Befall durch Trojan-BNK.Win32.Keylogger.gen / Was tun?

alephip · 23.05.2011, 09:55

Mein PC ist seit heute mit dem obengenannten Keylogger befallen. Wie muss ich vorgehen, um den PC davon zu befreien?
Ich kann Malwarebytes nicht installieren. runterladen geht aber öffnen tut sich nichts. so kann ich auch den log, welcher in der anleitung steht nicht erstellen.
Vielen Dank für eure rasche Hilfe
alephip

alephip · 23.05.2011, 10:20

Hallo zusammen
es tut mir leid, dass ich ein hijack gepostet habe. doch ich bekomme das Malwarebytes nicht geöffnet, resp die installation beginnt nicht...
das otl kann ich machen.
oje, ich bin überfrodert mit solchen sachen....hilfe
lg alephip

markusg · 23.05.2011, 12:25

hi
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
beide posten

alephip · 23.05.2011, 12:40

oha, das sind aber lange logs:

Jetzt kann ich keine exe dateien mehr öffnen. hab die logs aber vor diesem fehler noch machen können. hmm, ich hab keinen blassen???
danke für eure hilfeOTL Logfile:

Code:

ATTFilter

OTL logfile created on: 23.05.2011 11:12:59 - Run 1
OTL by OldTimer - Version 3.2.23.0     Folder = D:\
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 1.47 Gb Available Physical Memory | 73.62% Memory free
4.85 Gb Paging File | 4.33 Gb Available in Paging File | 89.19% Paging File free
Paging file location(s): C:\pagefile.sys 3070 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 55.89 Gb Total Space | 10.33 Gb Free Space | 18.49% Space Free | Partition Type: NTFS
Drive D: | 55.90 Gb Total Space | 8.67 Gb Free Space | 15.51% Space Free | Partition Type: NTFS
Drive E: | 37.25 Gb Total Space | 0.57 Gb Free Space | 1.54% Space Free | Partition Type: FAT32
 
Computer Name: heimpc | User Name: philip | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - D:\OTL.exe (OldTimer Tools)
PRC - C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe ()
PRC - C:\Programme\phonostar-Player\phonostarTimer.exe ()
PRC - C:\Programme\Tobit Radio.fx\Server\rfx-server.exe ()
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\WINDOWS\system32\dgdersvc.exe (Devguru Co., Ltd.)
PRC - C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\TightVNC\tvnserver.exe (GlavSoft LLC.)
PRC - C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia)
PRC - C:\WINDOWS\system32\TUProgSt.exe (TuneUp Software)
PRC - C:\WINDOWS\ALCFDRTM.EXE (Realtek Semiconductor Corp.)
PRC - C:\Programme\DNA\btdna.exe (BitTorrent, Inc.)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe (Nokia)
PRC - C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe (Dell Inc.)
PRC - C:\Programme\Dell Printers\Additional Color Laser Software\Updater\dlupdr.exe (Dell Inc.)
PRC - C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlpsp.exe (Dell Inc.)
PRC - C:\Programme\HijackThis\HijackThis.exe (Trend Micro Inc.)
PRC - C:\Programme\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe (WDC)
PRC - C:\ProgrammeAVG Anti-Spyware 7.5\avgas.exe (GRISOFT s.r.o.)
PRC - C:\ProgrammeAVG Anti-Spyware 7.5\guard.exe (GRISOFT s.r.o.)
PRC - C:\Programme\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
PRC - C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe (Dell Inc.)
PRC - C:\Programme\PestPatrol\CookiePatrol.exe ()
PRC - C:\Programme\PestPatrol\PPMemCheck.exe ()
PRC - C:\Programme\PestPatrol\PPControl.exe ()
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - D:\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) --  File not found
SRV - (Radio.fx) -- C:\Programme\Tobit Radio.fx\Server\rfx-server.exe ()
SRV - (dgdersvc) -- C:\WINDOWS\system32\dgdersvc.exe (Devguru Co., Ltd.)
SRV - (FsUsbExService) -- C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (tvnserver) -- C:\Programme\TightVNC\tvnserver.exe (GlavSoft LLC.)
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (TuneUp.ProgramStatisticsSvc) -- C:\WINDOWS\system32\TUProgSt.exe (TuneUp Software)
SRV - (TuneUp.Defrag) -- C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) -- C:\Programme\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (DLPWD) -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe (Dell Inc.)
SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
SRV - (WDBtnMgrSvc.exe) -- C:\Programme\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe (WDC)
SRV - (AVG Anti-Spyware Guard) -- C:\ProgrammeAVG Anti-Spyware 7.5\guard.exe (GRISOFT s.r.o.)
SRV - (StarWindServiceAE) -- C:\Programme\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
SRV - (DLSDB) -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe (Dell Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (tbhsd) -- C:\WINDOWS\system32\drivers\tbhsd.sys (RapidSolution Software AG)
DRV - (RRNetCapMP) -- C:\WINDOWS\system32\drivers\rrnetcap.sys (RapidSolution Software AG)
DRV - (RRNetCap) -- C:\WINDOWS\system32\drivers\rrnetcap.sys (RapidSolution Software AG)
DRV - (dgderdrv) -- C:\WINDOWS\system32\drivers\dgderdrv.sys (Devguru Co., Ltd)
DRV - (FsUsbExDisk) -- C:\WINDOWS\system32\FsUsbExDisk.Sys ()
DRV - (ssadmdm) -- C:\WINDOWS\system32\drivers\ssadmdm.sys (MCCI Corporation)
DRV - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) -- C:\WINDOWS\system32\drivers\ssadbus.sys (MCCI Corporation)
DRV - (ssadmdfl) SAMSUNG Android USB Modem (Filter) -- C:\WINDOWS\system32\drivers\ssadmdfl.sys (MCCI Corporation)
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (upperdev) -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdnsu) -- C:\WINDOWS\system32\drivers\nmwcdnsu.sys (Nokia)
DRV - (nmwcdnsuc) -- C:\WINDOWS\system32\drivers\nmwcdnsuc.sys (Nokia)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (iPodDrv) -- C:\WINDOWS\system32\drivers\iPodDrv.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (NPF) -- C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (cpuz132) -- C:\WINDOWS\system32\drivers\cpuz132_x32.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (BVRPMPR5) -- C:\WINDOWS\system32\drivers\BVRPMPR5.SYS (Avanquest Software)
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (AVG Anti-Spyware Driver) -- C:\ProgrammeAVG Anti-Spyware 7.5\guard.sys ()
DRV - (AvgAsCln) -- C:\WINDOWS\system32\drivers\AvgAsCln.sys (GRISOFT, s.r.o.)
DRV - (libusb0) -- C:\WINDOWS\system32\drivers\libusb0.sys (hxxp://libusb-win32.sourceforge.net)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (nm) -- C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)
DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (SISAGP) -- C:\WINDOWS\system32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (USB_RNDIS) -- C:\WINDOWS\system32\drivers\usb8023k.sys (Microsoft Corporation)
DRV - (SiSide) -- C:\WINDOWS\system32\DRIVERS\siside.sys (Silicon Integrated Systems Corp.)
DRV - (SISNIC) -- C:\WINDOWS\system32\drivers\sisnic.sys (SiS Corporation)
DRV - (sisidex) -- C:\WINDOWS\system32\drivers\sisidex.sys (Windows (R) 2000 DDK provider)
DRV - (ms_mpu401) -- C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Ant.com"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..extensions.enabledItems: anttoolbar@ant.com:2.3.0
FF - prefs.js..extensions.enabledItems: {c50ca3c4-5656-43c2-a061-13e717f73fc8}:4.0.2
FF - prefs.js..extensions.enabledItems: fdm_ffext@freedownloadmanager.org:1.3.4
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 4
FF - prefs.js..extensions.enabledItems: 9
FF - prefs.js..extensions.enabledItems: 1
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.01.27 17:02:33 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.01.07 13:38:23 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0b8\extensions\\Components: C:\Programme\Mozilla Firefox 4.0 Beta 8\components [2011.01.05 11:51:08 | 000,000,000 | ---D | M]
 
[2011.01.07 13:38:34 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Mozilla\Extensions
[2011.05.21 17:32:14 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Mozilla\Firefox\Profiles\dggujlf1.default\extensions
[2011.05.17 16:49:32 | 000,000,000 | ---D | M] (Fast Video Download (with SearchMenu)) -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Mozilla\Firefox\Profiles\dggujlf1.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8}
[2011.05.17 16:49:32 | 000,000,000 | ---D | M] (Ant Video Downloader) -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Mozilla\Firefox\Profiles\dggujlf1.default\extensions\anttoolbar@ant.com
[2010.01.15 12:52:57 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Mozilla\Firefox\Profiles\dggujlf1.default\extensions\firefox@tvunetworks.com
[2011.05.21 17:32:14 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2009.01.07 12:57:16 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009.08.10 14:44:43 | 000,000,000 | ---D | M] (Free Download Manager plugin) -- C:\PROGRAMME\FREE DOWNLOAD MANAGER\FIREFOX\EXTENSION
[2009.02.17 23:06:37 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010.12.03 20:14:08 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.12.03 20:14:08 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.12.03 20:14:08 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.12.03 20:14:08 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.12.03 20:14:08 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2002.12.31 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (FGCatchUrl) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Programme\FlashGet\jccatch.dll (www.flashget.com)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (no name) - {500BCA15-57A7-4eaf-8143-8C619470B13D} - No CLSID value found.
O2 - BHO: (FlashGet GetFlash Class) - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Programme\FlashGet\getflash.dll (www.flashget.com)
O4 - HKLM..\Run: [!AVG Anti-Spyware] C:\ProgrammeAVG Anti-Spyware 7.5\avgas.exe (GRISOFT s.r.o.)
O4 - HKLM..\Run: [AlcFDMonitor] C:\WINDOWS\ALCFDRTM.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [CookiePatrol] C:\Programme\PestPatrol\CookiePatrol.exe ()
O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [DLPSP] C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE (Dell Inc.)
O4 - HKLM..\Run: [DLUPDR] C:\Programme\Dell Printers\Additional Color Laser Software\Updater\DLUPDR.EXE (Dell Inc.)
O4 - HKLM..\Run: [PestPatrol Control Center] C:\Programme\PestPatrol\PPControl.exe ()
O4 - HKLM..\Run: [PPMemCheck] C:\Programme\PestPatrol\PPMemCheck.exe ()
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [tvncontrol] C:\Programme\TightVNC\tvnserver.exe (GlavSoft LLC.)
O4 - HKCU..\Run: [AlcoholAutomount] C:\Programme\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)
O4 - HKCU..\Run: [PC Suite Tray] C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - HKCU..\Run: [phonostarTimer] C:\Programme\phonostar-Player\phonostarTimer.exe ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MaxRecentDocs = 0
O8 - Extra context menu item: &Download All with FlashGet - C:\Programme\FlashGet\JC_ALL.HTM ()
O8 - Extra context menu item: &Download with FlashGet - C:\Programme\FlashGet\JC_LINK.HTM ()
O8 - Extra context menu item: Alles mit FDM herunterladen - C:\Programme\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Auswahl mit FDM herunterladen - C:\Programme\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Datei mit FDM herunterladen - C:\Programme\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Videos mit FDM herunterladen - C:\Programme\Free Download Manager\dlfvideo.htm ()
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programme\FlashGet\flashget.exe (FlashGet.com)
O9 - Extra 'Tools' menuitem : FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programme\FlashGet\flashget.exe (FlashGet.com)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} hxxp://vexcast.com/download/vexcast.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {57B86673-276A-48B2-BAE7-C6DBB3020EB8} - C:\ProgrammeAVG Anti-Spyware 7.5\shellexecutehook.dll (GRISOFT s.r.o.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.01.07 02:58:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2005.04.25 20:34:16 | 000,000,027 | ---- | M] () - E:\autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{78d85520-dc5a-11dd-973e-806d6172696f}\Shell\AutoRun\command - "" = install.exe
O33 - MountPoints2\{9a5831a7-dc98-11dd-bd6e-0010dce5043b}\Shell\AutoRun\command - "" = install.exe
O33 - MountPoints2\{9a5831b2-dc98-11dd-bd6e-0010dce5043b}\Shell - "" = AutoRun
O33 - MountPoints2\{9a5831b2-dc98-11dd-bd6e-0010dce5043b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9a5831b2-dc98-11dd-bd6e-0010dce5043b}\Shell\AutoRun\command - "" = L:\LaunchU3.exe -a
O33 - MountPoints2\{9a5831b4-dc98-11dd-bd6e-0010dce5043b}\Shell - "" = AutoRun
O33 - MountPoints2\{9a5831b4-dc98-11dd-bd6e-0010dce5043b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9a5831b4-dc98-11dd-bd6e-0010dce5043b}\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a
O33 - MountPoints2\E\Shell\AutoRun\command - "" = install.exe
O33 - MountPoints2\P\Shell\AutoRun\command - "" = install.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKCU\..exefile [open] -- "C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe" -a "%1" %* ()
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- "C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe" -a "%1" %* ()
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.05.23 09:29:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Grisoft
[2011.05.23 09:29:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\AVG Anti-Spyware 7.5
[2011.05.23 09:29:22 | 000,010,872 | ---- | C] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\AvgAsCln.sys
[2011.05.23 09:29:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Grisoft
[2011.05.23 09:29:18 | 000,000,000 | ---D | C] -- C:\ProgrammeAVG Anti-Spyware 7.5
[2011.05.23 09:07:49 | 000,148,888 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011.05.23 09:07:49 | 000,144,792 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011.05.23 09:07:48 | 000,144,792 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011.05.23 09:04:26 | 000,000,000 | ---D | C] -- C:\Programme\xp-AntiSpy
[2011.05.23 09:04:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\philip\Startmenü\Programme\xp-AntiSpy
[2011.05.23 08:31:58 | 000,000,000 | ---D | C] -- E:\eigene daten\Podcasts
[2011.05.23 08:27:33 | 000,000,000 | ---D | C] -- E:\eigene daten\Aufnahmen
[2011.05.23 08:27:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\phonostar
[2011.05.23 08:27:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\phonostar GmbH
[2011.05.23 08:26:58 | 000,000,000 | ---D | C] -- C:\Programme\phonostar-Player
[2011.05.23 08:06:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Tobit
[2011.05.23 08:06:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Tobit.Software
[2011.05.23 08:05:49 | 003,521,880 | ---- | C] (Tobit.Software) -- C:\WINDOWS\RXSUnins.exe
[2011.05.23 08:05:49 | 003,521,880 | ---- | C] (Tobit.Software) -- C:\WINDOWS\RXCUnins.exe
[2011.05.23 08:05:49 | 000,000,000 | ---D | C] -- C:\Programme\Tobit Radio.fx
[2011.05.23 08:05:49 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Tobit
[2011.05.19 05:51:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google
[2011.05.18 20:36:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Google
[2011.05.18 20:35:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Google Earth
[2011.05.18 20:35:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google
[2011.05.18 20:34:50 | 000,000,000 | ---D | C] -- C:\Programme\Google
[2010.11.26 16:12:43 | 004,411,392 | ---- | C] (Gabest) -- C:\Programme\mplayerc.exe
[2010.02.04 01:00:00 | 000,139,264 | ---- | C] ( ) -- C:\WINDOWS\sipr3260.dll
[2009.11.10 21:20:10 | 000,032,768 | ---- | C] ( ) -- C:\WINDOWS\System32\ShellLnkSSE.dll
[2009.01.07 14:49:32 | 000,155,648 | ---- | C] ( ) -- C:\WINDOWS\System32\flashshl.dll
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.05.23 11:01:14 | 000,018,572 | -HS- | M] () -- C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\hf7o7oior1bgb4rqj6cype23nm1c7x37y
[2011.05.23 11:01:14 | 000,018,572 | -HS- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hf7o7oior1bgb4rqj6cype23nm1c7x37y
[2011.05.23 11:00:02 | 000,000,494 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job
[2011.05.23 10:40:01 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.05.23 08:37:36 | 000,331,776 | -HS- | M] () -- C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe
[2011.05.23 06:17:49 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.05.23 06:08:13 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.05.23 06:08:07 | 2147,012,608 | -HS- | M] () -- C:\hiberfil.sys
[2011.05.21 17:13:57 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.05.18 07:42:49 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011.05.15 17:04:23 | 000,000,302 | ---- | M] () -- C:\WINDOWS\tasks\Orb Index when idle.job
[2011.05.02 18:02:16 | 000,337,146 | ---- | M] () -- C:\Dokumente und Einstellungen\philip\Desktop\Kellerwand-Dämmung.pdf
[2011.04.26 22:31:23 | 000,484,968 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.04.26 22:31:23 | 000,443,424 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.04.26 22:31:23 | 000,094,020 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.04.26 22:31:23 | 000,071,450 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.05.23 08:37:37 | 000,018,572 | -HS- | C] () -- C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\hf7o7oior1bgb4rqj6cype23nm1c7x37y
[2011.05.23 08:37:37 | 000,018,572 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hf7o7oior1bgb4rqj6cype23nm1c7x37y
[2011.05.23 08:37:36 | 000,331,776 | -HS- | C] () -- C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe
[2011.05.23 08:05:49 | 000,554,496 | ---- | C] () -- C:\WINDOWS\System32\dvmsg.dll
[2011.05.18 20:35:00 | 000,001,088 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.05.18 20:34:59 | 000,001,084 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.05.02 18:02:16 | 000,337,146 | ---- | C] () -- C:\Dokumente und Einstellungen\philip\Desktop\Kellerwand-Dämmung.pdf
[2010.12.22 20:36:57 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDevice.Dll
[2010.12.22 20:36:57 | 000,036,640 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDisk.Sys
[2010.12.21 00:57:57 | 002,257,360 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2010.10.25 11:09:56 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll
[2010.10.25 11:09:56 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2010.10.25 11:09:56 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2010.10.25 11:09:56 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll
[2010.09.02 01:53:48 | 000,108,032 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010.07.27 20:21:20 | 000,018,320 | ---- | C] () -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\NMM-MetaData.db
[2010.06.23 13:35:52 | 000,790,528 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010.06.23 13:35:52 | 000,134,144 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010.03.16 01:10:27 | 000,032,668 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010.03.03 19:19:55 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe
[2010.03.03 19:04:40 | 000,198,341 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2010.02.09 16:39:37 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2010.02.08 01:54:01 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2010.02.08 01:42:35 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.02.03 05:34:48 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2010.02.03 05:34:48 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2010.01.21 13:27:00 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\winscp.rnd
[2010.01.21 12:17:12 | 000,000,123 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft.SqlServer.Compact.351.32.bc
[2009.11.10 21:20:36 | 000,057,344 | ---- | C] () -- C:\WINDOWS\SSEUninstaller.exe
[2009.11.10 21:20:10 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\Gif89.dll
[2009.10.20 20:19:30 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2009.09.01 22:32:37 | 000,000,017 | ---- | C] () -- C:\WINDOWS\Missing.ini
[2009.08.16 11:08:36 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009.06.23 00:11:50 | 000,005,120 | ---- | C] () -- C:\WINDOWS\System32\tcusbdrv.dll
[2009.03.10 16:49:35 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2009.03.05 17:30:26 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2009.03.02 18:36:06 | 000,012,518 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2009.03.02 18:36:06 | 000,000,056 | RHS- | C] () -- C:\WINDOWS\System32\ACE2360411.sys
[2009.02.18 19:55:20 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\ATIODE.exe
[2009.02.13 12:51:49 | 000,000,046 | ---- | C] () -- C:\WINDOWS\System32\DonationCoder_urlsnooper_InstallInfo.dat
[2009.02.03 22:52:02 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ATIODCLI.exe
[2009.01.28 12:07:45 | 000,014,336 | ---- | C] () -- C:\WINDOWS\System32\vsmon1.dll
[2009.01.18 22:33:30 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009.01.07 14:49:33 | 000,000,022 | ---- | C] () -- C:\WINDOWS\FLASHKSK.INI
[2009.01.07 14:49:32 | 000,000,468 | ---- | C] () -- C:\WINDOWS\LXBLFMT.INI
[2009.01.07 14:49:31 | 000,021,504 | ---- | C] () -- C:\WINDOWS\LXBLSET.EXE
[2009.01.07 14:49:31 | 000,004,608 | ---- | C] () -- C:\WINDOWS\DelShell.exe
[2009.01.07 14:49:31 | 000,003,229 | ---- | C] () -- C:\WINDOWS\LXBLCAH.ini
[2009.01.07 14:49:29 | 000,002,329 | ---- | C] () -- C:\WINDOWS\System32\LXBLSET.INI
[2009.01.07 14:47:59 | 000,000,634 | ---- | C] () -- C:\WINDOWS\lexstat.ini
[2009.01.07 14:47:37 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxblvs.dll
[2009.01.07 14:47:31 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\LXBLIH.EXE
[2009.01.07 14:47:30 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\INSTMON.EXE
[2009.01.07 14:47:29 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\LXBLLCNP.DLL
[2009.01.07 14:18:15 | 000,157,184 | ---- | C] () -- C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.01.07 13:09:03 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\IDEproperty.dll
[2009.01.07 13:07:17 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
[2009.01.07 13:05:53 | 000,028,672 | ---- | C] () -- C:\WINDOWS\htpatch.exe
[2009.01.07 13:05:53 | 000,003,072 | ---- | C] () -- C:\WINDOWS\winio.sys
[2009.01.07 13:01:58 | 000,001,476 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2009.01.07 11:17:49 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.01.07 11:07:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009.01.07 10:50:07 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009.01.07 10:43:46 | 000,022,880 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009.01.07 10:31:20 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009.01.07 10:29:07 | 000,175,464 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008.09.24 03:38:02 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.dat
[2008.07.30 19:00:51 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\atibrtmon.exe
[2008.05.26 22:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008.05.26 22:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2008.01.04 23:58:50 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2007.02.05 21:05:26 | 000,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI
[2004.07.12 23:07:21 | 003,375,104 | ---- | C] () -- C:\WINDOWS\System32\qt-mt331.dll
[2002.12.31 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002.12.31 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2002.12.31 14:00:00 | 000,484,968 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2002.12.31 14:00:00 | 000,443,424 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2002.12.31 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2002.12.31 14:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2002.12.31 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2002.12.31 14:00:00 | 000,094,020 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2002.12.31 14:00:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2002.12.31 14:00:00 | 000,071,450 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2002.12.31 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2002.12.31 14:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2002.12.31 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2002.12.31 14:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2002.12.31 14:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2002.12.31 14:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2002.12.31 14:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2002.12.31 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

< End of report >

--- --- ---
OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 23.05.2011 11:12:59 - Run 1
OTL by OldTimer - Version 3.2.23.0     Folder = D:\
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 1.47 Gb Available Physical Memory | 73.62% Memory free
4.85 Gb Paging File | 4.33 Gb Available in Paging File | 89.19% Paging File free
Paging file location(s): C:\pagefile.sys 3070 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 55.89 Gb Total Space | 10.33 Gb Free Space | 18.49% Space Free | Partition Type: NTFS
Drive D: | 55.90 Gb Total Space | 8.67 Gb Free Space | 15.51% Space Free | Partition Type: NTFS
Drive E: | 37.25 Gb Total Space | 0.57 Gb Free Space | 1.54% Space Free | Partition Type: FAT32
 
Computer Name: heimpc | User Name: philip | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.exe [@ = exefile] -- C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe ()
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 1
"FirewallOverride" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"5900:TCP" = 5900:TCP:*:Enabled:vnc5900
"5800:TCP" = 5800:TCP:*:Enabled:vnc5800
"1700:TCP" = 1700:TCP:*:Enabled:MioNet Remote Drive Access 0
"1701:TCP" = 1701:TCP:*:Enabled:MioNet Remote Drive Access 1
"1702:TCP" = 1702:TCP:*:Enabled:MioNet Remote Drive Access 2
"1703:TCP" = 1703:TCP:*:Enabled:MioNet Remote Drive Access 3
"1704:TCP" = 1704:TCP:*:Enabled:MioNet Remote Drive Access 4
"1705:TCP" = 1705:TCP:*:Enabled:MioNet Remote Drive Access 5
"1706:TCP" = 1706:TCP:*:Enabled:MioNet Remote Drive Access 6
"1707:TCP" = 1707:TCP:*:Enabled:MioNet Remote Drive Access 7
"1708:TCP" = 1708:TCP:*:Enabled:MioNet Remote Drive Access 8
"1709:TCP" = 1709:TCP:*:Enabled:MioNet Remote Drive Access 9
"1641:TCP" = 1641:TCP:*:Enabled:MioNet Remote Drive Verification
"1647:TCP" = 1647:TCP:*:Enabled:MioNet Storage Device Configuration
"5432:UDP" = 5432:UDP:*:Enabled:MioNet Storage Device Discovery
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"N:\Programme\BitLord\BitLord.exe" = N:\Programme\BitLord\BitLord.exe:*:Enabled:BitLord
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Programme\DNA\btdna.exe" = C:\Programme\DNA\btdna.exe:*:Enabled:DNA -- (BitTorrent, Inc.)
"C:\Programme\SopCast\adv\SopAdver.exe" = C:\Programme\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver -- (www.sopcast.com)
"C:\Programme\SopCast\SopCast.exe" = C:\Programme\SopCast\SopCast.exe:*:Enabled:SopCast Main Application -- (www.sopcast.com)
"C:\Programme\Opera\Opera.exe" = C:\Programme\Opera\Opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Programme\FlashGet\flashget.exe" = C:\Programme\FlashGet\flashget.exe:*:Enabled:Flashget -- (FlashGet.com)
"C:\Programme\Gemeinsame Dateien\Nokia\Service Layer\A\nsl_host_process.exe" = C:\Programme\Gemeinsame Dateien\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process  -- (Nokia Corporation)
"C:\Programme\Nokia\Nokia Software Updater\nsu_ui_client.exe" = C:\Programme\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater -- (Nokia Corporation)
"C:\Programme\Free Video Zilla\FVZilla.exe" = C:\Programme\Free Video Zilla\FVZilla.exe:*:Enabled:FVZilla -- ()
"C:\Programme\VideoLAN\VLC\vlc.exe" = C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\TightVNC\tvnserver.exe" = C:\Programme\TightVNC\tvnserver.exe:*:Enabled:TightVNC Server -- (GlavSoft LLC.)
"C:\Programme\TightVNC\vncviewer.exe" = C:\Programme\TightVNC\vncviewer.exe:*:Enabled:TightVNC Viewer -- (TightVNC Group)
"C:\Programme\Orb Networks\Orb\bin\OrbjetManager.exe" = C:\Programme\Orb Networks\Orb\bin\OrbjetManager.exe:*:Enabled:Orb -- ()
"C:\Programme\Orb Networks\Orb\bin\Orb.exe" = C:\Programme\Orb Networks\Orb\bin\Orb.exe:*:Enabled:Orb -- (Orb Networks, Inc.)
"C:\Programme\Orb Networks\Orb\bin\OrbLauncher.exe" = C:\Programme\Orb Networks\Orb\bin\OrbLauncher.exe:*:Enabled:OrbLauncher -- (Orb Networks)
"C:\Programme\Orb Networks\Orb\bin\OrbSetupWizard.exe" = C:\Programme\Orb Networks\Orb\bin\OrbSetupWizard.exe:*:Enabled:OrbSetupWizard -- ()
"C:\Programme\Orb Networks\Orb\bin\OrbControlPanel.exe" = C:\Programme\Orb Networks\Orb\bin\OrbControlPanel.exe:*:Enabled:OrbControlPanel -- ()
"C:\Programme\Orb Networks\Orb\bin\OrbStreamerClient.exe" = C:\Programme\Orb Networks\Orb\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client -- ()
"C:\Programme\CesarFTP\Server.exe" = C:\Programme\CesarFTP\Server.exe:*:Enabled:Server -- ()
"C:\WINDOWS\system32\muzapp.exe" = C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player -- (Musiccity Co.Ltd.)
"C:\Programme\Real\RealPlayer\realplay.exe" = C:\Programme\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.)
"C:\Programme\aTube Catcher\yct.exe" = C:\Programme\aTube Catcher\yct.exe:*:Enabled:aTube Catcher to download and convert videos. -- (DsNET)
"C:\Programme\Readon TV Movie Radio Player 7.3.0.0\internettv.exe" = C:\Programme\Readon TV Movie Radio Player 7.3.0.0\internettv.exe:*:Enabled:Readon TV Movie Radio Player -- (Readon Technology)
"C:\Programme\Google\Google Earth\plugin\geplugin.exe" = C:\Programme\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth -- (Google)
"C:\Programme\Tobit Radio.fx\Server\rfx-server.exe" = C:\Programme\Tobit Radio.fx\Server\rfx-server.exe:*:Enabled:Radio.fx Server -- ()
"C:\Programme\Tobit Radio.fx\Client\rfx-client.exe" = C:\Programme\Tobit Radio.fx\Client\rfx-client.exe:*:Enabled:Radio.fx Client -- (Tobit.Software)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{089DD780-DB3F-4CDB-A0C2-111360247298}" = PC Connectivity Solution
"{0F9196C6-58B4-445B-B56E-B1200FECC151}" = Microsoft Bootvis
"{105F3CE5-FE55-408E-BF30-E78F85BA0B12}" = Dell-Druckersoftware
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{1BC0C37A-D1A5-46D4-A6DA-808C4CFB1E4A}" = Audials
"{1CF9EE4E-8C18-ECCC-2EA4-D3EED437092A}" = ccc-core-preinstall
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{2133CB3F-F891-4081-8681-FEE2B2419FF4}" = Orb Runtime libraries
"{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}" = Nokia PC Suite
"{24EE4523-711A-4BD1-95EA-F73A8A6950D3}" = Audials TV
"{26A24AE4-039D-4CA4-87B4-2F83216012F0}" = Java(TM) 6 Update 12
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java(TM) 6 Update 13
"{279D6950-AD52-B3E9-97C2-55133796CF90}" = Catalyst Control Center Graphics Previews Common
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2B238FBE-8446-9102-5469-99266D695FBD}" = Catalyst Control Center Localization All
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{324435A5-FCB1-9800-A4A0-5D3B97D08A1A}" = Catalyst Control Center Graphics Full Existing
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3953DA43-4488-9C4E-CAD6-05F1B345134B}" = ATI Catalyst Install Manager
"{39709822-5035-8DEC-740F-15217B25D0E8}" = Catalyst Control Center Graphics Full New
"{503D6E3E-1A48-44F5-BB7C-EB3B593FAED0}" = Opera 9.27
"{523BD5B6-E904-493C-B902-1BC9B7D44DF4}" = Lexmark Photo Center
"{55A29068-F2CE-456C-9148-C869879E2357}" = TuneUp Utilities 2009
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5BE3BF62-D432-4D47-A712-CD4DF91CABFB}" = ZyXEL USB ADSL-Modem
"{5C5021B0-6D3D-09AD-A95C-35094F8ACFCA}" = Catalyst Control Center HydraVision Full
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{62733593-6322-4C89-8B50-F714305A4DC6}" = TubeBox!
"{676B241C-AED4-400B-98FF-267773B94B11}_is1" = QuickFreedom 1.2.0
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D4C88F2-ED3A-AE9F-01DB-B31A307B2F9E}" = ccc-utility
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B63B2922B174135AFC0E1377DD81EC2}" = 
"{881F5DE8-9367-4B81-A325-E91BBC6472F9}" = iTunes
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)
"{9333DA9B-4F8C-4580-88A7-F12D7B10DC2A}" = Nokia Music
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A4D182C-35C7-4791-8484-4304EBC9101A}" = Windows 7 Upgrade Advisor
"{9F59C3AE-81B0-4EF6-9762-D674BB079705}" = Nokia Software Updater
"{A0DBDF40-559F-11E0-82E2-001D0926B1BF}" = Google Earth Plug-in
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A3207D62-C800-9E9C-6F7B-0E00885F693B}" = CCC Help English
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A67BB21E-D419-45BB-AB86-7D87D14BBCE2}" = Safari
"{A6E92CAB-9E63-46DC-8ABF-0CAFF7B7CD02}" = eXPert PDF 5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ABE5BD68-AB6D-A4A6-407C-85D533AC4F9B}" = Catalyst Control Center Graphics Light
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AD47A925-A7A4-D67F-2960-8CC7A8C03686}" = Catalyst Control Center Core Implementation
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B547CB8D-549A-436E-97B5-E79F911B11E2}" = SDP Downloader
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BCDA7B81-D35B-4D72-8266-6BAB9383CF2B}" = Readon TV Movie Radio Player 7.3.0.0
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C4BEEB8C-B9D2-4CD9-A2AA-1F3A1F57DF21}" = Works Suite-Betriebssystem-Pack
"{CADBCBBA-6CDD-4119-B5ED-4AE075B153E7}" = MobileMe Control Panel
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D0C73318-7B4A-4D16-A0C4-3B83F075EA88}" = Search Settings 1.2
"{D679B939-2FF1-58DE-40E0-4876F5C482A5}" = Catalyst Control Center InstallProxy
"{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"{E723FBDD-0417-4546-8EB9-49A3CD443D3D}" = Readon TV Movie Radio Player 6.0.0.0
"{EDDDC607-91D9-4758-9F57-265FDCD8A772}" = Microsoft Works 7.0 
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack
"{F2E6CAF1-D651-4A74-8CC6-D92FE81FDBCC}" = WD Drive Manager (x86)
"{F7D689BA-E7DE-4727-9F8D-936B6C30A53A}" = Rapidshare Auto Downloader 3.6.2
"{F7F2DC0A-C22E-49AD-AD37-797309A54E7B}" = Microsoft AutoRoute 2002
"{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}" = Vista Codec Package
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FC053571-8507-44E4-8B6D-AACEAB8CA57C}" =  Sansa Media Converter
"{FF8FBC40-7087-CCB9-56AA-8A65376EF948}" = ccc-core-static
"34EA302E7F4CBD17A19E33BBCB72363234956D7E" = Windows-Treiberpaket - Nokia Modem  (06/09/2010 4.5)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"6901-5136-2669-7101" = EasyTax 2010 AG 1.0
"819D45A9F73817F5B6D7C71A33ADAB88C5DA1765" = Windows-Treiberpaket - Nokia Modem  (08/03/2007 6.84.0.2)
"AD Stream Recorder_is1" = AD Stream Recorder 2.6.3
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 2.0" = Adobe Photoshop Elements 2.0
"ATI Display Driver" = ATI Display Driver
"aTube Catcher" = aTube Catcher
"Audacity_is1" = Audacity 1.2.6
"AVGAntiSpyware75" = AVG Anti-Spyware 7.5
"AviSynth" = AviSynth 2.5
"CesarFTP 0.99g_is1" = CesarFTP 0.99g
"CopyTrans Suite" = Nur Deinstallierung der CopyTrans Suite möglich.
"Core FTP LE 2.1" = Core FTP LE 2.1
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.53.1
"DivX Setup.divx.com" = DivX-Setup
"doubleTwist" = doubleTwist
"DVD Shrink DE_is1" = DVD Shrink 3.2 deutsch (DeCSS-frei)
"EasyTax 2008 AG 1.0" = EasyTax 2008 AG 1.0
"EasyTax 2009 AG 1.0" = EasyTax 2009 AG 1.0
"EEEE705096F837B7907659F100C9FE6DA001970F" = Windows-Treiberpaket - Nokia Modem  (06/09/2010 7.01.0.7)
"ffdshow_is1" = ffdshow [rev 2527] [2008-12-19]
"FlashGet" = FlashGet 1.9.6.1073
"FLV Player" = FLV Player 2.0 (build 25)
"Free Download Manager_is1" = Free Download Manager 3.0
"Free Video Zilla_is1" = Free Video Zilla
"Gadwin PrintScreen" = Gadwin PrintScreen
"HijackThis" = HijackThis 2.0.2
"ifolor-OrderClient36" = ifolor Bestellsoftware 3.6
"ImgBurn" = ImgBurn
"InstallShield_{523BD5B6-E904-493C-B902-1BC9B7D44DF4}" = Lexmark Fotocenter
"InstallShield_{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"JDownloader" = JDownloader
"Lexmark Z700-P700 Series" = Lexmark Z700-P700 Series
"Lexmark Z700-P700 Series Photo Card Reader V3.00" = Lexmark Z700-P700 Series Photo Card Reader
"LibUSB-Win32_is1" = LibUSB-Win32-0.1.12.1
"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Mozilla Firefox 4.0b8 (x86 de)" = Mozilla Firefox 4.0b8 (x86 de)
"Nero - Burning Rom!UninstallKey" = Nero 6 Enterprise Edition
"netloader" = netloader
"Nokia PC Suite" = Nokia PC Suite
"Orb" = Orb
"P2PFilter" = P2PFilter 3.0.5
"pdfsam" = pdfsam
"phonostar3RadioPlayer_is1" = phonostar-Player Version 3.02.1
"Picture Resize_is1" = Free Picture Resize Starter 4.5
"PSPgo Video 9" = PSPgo Video 9 5.04
"RealPlayer 6.0" = RealPlayer
"Riva FLV Encoder 2.0_is1" = Riva FLV Encoder 2.0
"SiSLan" = SiS 900 PCI Fast Ethernet Adapter Driver
"SopCast" = SopCast 3.0.3
"ST6UNST #1" = Camel's MPEGJoin
"SUPER ©" = SUPER © Version 2009.bld.36 (June 10, 2009)
"TightVNC" = TightVNC 2.0.2
"Tobit Radio.fx Server 1" = WDR RadioRecorder
"URLSnooper 2_is1" = URL Snooper v2.20.02
"VLC media player" = VLC media player 0.9.8a
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"WinGimp-2.0_is1" = GIMP 2.6.4
"WinPcapInst" = WinPcap 4.1.1
"WinRAR archiver" = WinRAR
"winscp3_is1" = WinSCP 4.2.5
"WinZip" = WinZip
"WM Converter 2.0" = WM Converter 2.0
"WM Recorder 12.0" = WM Recorder 12.0
"WM Recorder 14" = WM Recorder 14
"WMFDist11" = Windows Media Format 11 runtime
"Works2003Setup" = Microsoft Works 2003-Setup-Start
"Wudf01009" = Microsoft User-Mode Driver Framework Feature Pack 1.9
"xp-AntiSpy" = xp-AntiSpy 3.97
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent DNA" = DNA
"Sansa Updater" = Sansa Updater
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 08.04.2011 02:32:05 | Computer Name = heimpc | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung internettv.exe, Version 7.2.0.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 09.04.2011 11:40:41 | Computer Name = heimpc | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 1.9.2.3989, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 09.04.2011 11:40:43 | Computer Name = heimpc | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3989,
 fehlgeschlagenes Modul xul.dll, Version 1.9.2.3989, Fehleradresse 0x0070b15a.
 
Error - 12.04.2011 14:11:33 | Computer Name = heimpc | Source = MsiInstaller | ID = 11706
Description = Produkt: Microsoft Office XP Professional mit FrontPage -- Fehler 
1706. Setup kann die benötigten Dateien nicht finden. Überprüfen Sie Ihre Verbindung
 mit dem Netzwerk oder dem CD-ROM-Laufwerk. Um mehr über mögliche Lösungen für dieses
 Problem zu erfahren, sehen sie bitte nach in C:\Programme\Microsoft Office\Office10\1031\SETUP.HLP.
 
Error - 12.04.2011 14:11:41 | Computer Name = heimpc | Source = MsiInstaller | ID = 11706
Description = Produkt: Microsoft Office XP Professional mit FrontPage -- Fehler 
1706. Setup kann die benötigten Dateien nicht finden. Überprüfen Sie Ihre Verbindung
 mit dem Netzwerk oder dem CD-ROM-Laufwerk. Um mehr über mögliche Lösungen für dieses
 Problem zu erfahren, sehen sie bitte nach in C:\Programme\Microsoft Office\Office10\1031\SETUP.HLP.
 
Error - 17.05.2011 10:37:49 | Computer Name = heimpc | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung wmplayer.exe, Version 9.0.0.3250, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 17.05.2011 10:37:53 | Computer Name = heimpc | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung wmplayer.exe, Version 9.0.0.3250, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 18.05.2011 02:59:44 | Computer Name = heimpc | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3989,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.2180, Fehleradresse 0x00018fea.
 
Error - 18.05.2011 08:24:02 | Computer Name = heimpc | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung internettv.exe, Version 7.3.0.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 23.05.2011 01:52:06 | Computer Name = heimpc | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung vlc.exe, Version 0.9.8.1, fehlgeschlagenes
 Modul libavcodec_plugin.dll, Version 0.0.0.0, Fehleradresse 0x001d3f05.
 
[ System Events ]
Error - 22.05.2011 04:47:56 | Computer Name = heimpc | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.0.2 für die Netzwerkkarte mit der Netzwerkadresse
 0010DCE5043B wurde durch  den DHCP-Server 192.168.0.1 abgelehnt (der DHCP-Server 
hat eine DHCPNACK-Meldung gesendet).
 
Error - 22.05.2011 04:47:59 | Computer Name = heimpc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "TuneUp Designerweiterung" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1083
 
Error - 23.05.2011 00:08:15 | Computer Name = heimpc | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.0.2 für die Netzwerkkarte mit der Netzwerkadresse
 0010DCE5043B wurde durch  den DHCP-Server 192.168.0.1 abgelehnt (der DHCP-Server 
hat eine DHCPNACK-Meldung gesendet).
 
Error - 23.05.2011 00:08:18 | Computer Name = heimpc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "TuneUp Designerweiterung" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1083
 
Error - 23.05.2011 00:08:23 | Computer Name = heimpc | Source = W32Time | ID = 39452689
Description = Zeitabieter "NtpClient": Beim DNS-Lookup für den manuell konfigurierten
 Peer  "time.windows.com,0x1" ist ein Fehler aufgetreten. Der DNS-Lookup wird in 15
 Minuten  wiederholt.  Fehler: Der Host war bei einem Socketvorgang nicht erreichbar.
 (0x80072751)
 
Error - 23.05.2011 00:08:23 | Computer Name = heimpc | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
 Zeitquellen  konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb  der
 nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung  mit der Quelle
 herzustellen.  Der NtpClient verfügt über keine Quelle mit genauer Zeit.
 
Error - 23.05.2011 03:43:51 | Computer Name = heimpc | Source = Service Control Manager | ID = 7034
Description = Dienst "LexBce Server" wurde unerwartet beendet. Dies ist bereits 
1 Mal passiert.
 
Error - 23.05.2011 04:42:25 | Computer Name = heimpc | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Apple Mobile Device" wurde unerwartet beendet. Dies ist
 bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
 durchgeführt: Starten Sie den Dienst neu..
 
Error - 23.05.2011 04:42:53 | Computer Name = heimpc | Source = Service Control Manager | ID = 7034
Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 23.05.2011 04:59:38 | Computer Name = heimpc | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Apple Mobile Device" wurde unerwartet beendet. Dies ist
 bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
 durchgeführt: Starten Sie den Dienst neu..
 
 
< End of report >

--- --- ---

markusg · 23.05.2011, 12:44

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:

ATTFilter

C:\Washer2.rar
:OTL
PRC - C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe ()
[2011.05.23 11:01:14 | 000,018,572 | -HS- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hf7o7oior1bgb4rqj6cype23nm1c7x37y
[2011.05.23 08:37:36 | 000,331,776 | -HS- | M] () -- C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe
:Files
C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.

öffne arbeitsplatz, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
http://www.trojaner-board.de/54791-a...ner-board.html

alephip · 23.05.2011, 12:57

okay, ich habs nochmals hingekriegt und einen log gemacht. hoffe dass sie nun stimmen....OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 23.05.2011 13:48:31 - Run 2
OTL by OldTimer - Version 3.2.23.0     Folder = D:\
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 1.36 Gb Available Physical Memory | 68.04% Memory free
4.85 Gb Paging File | 4.28 Gb Available in Paging File | 88.19% Paging File free
Paging file location(s): C:\pagefile.sys 3070 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 55.89 Gb Total Space | 10.81 Gb Free Space | 19.35% Space Free | Partition Type: NTFS
Drive D: | 55.90 Gb Total Space | 8.67 Gb Free Space | 15.52% Space Free | Partition Type: NTFS
Drive E: | 37.25 Gb Total Space | 3.26 Gb Free Space | 8.74% Space Free | Partition Type: FAT32
 
Computer Name: heimpc | User Name: philip | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - D:\OTL.exe (OldTimer Tools)
PRC - C:\Programme\phonostar-Player\phonostarTimer.exe ()
PRC - C:\Programme\Tobit Radio.fx\Server\rfx-server.exe ()
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\WINDOWS\system32\dgdersvc.exe (Devguru Co., Ltd.)
PRC - C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\TightVNC\tvnserver.exe (GlavSoft LLC.)
PRC - C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia)
PRC - C:\WINDOWS\system32\TUProgSt.exe (TuneUp Software)
PRC - C:\WINDOWS\ALCFDRTM.EXE (Realtek Semiconductor Corp.)
PRC - C:\Programme\DNA\btdna.exe (BitTorrent, Inc.)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe (Nokia)
PRC - C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe (Dell Inc.)
PRC - C:\Programme\Dell Printers\Additional Color Laser Software\Updater\dlupdr.exe (Dell Inc.)
PRC - C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlpsp.exe (Dell Inc.)
PRC - C:\Programme\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe (WDC)
PRC - C:\ProgrammeAVG Anti-Spyware 7.5\guard.exe (GRISOFT s.r.o.)
PRC - C:\Programme\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
PRC - C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe (Dell Inc.)
PRC - C:\Programme\PestPatrol\CookiePatrol.exe ()
PRC - C:\Programme\PestPatrol\PPMemCheck.exe ()
PRC - C:\Programme\PestPatrol\PPControl.exe ()
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - D:\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) --  File not found
SRV - (Radio.fx) -- C:\Programme\Tobit Radio.fx\Server\rfx-server.exe ()
SRV - (dgdersvc) -- C:\WINDOWS\system32\dgdersvc.exe (Devguru Co., Ltd.)
SRV - (FsUsbExService) -- C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (tvnserver) -- C:\Programme\TightVNC\tvnserver.exe (GlavSoft LLC.)
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (TuneUp.ProgramStatisticsSvc) -- C:\WINDOWS\system32\TUProgSt.exe (TuneUp Software)
SRV - (TuneUp.Defrag) -- C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) -- C:\Programme\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (DLPWD) -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe (Dell Inc.)
SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
SRV - (WDBtnMgrSvc.exe) -- C:\Programme\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe (WDC)
SRV - (AVG Anti-Spyware Guard) -- C:\ProgrammeAVG Anti-Spyware 7.5\guard.exe (GRISOFT s.r.o.)
SRV - (StarWindServiceAE) -- C:\Programme\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
SRV - (DLSDB) -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe (Dell Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (tbhsd) -- C:\WINDOWS\system32\drivers\tbhsd.sys (RapidSolution Software AG)
DRV - (RRNetCapMP) -- C:\WINDOWS\system32\drivers\rrnetcap.sys (RapidSolution Software AG)
DRV - (RRNetCap) -- C:\WINDOWS\system32\drivers\rrnetcap.sys (RapidSolution Software AG)
DRV - (dgderdrv) -- C:\WINDOWS\system32\drivers\dgderdrv.sys (Devguru Co., Ltd)
DRV - (FsUsbExDisk) -- C:\WINDOWS\system32\FsUsbExDisk.Sys ()
DRV - (ssadmdm) -- C:\WINDOWS\system32\drivers\ssadmdm.sys (MCCI Corporation)
DRV - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) -- C:\WINDOWS\system32\drivers\ssadbus.sys (MCCI Corporation)
DRV - (ssadmdfl) SAMSUNG Android USB Modem (Filter) -- C:\WINDOWS\system32\drivers\ssadmdfl.sys (MCCI Corporation)
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (upperdev) -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdnsu) -- C:\WINDOWS\system32\drivers\nmwcdnsu.sys (Nokia)
DRV - (nmwcdnsuc) -- C:\WINDOWS\system32\drivers\nmwcdnsuc.sys (Nokia)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (iPodDrv) -- C:\WINDOWS\system32\drivers\iPodDrv.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (NPF) -- C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (cpuz132) -- C:\WINDOWS\system32\drivers\cpuz132_x32.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (BVRPMPR5) -- C:\WINDOWS\system32\drivers\BVRPMPR5.SYS (Avanquest Software)
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (AVG Anti-Spyware Driver) -- C:\ProgrammeAVG Anti-Spyware 7.5\guard.sys ()
DRV - (AvgAsCln) -- C:\WINDOWS\system32\drivers\AvgAsCln.sys (GRISOFT, s.r.o.)
DRV - (libusb0) -- C:\WINDOWS\system32\drivers\libusb0.sys (hxxp://libusb-win32.sourceforge.net)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (nm) -- C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)
DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (SISAGP) -- C:\WINDOWS\system32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (USB_RNDIS) -- C:\WINDOWS\system32\drivers\usb8023k.sys (Microsoft Corporation)
DRV - (SiSide) -- C:\WINDOWS\system32\DRIVERS\siside.sys (Silicon Integrated Systems Corp.)
DRV - (SISNIC) -- C:\WINDOWS\system32\drivers\sisnic.sys (SiS Corporation)
DRV - (sisidex) -- C:\WINDOWS\system32\drivers\sisidex.sys (Windows (R) 2000 DDK provider)
DRV - (ms_mpu401) -- C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1220945662-1177238915-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1220945662-1177238915-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1220945662-1177238915-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Ant.com"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..extensions.enabledItems: anttoolbar@ant.com:2.3.0
FF - prefs.js..extensions.enabledItems: {c50ca3c4-5656-43c2-a061-13e717f73fc8}:4.0.2
FF - prefs.js..extensions.enabledItems: fdm_ffext@freedownloadmanager.org:1.3.4
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 4
FF - prefs.js..extensions.enabledItems: 9
FF - prefs.js..extensions.enabledItems: 1
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.01.27 17:02:33 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.01.07 13:38:23 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0b8\extensions\\Components: C:\Programme\Mozilla Firefox 4.0 Beta 8\components [2011.01.05 11:51:08 | 000,000,000 | ---D | M]
 
[2011.01.07 13:38:34 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Mozilla\Extensions
[2011.05.21 17:32:14 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Mozilla\Firefox\Profiles\dggujlf1.default\extensions
[2011.05.17 16:49:32 | 000,000,000 | ---D | M] (Fast Video Download (with SearchMenu)) -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Mozilla\Firefox\Profiles\dggujlf1.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8}
[2011.05.17 16:49:32 | 000,000,000 | ---D | M] (Ant Video Downloader) -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Mozilla\Firefox\Profiles\dggujlf1.default\extensions\anttoolbar@ant.com
[2010.01.15 12:52:57 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Mozilla\Firefox\Profiles\dggujlf1.default\extensions\firefox@tvunetworks.com
[2011.05.21 17:32:14 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2009.01.07 12:57:16 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009.08.10 14:44:43 | 000,000,000 | ---D | M] (Free Download Manager plugin) -- C:\PROGRAMME\FREE DOWNLOAD MANAGER\FIREFOX\EXTENSION
[2009.02.17 23:06:37 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010.12.03 20:14:08 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.12.03 20:14:08 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.12.03 20:14:08 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.12.03 20:14:08 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.12.03 20:14:08 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2002.12.31 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (FGCatchUrl) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Programme\FlashGet\jccatch.dll (www.flashget.com)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (no name) - {500BCA15-57A7-4eaf-8143-8C619470B13D} - No CLSID value found.
O2 - BHO: (FlashGet GetFlash Class) - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Programme\FlashGet\getflash.dll (www.flashget.com)
O4 - HKLM..\Run: [!AVG Anti-Spyware] C:\ProgrammeAVG Anti-Spyware 7.5\avgas.exe (GRISOFT s.r.o.)
O4 - HKLM..\Run: [AlcFDMonitor] C:\WINDOWS\ALCFDRTM.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [CookiePatrol] C:\Programme\PestPatrol\CookiePatrol.exe ()
O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [DLPSP] C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE (Dell Inc.)
O4 - HKLM..\Run: [DLUPDR] C:\Programme\Dell Printers\Additional Color Laser Software\Updater\DLUPDR.EXE (Dell Inc.)
O4 - HKLM..\Run: [PestPatrol Control Center] C:\Programme\PestPatrol\PPControl.exe ()
O4 - HKLM..\Run: [PPMemCheck] C:\Programme\PestPatrol\PPMemCheck.exe ()
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [tvncontrol] C:\Programme\TightVNC\tvnserver.exe (GlavSoft LLC.)
O4 - HKU\.DEFAULT..\Run: [Nokia.PCSync]  File not found
O4 - HKU\S-1-5-18..\Run: [Nokia.PCSync]  File not found
O4 - HKU\S-1-5-21-1220945662-1177238915-839522115-1003..\Run: [AlcoholAutomount] C:\Programme\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)
O4 - HKU\S-1-5-21-1220945662-1177238915-839522115-1003..\Run: [PC Suite Tray] C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - HKU\S-1-5-21-1220945662-1177238915-839522115-1003..\Run: [phonostarTimer] C:\Programme\phonostar-Player\phonostarTimer.exe ()
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1220945662-1177238915-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1220945662-1177238915-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MaxRecentDocs = 0
O8 - Extra context menu item: &Download All with FlashGet - C:\Programme\FlashGet\JC_ALL.HTM ()
O8 - Extra context menu item: &Download with FlashGet - C:\Programme\FlashGet\JC_LINK.HTM ()
O8 - Extra context menu item: Alles mit FDM herunterladen - C:\Programme\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Auswahl mit FDM herunterladen - C:\Programme\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Datei mit FDM herunterladen - C:\Programme\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Videos mit FDM herunterladen - C:\Programme\Free Download Manager\dlfvideo.htm ()
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programme\FlashGet\flashget.exe (FlashGet.com)
O9 - Extra 'Tools' menuitem : FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programme\FlashGet\flashget.exe (FlashGet.com)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} hxxp://vexcast.com/download/vexcast.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {57B86673-276A-48B2-BAE7-C6DBB3020EB8} - C:\ProgrammeAVG Anti-Spyware 7.5\shellexecutehook.dll (GRISOFT s.r.o.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.01.07 02:58:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2005.04.25 20:34:16 | 000,000,027 | ---- | M] () - E:\autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{78d85520-dc5a-11dd-973e-806d6172696f}\Shell\AutoRun\command - "" = install.exe
O33 - MountPoints2\{9a5831a7-dc98-11dd-bd6e-0010dce5043b}\Shell\AutoRun\command - "" = install.exe
O33 - MountPoints2\{9a5831b2-dc98-11dd-bd6e-0010dce5043b}\Shell - "" = AutoRun
O33 - MountPoints2\{9a5831b2-dc98-11dd-bd6e-0010dce5043b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9a5831b2-dc98-11dd-bd6e-0010dce5043b}\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a
O33 - MountPoints2\{9a5831b4-dc98-11dd-bd6e-0010dce5043b}\Shell - "" = AutoRun
O33 - MountPoints2\{9a5831b4-dc98-11dd-bd6e-0010dce5043b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9a5831b4-dc98-11dd-bd6e-0010dce5043b}\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a
O33 - MountPoints2\E\Shell\AutoRun\command - "" = install.exe
O33 - MountPoints2\P\Shell\AutoRun\command - "" = install.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKU\S-1-5-21-1220945662-1177238915-839522115-1003..exefile [open] -- "C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe" -a "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-1220945662-1177238915-839522115-1003\...exe [@ = exefile] -- "C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe" -a "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.05.23 09:29:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Grisoft
[2011.05.23 09:29:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\AVG Anti-Spyware 7.5
[2011.05.23 09:29:22 | 000,010,872 | ---- | C] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\AvgAsCln.sys
[2011.05.23 09:29:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Grisoft
[2011.05.23 09:29:18 | 000,000,000 | ---D | C] -- C:\ProgrammeAVG Anti-Spyware 7.5
[2011.05.23 09:07:49 | 000,148,888 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011.05.23 09:07:49 | 000,144,792 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011.05.23 09:07:48 | 000,144,792 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011.05.23 09:04:26 | 000,000,000 | ---D | C] -- C:\Programme\xp-AntiSpy
[2011.05.23 09:04:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\philip\Startmenü\Programme\xp-AntiSpy
[2011.05.23 08:31:58 | 000,000,000 | ---D | C] -- E:\eigene daten\Podcasts
[2011.05.23 08:27:33 | 000,000,000 | ---D | C] -- E:\eigene daten\Aufnahmen
[2011.05.23 08:27:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\phonostar
[2011.05.23 08:27:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\phonostar GmbH
[2011.05.23 08:26:58 | 000,000,000 | ---D | C] -- C:\Programme\phonostar-Player
[2011.05.23 08:06:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Tobit
[2011.05.23 08:06:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Tobit.Software
[2011.05.23 08:05:49 | 003,521,880 | ---- | C] (Tobit.Software) -- C:\WINDOWS\RXSUnins.exe
[2011.05.23 08:05:49 | 003,521,880 | ---- | C] (Tobit.Software) -- C:\WINDOWS\RXCUnins.exe
[2011.05.23 08:05:49 | 000,000,000 | ---D | C] -- C:\Programme\Tobit Radio.fx
[2011.05.23 08:05:49 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Tobit
[2011.05.19 05:51:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google
[2011.05.18 20:36:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Google
[2011.05.18 20:35:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Google Earth
[2011.05.18 20:35:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google
[2011.05.18 20:34:50 | 000,000,000 | ---D | C] -- C:\Programme\Google
[2010.11.26 16:12:43 | 004,411,392 | ---- | C] (Gabest) -- C:\Programme\mplayerc.exe
[2010.02.04 01:00:00 | 000,139,264 | ---- | C] ( ) -- C:\WINDOWS\sipr3260.dll
[2009.11.10 21:20:10 | 000,032,768 | ---- | C] ( ) -- C:\WINDOWS\System32\ShellLnkSSE.dll
[2009.01.07 14:49:32 | 000,155,648 | ---- | C] ( ) -- C:\WINDOWS\System32\flashshl.dll
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.05.23 13:40:00 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.05.23 13:00:18 | 000,000,494 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job
[2011.05.23 11:01:14 | 000,018,572 | -HS- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hf7o7oior1bgb4rqj6cype23nm1c7x37y
[2011.05.23 06:17:49 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.05.23 06:08:13 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.05.23 06:08:07 | 2147,012,608 | -HS- | M] () -- C:\hiberfil.sys
[2011.05.21 17:13:57 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.05.18 07:42:49 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011.05.15 17:04:23 | 000,000,302 | ---- | M] () -- C:\WINDOWS\tasks\Orb Index when idle.job
[2011.05.02 18:02:16 | 000,337,146 | ---- | M] () -- C:\Dokumente und Einstellungen\philip\Desktop\Kellerwand-Dämmung.pdf
[2011.04.26 22:31:23 | 000,484,968 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.04.26 22:31:23 | 000,443,424 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.04.26 22:31:23 | 000,094,020 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.04.26 22:31:23 | 000,071,450 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.05.23 08:37:37 | 000,018,572 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hf7o7oior1bgb4rqj6cype23nm1c7x37y
[2011.05.23 08:05:49 | 000,554,496 | ---- | C] () -- C:\WINDOWS\System32\dvmsg.dll
[2011.05.18 20:35:00 | 000,001,088 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.05.18 20:34:59 | 000,001,084 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.05.02 18:02:16 | 000,337,146 | ---- | C] () -- C:\Dokumente und Einstellungen\philip\Desktop\Kellerwand-Dämmung.pdf
[2010.12.22 20:36:57 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDevice.Dll
[2010.12.22 20:36:57 | 000,036,640 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDisk.Sys
[2010.12.21 00:57:57 | 002,257,360 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2010.10.25 11:09:56 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll
[2010.10.25 11:09:56 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2010.10.25 11:09:56 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2010.10.25 11:09:56 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll
[2010.09.02 01:53:48 | 000,108,032 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010.07.27 20:21:20 | 000,018,320 | ---- | C] () -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\NMM-MetaData.db
[2010.06.23 13:35:52 | 000,790,528 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010.06.23 13:35:52 | 000,134,144 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010.03.16 01:10:27 | 000,032,668 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010.03.03 19:19:55 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe
[2010.03.03 19:04:40 | 000,198,341 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2010.02.09 16:39:37 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2010.02.08 01:54:01 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2010.02.08 01:42:35 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.02.03 05:34:48 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2010.02.03 05:34:48 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2010.01.21 13:27:00 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\winscp.rnd
[2010.01.21 12:17:12 | 000,000,123 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft.SqlServer.Compact.351.32.bc
[2009.11.10 21:20:36 | 000,057,344 | ---- | C] () -- C:\WINDOWS\SSEUninstaller.exe
[2009.11.10 21:20:10 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\Gif89.dll
[2009.10.20 20:19:30 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2009.09.01 22:32:37 | 000,000,017 | ---- | C] () -- C:\WINDOWS\Missing.ini
[2009.08.16 11:08:36 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009.06.23 00:11:50 | 000,005,120 | ---- | C] () -- C:\WINDOWS\System32\tcusbdrv.dll
[2009.03.10 16:49:35 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2009.03.05 17:30:26 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2009.03.02 18:36:06 | 000,012,518 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2009.03.02 18:36:06 | 000,000,056 | RHS- | C] () -- C:\WINDOWS\System32\ACE2360411.sys
[2009.02.18 19:55:20 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\ATIODE.exe
[2009.02.13 12:51:49 | 000,000,046 | ---- | C] () -- C:\WINDOWS\System32\DonationCoder_urlsnooper_InstallInfo.dat
[2009.02.03 22:52:02 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ATIODCLI.exe
[2009.01.28 12:07:45 | 000,014,336 | ---- | C] () -- C:\WINDOWS\System32\vsmon1.dll
[2009.01.18 22:33:30 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009.01.07 14:49:33 | 000,000,022 | ---- | C] () -- C:\WINDOWS\FLASHKSK.INI
[2009.01.07 14:49:32 | 000,000,468 | ---- | C] () -- C:\WINDOWS\LXBLFMT.INI
[2009.01.07 14:49:31 | 000,021,504 | ---- | C] () -- C:\WINDOWS\LXBLSET.EXE
[2009.01.07 14:49:31 | 000,004,608 | ---- | C] () -- C:\WINDOWS\DelShell.exe
[2009.01.07 14:49:31 | 000,003,229 | ---- | C] () -- C:\WINDOWS\LXBLCAH.ini
[2009.01.07 14:49:29 | 000,002,329 | ---- | C] () -- C:\WINDOWS\System32\LXBLSET.INI
[2009.01.07 14:47:59 | 000,000,634 | ---- | C] () -- C:\WINDOWS\lexstat.ini
[2009.01.07 14:47:37 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxblvs.dll
[2009.01.07 14:47:31 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\LXBLIH.EXE
[2009.01.07 14:47:30 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\INSTMON.EXE
[2009.01.07 14:47:29 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\LXBLLCNP.DLL
[2009.01.07 14:18:15 | 000,157,184 | ---- | C] () -- C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.01.07 13:09:03 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\IDEproperty.dll
[2009.01.07 13:07:17 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
[2009.01.07 13:05:53 | 000,028,672 | ---- | C] () -- C:\WINDOWS\htpatch.exe
[2009.01.07 13:05:53 | 000,003,072 | ---- | C] () -- C:\WINDOWS\winio.sys
[2009.01.07 13:01:58 | 000,001,476 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2009.01.07 11:17:49 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.01.07 11:07:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009.01.07 10:50:07 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009.01.07 10:43:46 | 000,022,880 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009.01.07 10:31:20 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009.01.07 10:29:07 | 000,175,464 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008.09.24 03:38:02 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.dat
[2008.07.30 19:00:51 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\atibrtmon.exe
[2008.05.26 22:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008.05.26 22:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2008.01.04 23:58:50 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2007.02.05 21:05:26 | 000,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI
[2004.07.12 23:07:21 | 003,375,104 | ---- | C] () -- C:\WINDOWS\System32\qt-mt331.dll
[2002.12.31 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002.12.31 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2002.12.31 14:00:00 | 000,484,968 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2002.12.31 14:00:00 | 000,443,424 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2002.12.31 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2002.12.31 14:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2002.12.31 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2002.12.31 14:00:00 | 000,094,020 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2002.12.31 14:00:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2002.12.31 14:00:00 | 000,071,450 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2002.12.31 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2002.12.31 14:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2002.12.31 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2002.12.31 14:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2002.12.31 14:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2002.12.31 14:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2002.12.31 14:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2002.12.31 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
 
========== LOP Check ==========
 
[2011.02.15 21:21:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ALG Updater
[2011.02.15 21:33:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Amazing WebTV
[2010.01.06 14:55:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Azureus
[2010.07.17 22:15:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2009.02.13 12:47:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DonationCoder
[2009.09.18 18:43:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\doubleTwist Corporation
[2009.01.28 12:07:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\eXPert PDF
[2009.01.28 12:09:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\eXPert PDF 5
[2009.01.28 12:07:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\eXPert PDF Jobs
[2009.08.10 14:44:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreeDownloadManager.ORG
[2011.05.23 09:29:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Grisoft
[2010.05.17 13:13:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ifolor
[2010.09.18 17:01:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2009.05.11 20:53:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2009.02.24 22:29:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaMusic
[2010.12.22 17:18:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\OrbNetworks
[2009.02.24 23:31:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2010.12.20 18:54:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RapidSolution
[2011.04.09 17:31:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Readon
[2010.12.22 20:29:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Samsung
[2011.02.15 21:20:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SLGlobal
[2011.02.15 21:20:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SoftLocker
[2010.02.13 00:43:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2010.11.03 13:24:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\VistaCodecs
[2009.09.16 15:40:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WindSolutions
[2010.12.22 19:33:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009.09.04 00:32:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011.04.27 09:02:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\HomePipe
[2010.12.22 14:04:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\TightVNC
[2011.02.15 21:34:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Amazing WebTV
[2010.01.06 14:57:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Azureus
[2009.02.20 11:44:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Bidgood Svcs
[2009.01.25 19:05:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Canon
[2010.12.22 18:00:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\CoreFTP
[2010.07.17 22:23:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\DAEMON Tools Lite
[2011.05.23 13:48:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\DNA
[2009.09.01 18:43:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\DScaler4
[2011.03.10 22:16:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\EasyTax
[2009.01.28 12:09:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\eXPert PDF 5
[2009.02.08 15:36:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\eXPert PDF Editor
[2010.12.20 17:16:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Free Download Manager
[2009.10.15 22:17:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\FVZilla
[2011.05.23 09:29:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Grisoft
[2009.04.12 16:35:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\gtk-2.0
[2010.12.22 17:45:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\HomePipe
[2009.09.21 21:14:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\iCloner
[2010.05.17 13:14:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\ifolor
[2010.07.17 22:02:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\ImgBurn
[2009.10.30 01:58:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Improved Software
[2009.05.11 21:05:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Nokia
[2010.08.28 19:03:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\PC Suite
[2011.05.23 08:27:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\phonostar GmbH
[2009.02.24 11:40:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\RayV
[2009.10.29 17:41:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Router Manager
[2010.12.22 20:29:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Samsung
[2009.01.14 18:01:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\SanDisk
[2009.09.16 15:43:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\SharePod
[2009.09.01 17:35:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\STOIK
[2011.05.23 08:06:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\Tobit
[2011.01.05 13:28:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\TubeBox
[2010.02.13 00:44:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\TuneUp Software
[2010.11.03 13:24:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\VistaCodecs
[2009.09.22 19:25:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\philip\Anwendungsdaten\WindSolutions
[2011.05.23 13:00:18 | 000,000,494 | ---- | M] () -- C:\WINDOWS\Tasks\1-Klick-Wartung.job
[2011.05.15 17:04:23 | 000,000,302 | ---- | M] () -- C:\WINDOWS\Tasks\Orb Index when idle.job
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---
OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 23.05.2011 13:48:31 - Run 2
OTL by OldTimer - Version 3.2.23.0     Folder = D:\
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 1.36 Gb Available Physical Memory | 68.04% Memory free
4.85 Gb Paging File | 4.28 Gb Available in Paging File | 88.19% Paging File free
Paging file location(s): C:\pagefile.sys 3070 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 55.89 Gb Total Space | 10.81 Gb Free Space | 19.35% Space Free | Partition Type: NTFS
Drive D: | 55.90 Gb Total Space | 8.67 Gb Free Space | 15.52% Space Free | Partition Type: NTFS
Drive E: | 37.25 Gb Total Space | 3.26 Gb Free Space | 8.74% Space Free | Partition Type: FAT32
 
Computer Name: heimpc | User Name: philip | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
 
[HKEY_USERS\S-1-5-21-1220945662-1177238915-839522115-1003\SOFTWARE\Classes\<extension>]
.exe [@ = exefile] -- "C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe" -a "%1" %*
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 1
"FirewallOverride" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"5900:TCP" = 5900:TCP:*:Enabled:vnc5900
"5800:TCP" = 5800:TCP:*:Enabled:vnc5800
"1700:TCP" = 1700:TCP:*:Enabled:MioNet Remote Drive Access 0
"1701:TCP" = 1701:TCP:*:Enabled:MioNet Remote Drive Access 1
"1702:TCP" = 1702:TCP:*:Enabled:MioNet Remote Drive Access 2
"1703:TCP" = 1703:TCP:*:Enabled:MioNet Remote Drive Access 3
"1704:TCP" = 1704:TCP:*:Enabled:MioNet Remote Drive Access 4
"1705:TCP" = 1705:TCP:*:Enabled:MioNet Remote Drive Access 5
"1706:TCP" = 1706:TCP:*:Enabled:MioNet Remote Drive Access 6
"1707:TCP" = 1707:TCP:*:Enabled:MioNet Remote Drive Access 7
"1708:TCP" = 1708:TCP:*:Enabled:MioNet Remote Drive Access 8
"1709:TCP" = 1709:TCP:*:Enabled:MioNet Remote Drive Access 9
"1641:TCP" = 1641:TCP:*:Enabled:MioNet Remote Drive Verification
"1647:TCP" = 1647:TCP:*:Enabled:MioNet Storage Device Configuration
"5432:UDP" = 5432:UDP:*:Enabled:MioNet Storage Device Discovery
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"N:\Programme\BitLord\BitLord.exe" = N:\Programme\BitLord\BitLord.exe:*:Enabled:BitLord
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Programme\DNA\btdna.exe" = C:\Programme\DNA\btdna.exe:*:Enabled:DNA -- (BitTorrent, Inc.)
"C:\Programme\SopCast\adv\SopAdver.exe" = C:\Programme\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver -- (www.sopcast.com)
"C:\Programme\SopCast\SopCast.exe" = C:\Programme\SopCast\SopCast.exe:*:Enabled:SopCast Main Application -- (www.sopcast.com)
"C:\Programme\Opera\Opera.exe" = C:\Programme\Opera\Opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Programme\FlashGet\flashget.exe" = C:\Programme\FlashGet\flashget.exe:*:Enabled:Flashget -- (FlashGet.com)
"C:\Programme\Gemeinsame Dateien\Nokia\Service Layer\A\nsl_host_process.exe" = C:\Programme\Gemeinsame Dateien\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process  -- (Nokia Corporation)
"C:\Programme\Nokia\Nokia Software Updater\nsu_ui_client.exe" = C:\Programme\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater -- (Nokia Corporation)
"C:\Programme\Free Video Zilla\FVZilla.exe" = C:\Programme\Free Video Zilla\FVZilla.exe:*:Enabled:FVZilla -- ()
"C:\Programme\VideoLAN\VLC\vlc.exe" = C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\TightVNC\tvnserver.exe" = C:\Programme\TightVNC\tvnserver.exe:*:Enabled:TightVNC Server -- (GlavSoft LLC.)
"C:\Programme\TightVNC\vncviewer.exe" = C:\Programme\TightVNC\vncviewer.exe:*:Enabled:TightVNC Viewer -- (TightVNC Group)
"C:\Programme\Orb Networks\Orb\bin\OrbjetManager.exe" = C:\Programme\Orb Networks\Orb\bin\OrbjetManager.exe:*:Enabled:Orb -- ()
"C:\Programme\Orb Networks\Orb\bin\Orb.exe" = C:\Programme\Orb Networks\Orb\bin\Orb.exe:*:Enabled:Orb -- (Orb Networks, Inc.)
"C:\Programme\Orb Networks\Orb\bin\OrbLauncher.exe" = C:\Programme\Orb Networks\Orb\bin\OrbLauncher.exe:*:Enabled:OrbLauncher -- (Orb Networks)
"C:\Programme\Orb Networks\Orb\bin\OrbSetupWizard.exe" = C:\Programme\Orb Networks\Orb\bin\OrbSetupWizard.exe:*:Enabled:OrbSetupWizard -- ()
"C:\Programme\Orb Networks\Orb\bin\OrbControlPanel.exe" = C:\Programme\Orb Networks\Orb\bin\OrbControlPanel.exe:*:Enabled:OrbControlPanel -- ()
"C:\Programme\Orb Networks\Orb\bin\OrbStreamerClient.exe" = C:\Programme\Orb Networks\Orb\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client -- ()
"C:\Programme\CesarFTP\Server.exe" = C:\Programme\CesarFTP\Server.exe:*:Enabled:Server -- ()
"C:\WINDOWS\system32\muzapp.exe" = C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player -- (Musiccity Co.Ltd.)
"C:\Programme\Real\RealPlayer\realplay.exe" = C:\Programme\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.)
"C:\Programme\aTube Catcher\yct.exe" = C:\Programme\aTube Catcher\yct.exe:*:Enabled:aTube Catcher to download and convert videos. -- (DsNET)
"C:\Programme\Readon TV Movie Radio Player 7.3.0.0\internettv.exe" = C:\Programme\Readon TV Movie Radio Player 7.3.0.0\internettv.exe:*:Enabled:Readon TV Movie Radio Player -- (Readon Technology)
"C:\Programme\Google\Google Earth\plugin\geplugin.exe" = C:\Programme\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth -- (Google)
"C:\Programme\Tobit Radio.fx\Server\rfx-server.exe" = C:\Programme\Tobit Radio.fx\Server\rfx-server.exe:*:Enabled:Radio.fx Server -- ()
"C:\Programme\Tobit Radio.fx\Client\rfx-client.exe" = C:\Programme\Tobit Radio.fx\Client\rfx-client.exe:*:Enabled:Radio.fx Client -- (Tobit.Software)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{089DD780-DB3F-4CDB-A0C2-111360247298}" = PC Connectivity Solution
"{0F9196C6-58B4-445B-B56E-B1200FECC151}" = Microsoft Bootvis
"{105F3CE5-FE55-408E-BF30-E78F85BA0B12}" = Dell-Druckersoftware
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{1BC0C37A-D1A5-46D4-A6DA-808C4CFB1E4A}" = Audials
"{1CF9EE4E-8C18-ECCC-2EA4-D3EED437092A}" = ccc-core-preinstall
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{2133CB3F-F891-4081-8681-FEE2B2419FF4}" = Orb Runtime libraries
"{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}" = Nokia PC Suite
"{24EE4523-711A-4BD1-95EA-F73A8A6950D3}" = Audials TV
"{26A24AE4-039D-4CA4-87B4-2F83216012F0}" = Java(TM) 6 Update 12
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java(TM) 6 Update 13
"{279D6950-AD52-B3E9-97C2-55133796CF90}" = Catalyst Control Center Graphics Previews Common
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2B238FBE-8446-9102-5469-99266D695FBD}" = Catalyst Control Center Localization All
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{324435A5-FCB1-9800-A4A0-5D3B97D08A1A}" = Catalyst Control Center Graphics Full Existing
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3953DA43-4488-9C4E-CAD6-05F1B345134B}" = ATI Catalyst Install Manager
"{39709822-5035-8DEC-740F-15217B25D0E8}" = Catalyst Control Center Graphics Full New
"{503D6E3E-1A48-44F5-BB7C-EB3B593FAED0}" = Opera 9.27
"{523BD5B6-E904-493C-B902-1BC9B7D44DF4}" = Lexmark Photo Center
"{55A29068-F2CE-456C-9148-C869879E2357}" = TuneUp Utilities 2009
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5BE3BF62-D432-4D47-A712-CD4DF91CABFB}" = ZyXEL USB ADSL-Modem
"{5C5021B0-6D3D-09AD-A95C-35094F8ACFCA}" = Catalyst Control Center HydraVision Full
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{62733593-6322-4C89-8B50-F714305A4DC6}" = TubeBox!
"{676B241C-AED4-400B-98FF-267773B94B11}_is1" = QuickFreedom 1.2.0
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D4C88F2-ED3A-AE9F-01DB-B31A307B2F9E}" = ccc-utility
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B63B2922B174135AFC0E1377DD81EC2}" = 
"{881F5DE8-9367-4B81-A325-E91BBC6472F9}" = iTunes
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)
"{9333DA9B-4F8C-4580-88A7-F12D7B10DC2A}" = Nokia Music
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A4D182C-35C7-4791-8484-4304EBC9101A}" = Windows 7 Upgrade Advisor
"{9F59C3AE-81B0-4EF6-9762-D674BB079705}" = Nokia Software Updater
"{A0DBDF40-559F-11E0-82E2-001D0926B1BF}" = Google Earth Plug-in
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A3207D62-C800-9E9C-6F7B-0E00885F693B}" = CCC Help English
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A67BB21E-D419-45BB-AB86-7D87D14BBCE2}" = Safari
"{A6E92CAB-9E63-46DC-8ABF-0CAFF7B7CD02}" = eXPert PDF 5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ABE5BD68-AB6D-A4A6-407C-85D533AC4F9B}" = Catalyst Control Center Graphics Light
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AD47A925-A7A4-D67F-2960-8CC7A8C03686}" = Catalyst Control Center Core Implementation
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B547CB8D-549A-436E-97B5-E79F911B11E2}" = SDP Downloader
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BCDA7B81-D35B-4D72-8266-6BAB9383CF2B}" = Readon TV Movie Radio Player 7.3.0.0
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C4BEEB8C-B9D2-4CD9-A2AA-1F3A1F57DF21}" = Works Suite-Betriebssystem-Pack
"{CADBCBBA-6CDD-4119-B5ED-4AE075B153E7}" = MobileMe Control Panel
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D0C73318-7B4A-4D16-A0C4-3B83F075EA88}" = Search Settings 1.2
"{D679B939-2FF1-58DE-40E0-4876F5C482A5}" = Catalyst Control Center InstallProxy
"{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"{E723FBDD-0417-4546-8EB9-49A3CD443D3D}" = Readon TV Movie Radio Player 6.0.0.0
"{EDDDC607-91D9-4758-9F57-265FDCD8A772}" = Microsoft Works 7.0 
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack
"{F2E6CAF1-D651-4A74-8CC6-D92FE81FDBCC}" = WD Drive Manager (x86)
"{F7D689BA-E7DE-4727-9F8D-936B6C30A53A}" = Rapidshare Auto Downloader 3.6.2
"{F7F2DC0A-C22E-49AD-AD37-797309A54E7B}" = Microsoft AutoRoute 2002
"{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}" = Vista Codec Package
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FC053571-8507-44E4-8B6D-AACEAB8CA57C}" =  Sansa Media Converter
"{FF8FBC40-7087-CCB9-56AA-8A65376EF948}" = ccc-core-static
"34EA302E7F4CBD17A19E33BBCB72363234956D7E" = Windows-Treiberpaket - Nokia Modem  (06/09/2010 4.5)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"6901-5136-2669-7101" = EasyTax 2010 AG 1.0
"819D45A9F73817F5B6D7C71A33ADAB88C5DA1765" = Windows-Treiberpaket - Nokia Modem  (08/03/2007 6.84.0.2)
"AD Stream Recorder_is1" = AD Stream Recorder 2.6.3
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 2.0" = Adobe Photoshop Elements 2.0
"ATI Display Driver" = ATI Display Driver
"aTube Catcher" = aTube Catcher
"Audacity_is1" = Audacity 1.2.6
"AVGAntiSpyware75" = AVG Anti-Spyware 7.5
"AviSynth" = AviSynth 2.5
"CesarFTP 0.99g_is1" = CesarFTP 0.99g
"CopyTrans Suite" = Nur Deinstallierung der CopyTrans Suite möglich.
"Core FTP LE 2.1" = Core FTP LE 2.1
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.53.1
"DivX Setup.divx.com" = DivX-Setup
"doubleTwist" = doubleTwist
"DVD Shrink DE_is1" = DVD Shrink 3.2 deutsch (DeCSS-frei)
"EasyTax 2008 AG 1.0" = EasyTax 2008 AG 1.0
"EasyTax 2009 AG 1.0" = EasyTax 2009 AG 1.0
"EEEE705096F837B7907659F100C9FE6DA001970F" = Windows-Treiberpaket - Nokia Modem  (06/09/2010 7.01.0.7)
"ffdshow_is1" = ffdshow [rev 2527] [2008-12-19]
"FlashGet" = FlashGet 1.9.6.1073
"FLV Player" = FLV Player 2.0 (build 25)
"Free Download Manager_is1" = Free Download Manager 3.0
"Free Video Zilla_is1" = Free Video Zilla
"Gadwin PrintScreen" = Gadwin PrintScreen
"HijackThis" = HijackThis 2.0.2
"ifolor-OrderClient36" = ifolor Bestellsoftware 3.6
"ImgBurn" = ImgBurn
"InstallShield_{523BD5B6-E904-493C-B902-1BC9B7D44DF4}" = Lexmark Fotocenter
"InstallShield_{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"JDownloader" = JDownloader
"Lexmark Z700-P700 Series" = Lexmark Z700-P700 Series
"Lexmark Z700-P700 Series Photo Card Reader V3.00" = Lexmark Z700-P700 Series Photo Card Reader
"LibUSB-Win32_is1" = LibUSB-Win32-0.1.12.1
"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Mozilla Firefox 4.0b8 (x86 de)" = Mozilla Firefox 4.0b8 (x86 de)
"Nero - Burning Rom!UninstallKey" = Nero 6 Enterprise Edition
"netloader" = netloader
"Nokia PC Suite" = Nokia PC Suite
"Orb" = Orb
"P2PFilter" = P2PFilter 3.0.5
"pdfsam" = pdfsam
"phonostar3RadioPlayer_is1" = phonostar-Player Version 3.02.1
"Picture Resize_is1" = Free Picture Resize Starter 4.5
"PSPgo Video 9" = PSPgo Video 9 5.04
"RealPlayer 6.0" = RealPlayer
"Riva FLV Encoder 2.0_is1" = Riva FLV Encoder 2.0
"SiSLan" = SiS 900 PCI Fast Ethernet Adapter Driver
"SopCast" = SopCast 3.0.3
"ST6UNST #1" = Camel's MPEGJoin
"SUPER ©" = SUPER © Version 2009.bld.36 (June 10, 2009)
"TightVNC" = TightVNC 2.0.2
"Tobit Radio.fx Server 1" = WDR RadioRecorder
"URLSnooper 2_is1" = URL Snooper v2.20.02
"VLC media player" = VLC media player 0.9.8a
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"WinGimp-2.0_is1" = GIMP 2.6.4
"WinPcapInst" = WinPcap 4.1.1
"WinRAR archiver" = WinRAR
"winscp3_is1" = WinSCP 4.2.5
"WinZip" = WinZip
"WM Converter 2.0" = WM Converter 2.0
"WM Recorder 12.0" = WM Recorder 12.0
"WM Recorder 14" = WM Recorder 14
"WMFDist11" = Windows Media Format 11 runtime
"Works2003Setup" = Microsoft Works 2003-Setup-Start
"Wudf01009" = Microsoft User-Mode Driver Framework Feature Pack 1.9
"xp-AntiSpy" = xp-AntiSpy 3.97
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1220945662-1177238915-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent DNA" = DNA
"Sansa Updater" = Sansa Updater
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 08.04.2011 02:32:05 | Computer Name = heimpc | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung internettv.exe, Version 7.2.0.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 09.04.2011 11:40:41 | Computer Name = heimpc | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 1.9.2.3989, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 09.04.2011 11:40:43 | Computer Name = heimpc | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3989,
 fehlgeschlagenes Modul xul.dll, Version 1.9.2.3989, Fehleradresse 0x0070b15a.
 
Error - 12.04.2011 14:11:33 | Computer Name = heimpc | Source = MsiInstaller | ID = 11706
Description = Produkt: Microsoft Office XP Professional mit FrontPage -- Fehler 
1706. Setup kann die benötigten Dateien nicht finden. Überprüfen Sie Ihre Verbindung
 mit dem Netzwerk oder dem CD-ROM-Laufwerk. Um mehr über mögliche Lösungen für dieses
 Problem zu erfahren, sehen sie bitte nach in C:\Programme\Microsoft Office\Office10\1031\SETUP.HLP.
 
Error - 12.04.2011 14:11:41 | Computer Name = heimpc | Source = MsiInstaller | ID = 11706
Description = Produkt: Microsoft Office XP Professional mit FrontPage -- Fehler 
1706. Setup kann die benötigten Dateien nicht finden. Überprüfen Sie Ihre Verbindung
 mit dem Netzwerk oder dem CD-ROM-Laufwerk. Um mehr über mögliche Lösungen für dieses
 Problem zu erfahren, sehen sie bitte nach in C:\Programme\Microsoft Office\Office10\1031\SETUP.HLP.
 
Error - 17.05.2011 10:37:49 | Computer Name = heimpc | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung wmplayer.exe, Version 9.0.0.3250, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 17.05.2011 10:37:53 | Computer Name = heimpc | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung wmplayer.exe, Version 9.0.0.3250, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 18.05.2011 02:59:44 | Computer Name = heimpc | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3989,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.2180, Fehleradresse 0x00018fea.
 
Error - 18.05.2011 08:24:02 | Computer Name = heimpc | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung internettv.exe, Version 7.3.0.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 23.05.2011 01:52:06 | Computer Name = heimpc | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung vlc.exe, Version 0.9.8.1, fehlgeschlagenes
 Modul libavcodec_plugin.dll, Version 0.0.0.0, Fehleradresse 0x001d3f05.
 
[ System Events ]
Error - 22.05.2011 04:47:56 | Computer Name = heimpc | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.0.2 für die Netzwerkkarte mit der Netzwerkadresse
 0010DCE5043B wurde durch  den DHCP-Server 192.168.0.1 abgelehnt (der DHCP-Server 
hat eine DHCPNACK-Meldung gesendet).
 
Error - 22.05.2011 04:47:59 | Computer Name = heimpc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "TuneUp Designerweiterung" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1083
 
Error - 23.05.2011 00:08:15 | Computer Name = heimpc | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.0.2 für die Netzwerkkarte mit der Netzwerkadresse
 0010DCE5043B wurde durch  den DHCP-Server 192.168.0.1 abgelehnt (der DHCP-Server 
hat eine DHCPNACK-Meldung gesendet).
 
Error - 23.05.2011 00:08:18 | Computer Name = heimpc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "TuneUp Designerweiterung" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1083
 
Error - 23.05.2011 00:08:23 | Computer Name = heimpc | Source = W32Time | ID = 39452689
Description = Zeitabieter "NtpClient": Beim DNS-Lookup für den manuell konfigurierten
 Peer  "time.windows.com,0x1" ist ein Fehler aufgetreten. Der DNS-Lookup wird in 15
 Minuten  wiederholt.  Fehler: Der Host war bei einem Socketvorgang nicht erreichbar.
 (0x80072751)
 
Error - 23.05.2011 00:08:23 | Computer Name = heimpc | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
 Zeitquellen  konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb  der
 nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung  mit der Quelle
 herzustellen.  Der NtpClient verfügt über keine Quelle mit genauer Zeit.
 
Error - 23.05.2011 03:43:51 | Computer Name = heimpc | Source = Service Control Manager | ID = 7034
Description = Dienst "LexBce Server" wurde unerwartet beendet. Dies ist bereits 
1 Mal passiert.
 
Error - 23.05.2011 04:42:25 | Computer Name = heimpc | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Apple Mobile Device" wurde unerwartet beendet. Dies ist
 bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
 durchgeführt: Starten Sie den Dienst neu..
 
Error - 23.05.2011 04:42:53 | Computer Name = heimpc | Source = Service Control Manager | ID = 7034
Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 23.05.2011 04:59:38 | Computer Name = heimpc | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Apple Mobile Device" wurde unerwartet beendet. Dies ist
 bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
 durchgeführt: Starten Sie den Dienst neu..
 
 
< End of report >

--- --- ---

markusg · 23.05.2011, 13:11

mach mal den fix, wie beschrieben.
und dann den upload, ebenfalls wie beschrieben

alephip · 23.05.2011, 13:26

hab das zip geuppt. bin unsicher ob geklappt?

All processes killed
Error: Unable to interpret <C:\Washer2.rar> in the current context!
========== OTL ==========
No active process named ros.exe was found!
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hf7o7oior1bgb4rqj6cype23nm1c7x37y moved successfully.
File C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe not found.
========== FILES ==========
File\Folder C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: philip
->Flash cache emptied: 347748 bytes

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 8843456 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: philip
->Temp folder emptied: 1666611006 bytes
->Temporary Internet Files folder emptied: 57993321 bytes
->Java cache emptied: 68092509 bytes
->FireFox cache emptied: 41635092 bytes
->Apple Safari cache emptied: 85051392 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 4229528 bytes
%systemroot%\System32 .tmp files removed: 2833287 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 32768 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1'846.00 mb

OTL by OldTimer - Version 3.2.23.0 log created on 05232011_140653

Files\Folders moved on Reboot...
File\Folder C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Temporary Internet Files\Content.IE5\S6JXSBDM\Ihre Gmail-Adresse, vorstandas@gmail.com, wurde erstellt. not found!

Registry entries deleted on Reboot...

markusg · 23.05.2011, 13:42

sorry kleiner fehler drinn
• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:

ATTFilter

:OTL
PRC - C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe ()
[2011.05.23 11:01:14 | 000,018,572 | -HS- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hf7o7oior1bgb4rqj6cype23nm1c7x37y
[2011.05.23 08:37:36 | 000,331,776 | -HS- | M] () -- C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe
:Files
C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
lösche dann das alte moved.zip bzw movedfiles.rar archiv und erstells neu
öffne arbeitsplatz, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
http://www.trojaner-board.de/54791-a...ner-board.html

alephip · 23.05.2011, 13:55

All processes killed
========== OTL ==========
No active process named ros.exe was found!
File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hf7o7oior1bgb4rqj6cype23nm1c7x37y not found.
File C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe not found.
========== FILES ==========
File\Folder C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Anwendungsdaten\ros.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: philip
->Flash cache emptied: 456 bytes

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: philip
->Temp folder emptied: 3515 bytes
->Temporary Internet Files folder emptied: 65938 bytes
->Java cache emptied: 1957 bytes
->FireFox cache emptied: 15441317 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 15.00 mb

OTL by OldTimer - Version 3.2.23.0 log created on 05232011_144920

Files\Folders moved on Reboot...
File\Folder C:\Dokumente und Einstellungen\philip\Lokale Einstellungen\Temporary Internet Files\Content.IE5\S6JXSBDM\Ihre Gmail-Adresse, vorstandas@gmail.com, wurde erstellt. not found!

Registry entries deleted on Reboot...

alephip · 23.05.2011, 14:14

hmm, jetzt lassen sich programme nicht mehr normal öffnen. es kommt immer das fenster "öffnen mit" und dann muss ich die exe suchen gehen...
gewisse programme aus der schnellstartleiste werden nicht mehr gefunden.
das ist leichtes chaos auf dem system. oder?

markusg · 23.05.2011, 15:38

ja, schaun wir mal.

bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

alephip · 23.05.2011, 15:44

ok. ich werde das combofix evtl heut abend noch machen können. doch jetzt muss ich zur arbeit. bis später und besten dank schon mal für deine tolle hilfe!
lg alephip

alephip · 24.05.2011, 16:55

hi markus
hab das combofix gemacht, doch unterwegs blauer bildschirm wegen fehler. dann bild vom speicher.....und wieder neu gestartet. kein log.txt oder so installiert, also ich find zumindest nix. was könnte der fehler sein?
gruss
alephip

markusg · 24.05.2011, 17:13

hi,

starte mal den pc im abgesicherten modus ohne netzwerk, pc neustarten und dann mit f8 versuchen, sollte klappen, dort combofix ausführen.

Befall durch Trojan-BNK.Win32.Keylogger.gen / Was tun?

Log-Analyse und Auswertung: Befall durch Trojan-BNK.Win32.Keylogger.gen / Was tun?