2184 TosRfSnd (156d63f6898e4d95f2962f2b72862868) C:\WINDOWS\system32\drivers\tosrfsnd.sys
2011/04/27 16:58:57.0375 2184 Tosrfusb (98c04a6432ce9c2ad328f57b9384d348) C:\WINDOWS\system32\DRIVERS\tosrfusb.sys
2011/04/27 16:58:57.0437 2184 tos_sps32 (4399a9bf7d8f49991a07fd86590a1619) C:\WINDOWS\system32\DRIVERS\tos_sps32.sys
2011/04/27 16:58:57.0578 2184 trudf (3f9ba8878aa26d0831116733f9bc53ff) C:\WINDOWS\system32\DRIVERS\trudf.sys
2011/04/27 16:58:57.0593 2184 TVALZ (73d3312955f805054e32fabdca5230b1) C:\WINDOWS\system32\DRIVERS\TVALZ.SYS
2011/04/27 16:58:57.0625 2184 TVALZFL (e03f5ca8d4edb4ce8141a3242e1261f8) C:\WINDOWS\system32\DRIVERS\TVALZFL.sys
2011/04/27 16:58:57.0640 2184 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/04/27 16:58:57.0656 2184 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/04/27 16:58:57.0718 2184 upperdev (0ccadc7391021376edbb8aa649d04e68) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
2011/04/27 16:58:57.0765 2184 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/04/27 16:58:57.0828 2184 usbbus (9419faac6552a51542dbba02971c841c) C:\WINDOWS\system32\DRIVERS\lgusbbus.sys
2011/04/27 16:58:57.0875 2184 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/04/27 16:58:57.0906 2184 UsbDiag (c0a466fa4ffec464320e159bc1bbdc0c) C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys
2011/04/27 16:58:57.0921 2184 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/04/27 16:58:57.0937 2184 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/04/27 16:58:57.0953 2184 USBModem (f74a54774a9b0afeb3c40adec68aa600) C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys
2011/04/27 16:58:58.0000 2184 usbmp (b6610e3de8d1ee8574f957d1060f1d7f) C:\WINDOWS\system32\Drivers\usbmp.sys
2011/04/27 16:58:58.0140 2184 usbser (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
2011/04/27 16:58:58.0156 2184 UsbserFilt (68b4f83cccf70a2ff32ee142c234332a) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
2011/04/27 16:58:58.0203 2184 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/04/27 16:58:58.0250 2184 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/04/27 16:58:58.0296 2184 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
2011/04/27 16:58:58.0328 2184 UVCFTR (8c5094a8ab24de7496c7c19942f2df04) C:\WINDOWS\system32\Drivers\UVCFTR_S.SYS
2011/04/27 16:58:58.0343 2184 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/04/27 16:58:58.0390 2184 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/04/27 16:58:58.0421 2184 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/04/27 16:58:58.0500 2184 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
2011/04/27 16:58:58.0578 2184 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/04/27 16:58:58.0625 2184 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
2011/04/27 16:58:58.0656 2184 WpdUsb (c1b3d9d75c3fb735f5fa3a5806aded57) C:\WINDOWS\system32\Drivers\wpdusb.sys
2011/04/27 16:58:58.0687 2184 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/04/27 16:58:58.0906 2184 ================================================================================
2011/04/27 16:58:58.0906 2184 Scan finished
2011/04/27 16:58:58.0906 2184 ================================================================================

Ja cool! Danke sind jetzt schonmal alle dateien und ordner wieder da!!! *FREU*

Danke danke!!

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

• Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

• Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

• Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

• Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
  Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

• Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Habe erst CCleaner gestartet das hat auch soweit geklappt. Dann habe ich Combofix gestartet, musste erst updaten, habe ich auch gemacht, dann sollte ich die Wiederherstellungskonsole installieren, habe ich dann gemacht, dann fing es an zu laufen und auf mal ging der Bildschirm auf blau zeigt kurz ein parr texte an, glaube von wegen schwerwiegender Fehler oder so, und der Laptop startete dann aufmal neu. Habe jetzt die Text Datei nicht und wenn ich auch meine Festplatte gucke zeigt er da nichts mehr an. Habe ich etwas falsch gemacht??
Danke schonmal!!

Wollte versuchen nen Screenshot hoch zu laden. Aber klappt irgendwie nicht.

Starte Windows neu, lösch die alte cofi.exe, lade CF neu als cofi.exe runter und probier es bitte nochmal.

So habe das jetzt nochmal gemacht, aber kam wieder das selbe. Habe CF gestartet, der macht dann bis ca Stufe 50 und dann wird der Desktop blau mit vielen texten aber wird sofort schwarz und startet neu. Nachdem der hochgefahren ist kommt eine kleine einblendung von wegen nach einem schwerwiegenden Fehler wurde Windows neu gestartet....
Und auf die Festplatte kann ich immer noch nicht zu greifen, da sehe ich nur die Daten die ich neu installiert habe.
Mache ich etwas falsch?? MfG Oemmel

Ich brauch den Quarantäneordner von Combofix. Bitte folgendes machen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf da nicht rummurksen!
2.) Ordner C:\Qoobox in eine Datei zippen
3.) die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html
4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

So habe die Datei hochgeladen ist aber ne rar datei. Hoffe es hat auch geklappt