Trojaner-Board - Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter"

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! (https://www.trojaner-board.de/104702-malwarebytes-logfile-infizierte-file-rogue-controlcenter-bitte-um-hilfe.html)

Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe!

Hallo an alle,

ich habe heute einen Avira-Scan machen lassen, der nichts Auffälliges gefunden hat. Mit Malwarebytes wurde jedoch eine infizierte File gefunden:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8066

Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514

02.11.2011 09:42:17
mbam-log-2011-11-02 (09-42-09).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 247648
Laufzeit: 21 Minute(n), 53 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\Public\Desktop\control center.lnk (Rogue.ControlCenter) -> No action taken.

Ich weiß weder was das ist, noch wie es in den öffentlichen Benutzer reingekommen ist. Der PC ist recht neu und alles wurde neu installiert, lediglich 2-3 Freeware-Sachen (Adobe, Flash-Player & Thunderbird) wurden von Chip aus dem Netzt geladen.

Ich habe die file jetzt in Quarantäne verschoben. Soll es gelöscht werden? Ist dann alles okay oder muss das System neu installiert werden? Wie soll ich vorgehen - ich kenne mich leider mit Computern nicht wirklich aus.

Schonmal vielen Dank für eure Hilfe,
Lady

Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.

Hallo Arne,

ich habe nur noch das gefunden. Das Logfile kam, nachdem ich den Fund entfernt habe.

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8066

Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514

02.11.2011 10:12:33
mbam-log-2011-11-02 (10-12-33).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 247648
Laufzeit: 21 Minute(n), 53 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\Public\Desktop\control center.lnk (Rogue.ControlCenter) -> Quarantined and deleted successfully.

Jetzt findet Malwarebytes nichts mehr, aber ist dadurch die "Gefahr" gebannt? Oder doch lieber neu installieren?

Danke für die Hilfe!

Ich habe auch noch zwei Logfiles von RSIT. Vielleicht kann man damit mehr anfangen...

RSIT Logfile:

Code:

Logfile of random's system information tool 1.09 (written by random/random)

Run by Franziska at 2011-11-02 13:12:06

Microsoft Windows 7 Home Premium  Service Pack 1

System drive C: has 444 GB (94%) free of 472 GB

Total RAM: 1981 MB (68% free)
 

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 13:12:24, on 02.11.2011

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v8.00 (8.00.7601.17514)

Boot mode: Normal
 

Running processes:

C:\windows\system32\taskhost.exe

C:\windows\system32\Dwm.exe

C:\windows\Explorer.EXE

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe

C:\Program Files\Brother\ControlCenter3\brccMCtl.exe

C:\windows\system32\SearchFilterHost.exe

C:\Users\Franziska\Downloads\RSIT.exe

C:\Program Files\trend micro\Franziska.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MIF5BA~1\Office14\URLREDIR.DLL

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s

O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"

O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"

O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"

O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN

O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')

O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MIF5BA~1\Office14\ONBttnIE.dll/105

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MIF5BA~1\Office14\EXCEL.EXE/3000

O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Avira Email Schutz (AntiVirMailService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe

O23 - Service: Avira Planer (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira Echtzeit Scanner (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Avira Browser Schutz (AntiVirWebService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
 

--

End of file - 6450 bytes
 

=========Mozilla firefox=========
 

ProfilePath - C:\Users\Franziska\AppData\Roaming\Mozilla\Firefox\Profiles\i8m7iaox.default
 

prefs.js - "browser.startup.homepage" -  "hxxp://www.google.de/"
 

"{27182e60-b5f3-411c-b545-b44205977502}"=C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\
 
 

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]

"Description"=Adobe® Flash® Player 10.1 Plugin

"Path"=C:\windows\system32\Macromed\Flash\NPSWF32.dll
 

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]

"Description"=

"Path"=disabled
 

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]

"Description"=Ag Player Plugin

"Path"=c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll
 

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]

"Description"=Office Authorization plug-in for NPAPI browsers

"Path"=C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL
 

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]

"Description"=Microsoft SharePoint Plug-in for Firefox

"Path"=C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL
 

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709]

"Description"=WLPG Install MIME type

"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
 

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]

"Description"=Handles PDFs in-place in Firefox

"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
 

C:\Program Files\Mozilla Firefox\extensions\

{972ce4c6-7e08-4474-a285-3208198ce6fd}
 

C:\Program Files\Mozilla Firefox\components\

binary.manifest

browsercomps.dll
 

C:\Program Files\Mozilla Firefox\searchplugins\

amazondotcom-de.xml

bing.xml

eBay-de.xml

google.xml

leo_ende_de.xml

wikipedia-de.xml

yahoo-de.xml
 

======Registry dump======
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]

Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-07-27 191792]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Windows Live Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]

Office Document Cache Handler - C:\PROGRA~1\MIF5BA~1\Office14\URLREDIR.DLL [2010-02-28 561552]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]

Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2010-07-06 9394792]

"IgfxTray"=C:\Windows\system32\igfxtray.exe [2010-07-28 136216]

"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-07-28 171032]

"Persistence"=C:\Windows\system32\igfxpers.exe [2010-07-28 170520]

"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2010-11-30 997408]

"SSBkgdUpdate"=C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25 210472]

"PaperPort PTD"=C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [2008-07-09 29984]

"IndexSearch"=C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [2008-07-09 46368]

"PPort11reminder"=C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe [2007-08-31 328992]

"BrMfcWnd"=C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2009-05-26 1159168]

"ControlCenter3"=C:\Program Files\Brother\ControlCenter3\brctrcen.exe [2008-12-24 114688]

"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2011-10-26 258512]

"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]

"Malwarebytes' Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2011-08-31 1047208]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]

C:\windows\system32\igfxdev.dll [2010-07-28 228864]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"=credssp.dll
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"ConsentPromptBehaviorAdmin"=5

"ConsentPromptBehaviorUser"=3

"EnableUIADesktopToggle"=0

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]

"vidc.mrle"=msrle32.dll

"vidc.msvc"=msvidc32.dll

"msacm.imaadpcm"=imaadp32.acm

"msacm.msg711"=msg711.acm

"msacm.msgsm610"=msgsm32.acm

"msacm.msadpcm"=msadp32.acm

"midimapper"=midimap.dll

"wavemapper"=msacm32.drv

"vidc.uyvy"=msyuv.dll

"vidc.yuy2"=msyuv.dll

"vidc.yvyu"=msyuv.dll

"vidc.iyuv"=iyuv_32.dll

"vidc.i420"=iyuv_32.dll

"vidc.yvu9"=tsbyuv.dll

"msacm.l3acm"=C:\Windows\System32\l3codeca.acm

"vidc.cvid"=iccvid.dll

"wave1"=wdmaud.drv

"midi1"=wdmaud.drv

"mixer1"=wdmaud.drv

"aux1"=wdmaud.drv

"wave"=wdmaud.drv

"midi"=wdmaud.drv

"mixer"=wdmaud.drv

"aux"=wdmaud.drv

"msacm.siren"=sirenacm.dll
 

======File associations======
 

.js - edit - C:\Windows\System32\Notepad.exe %1

.js - open - C:\Windows\System32\WScript.exe "%1" %*
 

======List of files/folders created in the last 1 month======
 

2011-11-02 13:12:06 ----D---- C:\rsit

2011-11-02 13:12:06 ----D---- C:\Program Files\trend micro

2011-11-02 09:04:30 ----D---- C:\Users\Franziska\AppData\Roaming\Malwarebytes

2011-11-02 09:04:24 ----D---- C:\ProgramData\Malwarebytes

2011-11-02 09:04:20 ----D---- C:\Program Files\Malwarebytes' Anti-Malware

2011-11-02 09:04:20 ----A---- C:\windows\system32\drivers\mbam.sys

2011-11-01 16:12:58 ----D---- C:\Users\Franziska\AppData\Roaming\Macromedia

2011-11-01 16:12:41 ----D---- C:\windows\system32\Macromed

2011-11-01 14:24:58 ----D---- C:\Users\Franziska\AppData\Roaming\Adobe

2011-11-01 14:15:50 ----D---- C:\Program Files\Common Files\Adobe

2011-11-01 14:15:50 ----D---- C:\Program Files\Adobe

2011-11-01 14:14:46 ----D---- C:\ProgramData\Adobe

2011-10-31 07:58:01 ----D---- C:\windows\system32\EventProviders

2011-10-31 07:10:46 ----RD---- C:\Users\Franziska\AppData\Roaming\Brother

2011-10-31 06:58:59 ----D---- C:\windows\system32\SPReview

2011-10-27 19:36:20 ----A---- C:\windows\system32\dfshim.dll

2011-10-27 19:36:18 ----A---- C:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2011-10-27 19:36:18 ----A---- C:\windows\system32\drivers\TsUsbFlt.sys

2011-10-27 19:36:17 ----A---- C:\windows\system32\mstscax.dll

2011-10-27 19:36:15 ----A---- C:\windows\system32\mfc40u.dll

2011-10-27 19:36:15 ----A---- C:\windows\system32\mfc40.dll

2011-10-27 19:36:15 ----A---- C:\windows\system32\d3d10warp.dll

2011-10-27 19:36:14 ----A---- C:\windows\system32\sysmain.dll

2011-10-27 19:36:13 ----A---- C:\windows\system32\shell32.dll

2011-10-27 19:36:13 ----A---- C:\windows\system32\secproc_isv.dll

2011-10-27 19:36:13 ----A---- C:\windows\system32\d2d1.dll

2011-10-27 19:36:12 ----A---- C:\windows\system32\secproc.dll

2011-10-27 19:36:12 ----A---- C:\windows\system32\RMActivate_isv.exe

2011-10-27 19:36:11 ----A---- C:\windows\system32\RMActivate.exe

2011-10-27 19:36:10 ----A---- C:\windows\system32\spwizui.dll

2011-10-27 19:36:10 ----A---- C:\windows\system32\mscoree.dll

2011-10-27 19:36:09 ----A---- C:\windows\system32\mf.dll

2011-10-27 19:36:09 ----A---- C:\windows\system32\mcupdate_GenuineIntel.dll

2011-10-27 19:36:09 ----A---- C:\windows\system32\CertEnroll.dll

2011-10-27 19:36:08 ----A---- C:\windows\system32\wmp.dll

2011-10-27 19:36:08 ----A---- C:\windows\system32\PresentationHostProxy.dll

2011-10-27 19:36:08 ----A---- C:\windows\system32\PresentationHost.exe

2011-10-27 19:36:07 ----A---- C:\windows\system32\drivers\msiscsi.sys

2011-10-27 19:36:07 ----A---- C:\windows\system32\drivers\hwpolicy.sys

2011-10-27 19:36:06 ----A---- C:\windows\system32\schedsvc.dll

2011-10-27 19:36:06 ----A---- C:\windows\system32\RacEngn.dll

2011-10-27 19:36:05 ----A---- C:\windows\system32\rdpdd.dll

2011-10-27 19:36:05 ----A---- C:\windows\system32\ntdll.dll

2011-10-27 19:36:05 ----A---- C:\windows\system32\AuthFWSnapin.dll

2011-10-27 19:36:04 ----A---- C:\windows\system32\qmgr.dll

2011-10-27 19:36:04 ----A---- C:\windows\system32\ole32.dll

2011-10-27 19:36:04 ----A---- C:\windows\system32\ExplorerFrame.dll

2011-10-27 19:36:03 ----A---- C:\windows\system32\wevtsvc.dll

2011-10-27 19:36:02 ----A---- C:\windows\system32\vssapi.dll

2011-10-27 19:36:02 ----A---- C:\windows\system32\SearchFolder.dll

2011-10-27 19:36:02 ----A---- C:\windows\system32\DWrite.dll

2011-10-27 19:36:02 ----A---- C:\windows\system32\d3d9.dll

2011-10-27 19:36:01 ----A---- C:\windows\system32\taskschd.dll

2011-10-27 19:36:01 ----A---- C:\windows\system32\IKEEXT.DLL

2011-10-27 19:36:00 ----A---- C:\windows\system32\wer.dll

2011-10-27 19:36:00 ----A---- C:\windows\system32\termsrv.dll

2011-10-27 19:36:00 ----A---- C:\windows\system32\spreview.exe

2011-10-27 19:36:00 ----A---- C:\windows\system32\spinstall.exe

2011-10-27 19:36:00 ----A---- C:\windows\system32\mstsc.exe

2011-10-27 19:36:00 ----A---- C:\windows\system32\FntCache.dll

2011-10-27 19:36:00 ----A---- C:\windows\system32\crypt32.dll

2011-10-27 19:35:59 ----A---- C:\windows\system32\rpcrt4.dll

2011-10-27 19:35:59 ----A---- C:\windows\system32\msxml6.dll

2011-10-27 19:35:59 ----A---- C:\windows\system32\lsasrv.dll

2011-10-27 19:35:59 ----A---- C:\windows\system32\gpsvc.dll

2011-10-27 19:35:59 ----A---- C:\windows\system32\dwmcore.dll

2011-10-27 19:35:59 ----A---- C:\windows\system32\certcli.dll

2011-10-27 19:35:58 ----A---- C:\windows\system32\WinSAT.exe

2011-10-27 19:35:58 ----A---- C:\windows\system32\wbengine.exe

2011-10-27 19:35:58 ----A---- C:\windows\system32\scavengeui.dll

2011-10-27 19:35:58 ----A---- C:\windows\system32\quartz.dll

2011-10-27 19:35:58 ----A---- C:\windows\system32\odbc32.dll

2011-10-27 19:35:58 ----A---- C:\windows\system32\mstime.dll

2011-10-27 19:35:58 ----A---- C:\windows\system32\MPSSVC.dll

2011-10-27 19:35:58 ----A---- C:\windows\system32\diagperf.dll

2011-10-27 19:35:57 ----A---- C:\windows\system32\winhttp.dll

2011-10-27 19:35:57 ----A---- C:\windows\system32\TSWorkspace.dll

2011-10-27 19:35:57 ----A---- C:\windows\system32\tsmf.dll

2011-10-27 19:35:57 ----A---- C:\windows\system32\setupapi.dll

2011-10-27 19:35:57 ----A---- C:\windows\system32\localspl.dll

2011-10-27 19:35:57 ----A---- C:\windows\system32\iedkcs32.dll

2011-10-27 19:35:57 ----A---- C:\windows\system32\dot3api.dll

2011-10-27 19:35:56 ----A---- C:\windows\system32\WindowsCodecs.dll

2011-10-27 19:35:56 ----A---- C:\windows\system32\VSSVC.exe

2011-10-27 19:35:56 ----A---- C:\windows\system32\user32.dll

2011-10-27 19:35:56 ----A---- C:\windows\system32\netlogon.dll

2011-10-27 19:35:56 ----A---- C:\windows\system32\netcfgx.dll

2011-10-27 19:35:56 ----A---- C:\windows\system32\MSVidCtl.dll

2011-10-27 19:35:56 ----A---- C:\windows\system32\dbgeng.dll

2011-10-27 19:35:56 ----A---- C:\windows\system32\d3d11.dll

2011-10-27 19:35:56 ----A---- C:\windows\system32\apphelp.dll

2011-10-27 19:35:55 ----A---- C:\windows\system32\WsmSvc.dll

2011-10-27 19:35:55 ----A---- C:\windows\system32\WMVDECOD.DLL

2011-10-27 19:35:55 ----A---- C:\windows\system32\winlogon.exe

2011-10-27 19:35:55 ----A---- C:\windows\system32\webio.dll

2011-10-27 19:35:55 ----A---- C:\windows\system32\Query.dll

2011-10-27 19:35:55 ----A---- C:\windows\system32\drivers\rdpwd.sys

2011-10-27 19:35:55 ----A---- C:\windows\system32\advapi32.dll

2011-10-27 19:35:54 ----A---- C:\windows\system32\upnp.dll

2011-10-27 19:35:54 ----A---- C:\windows\system32\schannel.dll

2011-10-27 19:35:54 ----A---- C:\windows\system32\netfxperf.dll

2011-10-27 19:35:54 ----A---- C:\windows\system32\msv1_0.dll

2011-10-27 19:35:54 ----A---- C:\windows\system32\msdrm.dll

2011-10-27 19:35:54 ----A---- C:\windows\system32\mmcndmgr.dll

2011-10-27 19:35:54 ----A---- C:\windows\system32\lsm.exe

2011-10-27 19:35:54 ----A---- C:\windows\system32\imapi2fs.dll

2011-10-27 19:35:54 ----A---- C:\windows\system32\DShowRdpFilter.dll

2011-10-27 19:35:53 ----A---- C:\windows\system32\usp10.dll

2011-10-27 19:35:53 ----A---- C:\windows\system32\sppobjs.dll

2011-10-27 19:35:53 ----A---- C:\windows\system32\shlwapi.dll

2011-10-27 19:35:53 ----A---- C:\windows\system32\SessEnv.dll

2011-10-27 19:35:53 ----A---- C:\windows\system32\PortableDeviceApi.dll

2011-10-27 19:35:53 ----A---- C:\windows\system32\mcbuilder.exe

2011-10-27 19:35:53 ----A---- C:\windows\system32\authui.dll

2011-10-27 19:35:52 ----A---- C:\windows\system32\xpsservices.dll

2011-10-27 19:35:52 ----A---- C:\windows\system32\winload.exe

2011-10-27 19:35:52 ----A---- C:\windows\system32\WebClnt.dll

2011-10-27 19:35:52 ----A---- C:\windows\system32\userenv.dll

2011-10-27 19:35:52 ----A---- C:\windows\system32\drvstore.dll

2011-10-27 19:35:52 ----A---- C:\windows\system32\comdlg32.dll

2011-10-27 19:35:52 ----A---- C:\windows\system32\certmgr.dll

2011-10-27 19:35:52 ----A---- C:\windows\system32\audiosrv.dll

2011-10-27 19:35:51 ----A---- C:\windows\system32\sppwinob.dll

2011-10-27 19:35:51 ----A---- C:\windows\system32\rpcss.dll

2011-10-27 19:35:51 ----A---- C:\windows\system32\iphlpsvc.dll

2011-10-27 19:35:51 ----A---- C:\windows\system32\cmd.exe

2011-10-27 19:35:51 ----A---- C:\windows\system32\BFE.DLL

2011-10-27 19:35:50 ----A---- C:\windows\system32\wucltux.dll

2011-10-27 19:35:50 ----A---- C:\windows\system32\wuaueng.dll

2011-10-27 19:35:50 ----A---- C:\windows\system32\wmicmiplugin.dll

2011-10-27 19:35:50 ----A---- C:\windows\system32\Wldap32.dll

2011-10-27 19:35:50 ----A---- C:\windows\system32\winresume.exe

2011-10-27 19:35:50 ----A---- C:\windows\system32\win32spl.dll

2011-10-27 19:35:50 ----A---- C:\windows\system32\samsrv.dll

2011-10-27 19:35:50 ----A---- C:\windows\system32\propsys.dll

2011-10-27 19:35:50 ----A---- C:\windows\system32\profsvc.dll

2011-10-27 19:35:50 ----A---- C:\windows\system32\nlasvc.dll

2011-10-27 19:35:50 ----A---- C:\windows\system32\mfds.dll

2011-10-27 19:35:50 ----A---- C:\windows\system32\framedynos.dll

2011-10-27 19:35:50 ----A---- C:\windows\system32\drivers\volsnap.sys

2011-10-27 19:35:50 ----A---- C:\windows\system32\drivers\netio.sys

2011-10-27 19:35:50 ----A---- C:\windows\system32\drivers\ndis.sys

2011-10-27 19:35:49 ----A---- C:\windows\system32\werconcpl.dll

2011-10-27 19:35:49 ----A---- C:\windows\system32\ncsi.dll

2011-10-27 19:35:49 ----A---- C:\windows\system32\azroles.dll

2011-10-27 19:35:48 ----A---- C:\windows\system32\wintrust.dll

2011-10-27 19:35:48 ----A---- C:\windows\system32\themeui.dll

2011-10-27 19:35:48 ----A---- C:\windows\system32\taskeng.exe

2011-10-27 19:35:48 ----A---- C:\windows\system32\spp.dll

2011-10-27 19:35:48 ----A---- C:\windows\system32\msxml3.dll

2011-10-27 19:35:48 ----A---- C:\windows\system32\mswsock.dll

2011-10-27 19:35:48 ----A---- C:\windows\system32\mfreadwrite.dll

2011-10-27 19:35:48 ----A---- C:\windows\system32\dxgi.dll

2011-10-27 19:35:48 ----A---- C:\windows\system32\drivers\http.sys

2011-10-27 19:35:48 ----A---- C:\windows\system32\dhcpcore.dll

2011-10-27 19:35:48 ----A---- C:\windows\system32\dbghelp.dll

2011-10-27 19:35:48 ----A---- C:\windows\system32\credui.dll

2011-10-27 19:35:48 ----A---- C:\windows\system32\basecsp.dll

2011-10-27 19:35:47 ----A---- C:\windows\system32\WinSATAPI.dll

2011-10-27 19:35:47 ----A---- C:\windows\system32\taskcomp.dll

2011-10-27 19:35:47 ----A---- C:\windows\system32\spoolsv.exe

2011-10-27 19:35:47 ----A---- C:\windows\system32\NaturalLanguage6.dll

2011-10-27 19:35:47 ----A---- C:\windows\system32\gdi32.dll

2011-10-27 19:35:47 ----A---- C:\windows\system32\evr.dll

2011-10-27 19:35:47 ----A---- C:\windows\system32\drivers\mrxdav.sys

2011-10-27 19:35:47 ----A---- C:\windows\system32\drivers\1394ohci.sys

2011-10-27 19:35:47 ----A---- C:\windows\system32\calc.exe

2011-10-27 19:35:46 ----A---- C:\windows\system32\vpnike.dll

2011-10-27 19:35:46 ----A---- C:\windows\system32\UIRibbon.dll

2011-10-27 19:35:46 ----A---- C:\windows\system32\srvsvc.dll

2011-10-27 19:35:46 ----A---- C:\windows\system32\sqlsrv32.dll

2011-10-27 19:35:46 ----A---- C:\windows\system32\QAGENTRT.DLL

2011-10-27 19:35:46 ----A---- C:\windows\system32\lpksetup.exe

2011-10-27 19:35:46 ----A---- C:\windows\system32\fveapi.dll

2011-10-27 19:35:46 ----A---- C:\windows\system32\cryptsvc.dll

2011-10-27 19:35:45 ----A---- C:\windows\system32\ws2_32.dll

2011-10-27 19:35:45 ----A---- C:\windows\system32\sxs.dll

2011-10-27 19:35:45 ----A---- C:\windows\system32\stobject.dll

2011-10-27 19:35:45 ----A---- C:\windows\system32\netshell.dll

2011-10-27 19:35:45 ----A---- C:\windows\system32\inetpp.dll

2011-10-27 19:35:45 ----A---- C:\windows\system32\ie4uinit.exe

2011-10-27 19:35:45 ----A---- C:\windows\system32\hgprint.dll

2011-10-27 19:35:45 ----A---- C:\windows\system32\drivers\rdbss.sys

2011-10-27 19:35:45 ----A---- C:\windows\system32\drivers\msdsm.sys

2011-10-27 19:35:45 ----A---- C:\windows\system32\drivers\fvevol.sys

2011-10-27 19:35:45 ----A---- C:\windows\system32\comctl32.dll

2011-10-27 19:35:44 ----A---- C:\windows\system32\WSDApi.dll

2011-10-27 19:35:44 ----A---- C:\windows\system32\wmpeffects.dll

2011-10-27 19:35:44 ----A---- C:\windows\system32\rpchttp.dll

2011-10-27 19:35:44 ----A---- C:\windows\system32\prncache.dll

2011-10-27 19:35:44 ----A---- C:\windows\system32\printui.dll

2011-10-27 19:35:44 ----A---- C:\windows\system32\net1.exe

2011-10-27 19:35:44 ----A---- C:\windows\system32\msi.dll

2011-10-27 19:35:44 ----A---- C:\windows\system32\dps.dll

2011-10-27 19:35:44 ----A---- C:\windows\system32\ci.dll

2011-10-27 19:35:43 ----A---- C:\windows\system32\vds.exe

2011-10-27 19:35:43 ----A---- C:\windows\system32\scansetting.dll

2011-10-27 19:35:43 ----A---- C:\windows\system32\FXSSVC.exe

2011-10-27 19:35:43 ----A---- C:\windows\system32\drivers\pci.sys

2011-10-27 19:35:43 ----A---- C:\windows\system32\aitagent.exe

2011-10-27 19:35:43 ----A---- C:\windows\system32\aepdu.dll

2011-10-27 19:35:42 ----A---- C:\windows\system32\wpdshext.dll

2011-10-27 19:35:42 ----A---- C:\windows\system32\WMVCORE.DLL

2011-10-27 19:35:42 ----A---- C:\windows\system32\wlangpui.dll

2011-10-27 19:35:42 ----A---- C:\windows\system32\t2embed.dll

2011-10-27 19:35:42 ----A---- C:\windows\system32\QSHVHOST.DLL

2011-10-27 19:35:42 ----A---- C:\windows\system32\pnidui.dll

2011-10-27 19:35:42 ----A---- C:\windows\system32\MMDevAPI.dll

2011-10-27 19:35:42 ----A---- C:\windows\system32\IPSECSVC.DLL

2011-10-27 19:35:42 ----A---- C:\windows\system32\davclnt.dll

2011-10-27 19:35:42 ----A---- C:\windows\system32\consent.exe

2011-10-27 19:35:42 ----A---- C:\windows\system32\aaclient.dll

2011-10-27 19:35:41 ----A---- C:\windows\system32\wuapi.dll

2011-10-27 19:35:41 ----A---- C:\windows\system32\wscapi.dll

2011-10-27 19:35:41 ----A---- C:\windows\system32\webservices.dll

2011-10-27 19:35:41 ----A---- C:\windows\system32\TsUsbGDCoInstaller.dll

2011-10-27 19:35:41 ----A---- C:\windows\system32\SyncCenter.dll

2011-10-27 19:35:41 ----A---- C:\windows\system32\sdengin2.dll

2011-10-27 19:35:41 ----A---- C:\windows\system32\netdiagfx.dll

2011-10-27 19:35:41 ----A---- C:\windows\system32\fde.dll

2011-10-27 19:35:41 ----A---- C:\windows\system32\drivers\termdd.sys

2011-10-27 19:35:41 ----A---- C:\windows\system32\drivers\sbp2port.sys

2011-10-27 19:35:40 ----A---- C:\windows\system32\wisptis.exe

2011-10-27 19:35:40 ----A---- C:\windows\system32\winsta.dll

2011-10-27 19:35:40 ----A---- C:\windows\system32\WinSCard.dll

2011-10-27 19:35:40 ----A---- C:\windows\system32\rdpcore.dll

2011-10-27 19:35:40 ----A---- C:\windows\system32\pla.dll

2011-10-27 19:35:40 ----A---- C:\windows\system32\MSMPEG2ENC.DLL

2011-10-27 19:35:40 ----A---- C:\windows\system32\msasn1.dll

2011-10-27 19:35:40 ----A---- C:\windows\system32\mcmde.dll

2011-10-27 19:35:40 ----A---- C:\windows\system32\drivers\vhdmp.sys

2011-10-27 19:35:39 ----A---- C:\windows\system32\WUDFSvc.dll

2011-10-27 19:35:39 ----A---- C:\windows\system32\wiaservc.dll

2011-10-27 19:35:39 ----A---- C:\windows\system32\setupcl.exe

2011-10-27 19:35:39 ----A---- C:\windows\system32\ntshrui.dll

2011-10-27 19:35:39 ----A---- C:\windows\system32\imapi2.dll

2011-10-27 19:35:39 ----A---- C:\windows\system32\iepeers.dll

2011-10-27 19:35:39 ----A---- C:\windows\system32\DXPTaskRingtone.dll

2011-10-27 19:35:39 ----A---- C:\windows\system32\drivers\msahci.sys

2011-10-27 19:35:39 ----A---- C:\windows\system32\aeinv.dll

2011-10-27 19:35:38 ----A---- C:\windows\system32\WMPEncEn.dll

2011-10-27 19:35:38 ----A---- C:\windows\system32\winmm.dll

2011-10-27 19:35:38 ----A---- C:\windows\system32\TabSvc.dll

2011-10-27 19:35:38 ----A---- C:\windows\system32\shsvcs.dll

2011-10-27 19:35:38 ----A---- C:\windows\system32\rasmans.dll

2011-10-27 19:35:38 ----A---- C:\windows\system32\onex.dll

2011-10-27 19:35:38 ----A---- C:\windows\system32\gameux.dll

2011-10-27 19:35:38 ----A---- C:\windows\system32\dwmredir.dll

2011-10-27 19:35:38 ----A---- C:\windows\system32\drivers\udfs.sys

2011-10-27 19:35:38 ----A---- C:\windows\system32\drivers\acpi.sys

2011-10-27 19:35:37 ----A---- C:\windows\system32\vaultsvc.dll

2011-10-27 19:35:37 ----A---- C:\windows\system32\netiohlp.dll

2011-10-27 19:35:37 ----A---- C:\windows\system32\Narrator.exe

2011-10-27 19:35:37 ----A---- C:\windows\system32\hbaapi.dll

2011-10-27 19:35:37 ----A---- C:\windows\system32\bootres.dll

2011-10-27 19:35:37 ----A---- C:\windows\system32\autofmt.exe

2011-10-27 19:35:36 ----A---- C:\windows\system32\thumbcache.dll

2011-10-27 19:35:36 ----A---- C:\windows\system32\samcli.dll

2011-10-27 19:35:36 ----A---- C:\windows\system32\regapi.dll

2011-10-27 19:35:36 ----A---- C:\windows\system32\proquota.exe

2011-10-27 19:35:36 ----A---- C:\windows\system32\msutb.dll

2011-10-27 19:35:36 ----A---- C:\windows\system32\msinfo32.exe

2011-10-27 19:35:36 ----A---- C:\windows\system32\mimefilt.dll

2011-10-27 19:35:36 ----A---- C:\windows\system32\ipsmsnap.dll

2011-10-27 19:35:36 ----A---- C:\windows\system32\IPHLPAPI.DLL

2011-10-27 19:35:36 ----A---- C:\windows\system32\halmacpi.dll

2011-10-27 19:35:36 ----A---- C:\windows\system32\hal.dll

2011-10-27 19:35:36 ----A---- C:\windows\system32\autoconv.exe

2011-10-27 19:35:36 ----A---- C:\windows\system32\autochk.exe

2011-10-27 19:35:36 ----A---- C:\windows\system32\AudioSes.dll

2011-10-27 19:35:36 ----A---- C:\windows\system32\audiodg.exe

2011-10-27 19:35:35 ----A---- C:\windows\system32\wcncsvc.dll

2011-10-27 19:35:35 ----A---- C:\windows\system32\tcpipcfg.dll

2011-10-27 19:35:35 ----A---- C:\windows\system32\sspicli.dll

2011-10-27 19:35:35 ----A---- C:\windows\system32\srchadmin.dll

2011-10-27 19:35:35 ----A---- C:\windows\system32\schtasks.exe

2011-10-27 19:35:35 ----A---- C:\windows\system32\QAGENT.DLL

2011-10-27 19:35:35 ----A---- C:\windows\system32\powercpl.dll

2011-10-27 19:35:35 ----A---- C:\windows\system32\netid.dll

2011-10-27 19:35:35 ----A---- C:\windows\system32\msihnd.dll

2011-10-27 19:35:35 ----A---- C:\windows\system32\mscorier.dll

2011-10-27 19:35:35 ----A---- C:\windows\system32\framedyn.dll

2011-10-27 19:35:35 ----A---- C:\windows\system32\eapphost.dll

2011-10-27 19:35:35 ----A---- C:\windows\system32\drivers\volmgr.sys

2011-10-27 19:35:35 ----A---- C:\windows\system32\drivers\partmgr.sys

2011-10-27 19:35:35 ----A---- C:\windows\system32\drivers\netbt.sys

2011-10-27 19:35:35 ----A---- C:\windows\system32\AuxiliaryDisplayCpl.dll

2011-10-27 19:35:34 ----A---- C:\windows\system32\wdc.dll

2011-10-27 19:35:34 ----A---- C:\windows\system32\untfs.dll

2011-10-27 19:35:34 ----A---- C:\windows\system32\umpo.dll

2011-10-27 19:35:34 ----A---- C:\windows\system32\StructuredQuery.dll

2011-10-27 19:35:34 ----A---- C:\windows\system32\scesrv.dll

2011-10-27 19:35:34 ----A---- C:\windows\system32\DXP.dll

2011-10-27 19:35:34 ----A---- C:\windows\system32\actxprxy.dll

2011-10-27 19:35:33 ----A---- C:\windows\system32\WMNetMgr.dll

2011-10-27 19:35:33 ----A---- C:\windows\system32\wlanpref.dll

2011-10-27 19:35:33 ----A---- C:\windows\system32\Vault.dll

2011-10-27 19:35:33 ----A---- C:\windows\system32\sppsvc.exe

2011-10-27 19:35:33 ----A---- C:\windows\system32\sdclt.exe

2011-10-27 19:35:33 ----A---- C:\windows\system32\RpcRtRemote.dll

2011-10-27 19:35:33 ----A---- C:\windows\system32\Robocopy.exe

2011-10-27 19:35:33 ----A---- C:\windows\system32\rastls.dll

2011-10-27 19:35:33 ----A---- C:\windows\system32\nci.dll

2011-10-27 19:35:33 ----A---- C:\windows\system32\ListSvc.dll

2011-10-27 19:35:33 ----A---- C:\windows\system32\licmgr10.dll

2011-10-27 19:35:33 ----A---- C:\windows\system32\drivers\ataport.sys

2011-10-27 19:35:32 ----A---- C:\windows\system32\XpsRasterService.dll

2011-10-27 19:35:32 ----A---- C:\windows\system32\userinit.exe

2011-10-27 19:35:32 ----A---- C:\windows\system32\taskmgr.exe

2011-10-27 19:35:32 ----A---- C:\windows\system32\sharemediacpl.dll

2011-10-27 19:35:32 ----A---- C:\windows\system32\mtxclu.dll

2011-10-27 19:35:32 ----A---- C:\windows\system32\msdri.dll

2011-10-27 19:35:32 ----A---- C:\windows\system32\DxpTaskSync.dll

2011-10-27 19:35:32 ----A---- C:\windows\system32\drivers\mpio.sys

2011-10-27 19:35:32 ----A---- C:\windows\system32\drivers\mountmgr.sys

2011-10-27 19:35:32 ----A---- C:\windows\system32\Display.dll

2011-10-27 19:35:31 ----A---- C:\windows\system32\termmgr.dll

2011-10-27 19:35:31 ----A---- C:\windows\system32\puiobj.dll

2011-10-27 19:35:31 ----A---- C:\windows\system32\eudcedit.exe

2011-10-27 19:35:31 ----A---- C:\windows\system32\drivers\scsiport.sys

2011-10-27 19:35:31 ----A---- C:\windows\system32\DiagCpl.dll

2011-10-27 19:35:30 ----A---- C:\windows\system32\wpccpl.dll

2011-10-27 19:35:30 ----A---- C:\windows\system32\wiadefui.dll

2011-10-27 19:35:30 ----A---- C:\windows\system32\themecpl.dll

2011-10-27 19:35:30 ----A---- C:\windows\system32\sppcomapi.dll

2011-10-27 19:35:30 ----A---- C:\windows\system32\shsetup.dll

2011-10-27 19:35:30 ----A---- C:\windows\system32\SensorsCpl.dll

2011-10-27 19:35:30 ----A---- C:\windows\system32\rasppp.dll

2011-10-27 19:35:30 ----A---- C:\windows\system32\msdtctm.dll

2011-10-27 19:35:30 ----A---- C:\windows\system32\msconfig.exe

2011-10-27 19:35:30 ----A---- C:\windows\system32\logoncli.dll

2011-10-27 19:35:30 ----A---- C:\windows\system32\FWPUCLNT.DLL

2011-10-27 19:35:30 ----A---- C:\windows\system32\FirewallControlPanel.dll

2011-10-27 19:35:30 ----A---- C:\windows\system32\cabview.dll

2011-10-27 19:35:30 ----A---- C:\windows\system32\biocpl.dll

2011-10-27 19:35:29 ----A---- C:\windows\system32\tapisrv.dll

2011-10-27 19:35:29 ----A---- C:\windows\system32\scecli.dll

2011-10-27 19:35:29 ----A---- C:\windows\system32\PhotoScreensaver.scr

2011-10-27 19:35:29 ----A---- C:\windows\system32\mscories.dll

2011-10-27 19:35:29 ----A---- C:\windows\system32\mscms.dll

2011-10-27 19:35:29 ----A---- C:\windows\system32\localsec.dll

2011-10-27 19:35:29 ----A---- C:\windows\system32\hgcpl.dll

2011-10-27 19:35:29 ----A---- C:\windows\system32\fontext.dll

2011-10-27 19:35:29 ----A---- C:\windows\system32\drivers\rdyboost.sys

2011-10-27 19:35:29 ----A---- C:\windows\system32\drivers\ksecdd.sys

2011-10-27 19:35:29 ----A---- C:\windows\system32\dnscmmc.dll

2011-10-27 19:35:28 ----A---- C:\windows\system32\wpdbusenum.dll

2011-10-27 19:35:28 ----A---- C:\windows\system32\wlanui.dll

2011-10-27 19:35:28 ----A---- C:\windows\system32\wkssvc.dll

2011-10-27 19:35:28 ----A---- C:\windows\system32\wksprt.exe

2011-10-27 19:35:28 ----A---- C:\windows\system32\w32tm.exe

2011-10-27 19:35:28 ----A---- C:\windows\system32\VAN.dll

2011-10-27 19:35:28 ----A---- C:\windows\system32\usercpl.dll

2011-10-27 19:35:28 ----A---- C:\windows\system32\srcore.dll

2011-10-27 19:35:28 ----A---- C:\windows\system32\SndVolSSO.dll

2011-10-27 19:35:28 ----A---- C:\windows\system32\SndVol.exe

2011-10-27 19:35:28 ----A---- C:\windows\system32\qedit.dll

2011-10-27 19:35:28 ----A---- C:\windows\system32\qdvd.dll

2011-10-27 19:35:28 ----A---- C:\windows\system32\prntvpt.dll

2011-10-27 19:35:28 ----A---- C:\windows\system32\PerfCenterCPL.dll

2011-10-27 19:35:28 ----A---- C:\windows\system32\netcenter.dll

2011-10-27 19:35:28 ----A---- C:\windows\system32\mprddm.dll

2011-10-27 19:35:28 ----A---- C:\windows\system32\mblctr.exe

2011-10-27 19:35:28 ----A---- C:\windows\system32\KMSVC.DLL

2011-10-27 19:35:28 ----A---- C:\windows\system32\iasacct.dll

2011-10-27 19:35:28 ----A---- C:\windows\system32\bcdsrv.dll

2011-10-27 19:35:28 ----A---- C:\windows\system32\batmeter.dll

2011-10-27 19:35:27 ----A---- C:\windows\system32\zipfldr.dll

2011-10-27 19:35:27 ----A---- C:\windows\system32\spwizeng.dll

2011-10-27 19:35:27 ----A---- C:\windows\system32\MSAC3ENC.DLL

2011-10-27 19:35:27 ----A---- C:\windows\system32\fdeploy.dll

2011-10-27 19:35:27 ----A---- C:\windows\system32\drivers\ks.sys

2011-10-27 19:35:27 ----A---- C:\windows\system32\azroleui.dll

2011-10-27 19:35:27 ----A---- C:\windows\system32\accessibilitycpl.dll

2011-10-27 19:35:26 ----A---- C:\windows\system32\wusa.exe

2011-10-27 19:35:26 ----A---- C:\windows\system32\sud.dll

2011-10-27 19:35:26 ----A---- C:\windows\system32\prnfldr.dll

2011-10-27 19:35:26 ----A---- C:\windows\system32\OnLineIDCpl.dll

2011-10-27 19:35:26 ----A---- C:\windows\system32\networkmap.dll

2011-10-27 19:35:26 ----A---- C:\windows\system32\netjoin.dll

2011-10-27 19:35:26 ----A---- C:\windows\system32\mspbda.dll

2011-10-27 19:35:26 ----A---- C:\windows\system32\MCEWMDRMNDBootstrap.dll

2011-10-27 19:35:26 ----A---- C:\windows\system32\Faultrep.dll

2011-10-27 19:35:26 ----A---- C:\windows\system32\cryptui.dll

2011-10-27 19:35:26 ----A---- C:\windows\system32\adsldp.dll

2011-10-27 19:35:26 ----A---- C:\windows\system32\ActionCenter.dll

2011-10-27 19:35:25 ----A---- C:\windows\system32\taskhost.exe

2011-10-27 19:35:25 ----A---- C:\windows\system32\taskbarcpl.dll

2011-10-27 19:35:25 ----A---- C:\windows\system32\slui.exe

2011-10-27 19:35:25 ----A---- C:\windows\system32\rdpcorekmts.dll

2011-10-27 19:35:25 ----A---- C:\windows\system32\photowiz.dll

2011-10-27 19:35:25 ----A---- C:\windows\system32\msieftp.dll

2011-10-27 19:35:25 ----A---- C:\windows\system32\MediaMetadataHandler.dll

2011-10-27 19:35:25 ----A---- C:\windows\system32\iprtrmgr.dll

2011-10-27 19:35:25 ----A---- C:\windows\system32\iasrad.dll

2011-10-27 19:35:25 ----A---- C:\windows\system32\drivers\hidclass.sys

2011-10-27 19:35:25 ----A---- C:\windows\system32\dot3cfg.dll

2011-10-27 19:35:25 ----A---- C:\windows\system32\defaultlocationcpl.dll

2011-10-27 19:35:25 ----A---- C:\windows\system32\credssp.dll

2011-10-27 19:35:24 ----A---- C:\windows\system32\wpd_ci.dll

2011-10-27 19:35:24 ----A---- C:\windows\system32\syncui.dll

2011-10-27 19:35:24 ----A---- C:\windows\system32\sisbkup.dll

2011-10-27 19:35:24 ----A---- C:\windows\system32\shwebsvc.dll

2011-10-27 19:35:24 ----A---- C:\windows\system32\sdcpl.dll

2011-10-27 19:35:24 ----A---- C:\windows\system32\recovery.dll

2011-10-27 19:35:24 ----A---- C:\windows\system32\ifsutil.dll

2011-10-27 19:35:24 ----A---- C:\windows\system32\ieUnatt.exe

2011-10-27 19:35:24 ----A---- C:\windows\system32\iesysprep.dll

2011-10-27 19:35:24 ----A---- C:\windows\system32\halacpi.dll

2011-10-27 19:35:24 ----A---- C:\windows\system32\ftp.exe

2011-10-27 19:35:24 ----A---- C:\windows\system32\efscore.dll

2011-10-27 19:35:24 ----A---- C:\windows\system32\autoplay.dll

2011-10-27 19:35:24 ----A---- C:\windows\system32\ActionCenterCPL.dll

2011-10-27 19:35:23 ----A---- C:\windows\system32\wmpmde.dll

2011-10-27 19:35:23 ----A---- C:\windows\system32\vdsutil.dll

2011-10-27 19:35:23 ----A---- C:\windows\system32\systemcpl.dll

2011-10-27 19:35:23 ----A---- C:\windows\system32\sppnp.dll

2011-10-27 19:35:23 ----A---- C:\windows\system32\SmartcardCredentialProvider.dll

2011-10-27 19:35:23 ----A---- C:\windows\system32\rtutils.dll

2011-10-27 19:35:23 ----A---- C:\windows\system32\recdisc.exe

2011-10-27 19:35:23 ----A---- C:\windows\system32\rdpwsx.dll

2011-10-27 19:35:23 ----A---- C:\windows\system32\OobeFldr.dll

2011-10-27 19:35:23 ----A---- C:\windows\system32\ntprint.dll

2011-10-27 19:35:23 ----A---- C:\windows\system32\ntlanman.dll

2011-10-27 19:35:23 ----A---- C:\windows\system32\dskquoui.dll

2011-10-27 19:35:23 ----A---- C:\windows\system32\DeviceCenter.dll

2011-10-27 19:35:23 ----A---- C:\windows\system32\bcdedit.exe

2011-10-27 19:35:22 ----A---- C:\windows\system32\wmpsrcwp.dll

2011-10-27 19:35:22 ----A---- C:\windows\system32\sethc.exe

2011-10-27 19:35:22 ----A---- C:\windows\system32\rstrui.exe

2011-10-27 19:35:22 ----A---- C:\windows\system32\riched20.dll

2011-10-27 19:35:22 ----A---- C:\windows\system32\nshwfp.dll

2011-10-27 19:35:22 ----A---- C:\windows\system32\netplwiz.dll

2011-10-27 19:35:22 ----A---- C:\windows\system32\NAPHLPR.DLL

2011-10-27 19:35:22 ----A---- C:\windows\system32\migisol.dll

2011-10-27 19:35:22 ----A---- C:\windows\system32\fms.dll

2011-10-27 19:35:22 ----A---- C:\windows\system32\drivers\tdx.sys

2011-10-27 19:35:22 ----A---- C:\windows\system32\dpx.dll

2011-10-27 19:35:22 ----A---- C:\windows\system32\blackbox.dll

2011-10-27 19:35:22 ----A---- C:\windows\system32\bcdboot.exe

2011-10-27 19:35:22 ----A---- C:\windows\system32\AxInstSv.dll

2011-10-27 19:35:22 ----A---- C:\windows\system32\AuxiliaryDisplayServices.dll

2011-10-27 19:35:22 ----A---- C:\windows\system32\activeds.dll

2011-10-27 19:35:21 ----A---- C:\windows\system32\nshipsec.dll

2011-10-27 19:35:21 ----A---- C:\windows\system32\nlaapi.dll

2011-10-27 19:35:21 ----A---- C:\windows\system32\httpapi.dll

2011-10-27 19:35:21 ----A---- C:\windows\system32\drivers\tssecsrv.sys

2011-10-27 19:35:21 ----A---- C:\windows\system32\dot3svc.dll

2011-10-27 19:35:21 ----A---- C:\windows\system32\cdosys.dll

2011-10-27 19:35:21 ----A---- C:\windows\system32\asycfilt.dll

2011-10-27 19:35:20 ----A---- C:\windows\system32\wvc.dll

2011-10-27 19:35:20 ----A---- C:\windows\system32\wuwebv.dll

2011-10-27 19:35:20 ----A---- C:\windows\system32\wtsapi32.dll

2011-10-27 19:35:20 ----A---- C:\windows\system32\wsqmcons.exe

2011-10-27 19:35:20 ----A---- C:\windows\system32\wlanmsm.dll

2011-10-27 19:35:20 ----A---- C:\windows\system32\wimgapi.dll

2011-10-27 19:35:20 ----A---- C:\windows\system32\wavemsp.dll

2011-10-27 19:35:20 ----A---- C:\windows\system32\tzutil.exe

2011-10-27 19:35:20 ----A---- C:\windows\system32\sysclass.dll

2011-10-27 19:35:20 ----A---- C:\windows\system32\ReAgent.dll

2011-10-27 19:35:20 ----A---- C:\windows\system32\provsvc.dll

2011-10-27 19:35:20 ----A---- C:\windows\system32\ocsetup.exe

2011-10-27 19:35:20 ----A---- C:\windows\system32\msftedit.dll

2011-10-27 19:35:20 ----A---- C:\windows\system32\isoburn.exe

2011-10-27 19:35:20 ----A---- C:\windows\system32\dsuiext.dll

2011-10-27 19:35:20 ----A---- C:\windows\system32\drivers\ndproxy.sys

2011-10-27 19:35:20 ----A---- C:\windows\system32\dot3ui.dll

2011-10-27 19:35:20 ----A---- C:\windows\system32\dfrgui.exe

2011-10-27 19:35:20 ----A---- C:\windows\system32\appinfo.dll

2011-10-27 19:35:19 ----A---- C:\windows\twain_32.dll

2011-10-27 19:35:19 ----A---- C:\windows\system32\webcheck.dll

2011-10-27 19:35:19 ----A---- C:\windows\system32\twext.dll

2011-10-27 19:35:19 ----A---- C:\windows\system32\shdocvw.dll

2011-10-27 19:35:19 ----A---- C:\windows\system32\setupugc.exe

2011-10-27 19:35:19 ----A---- C:\windows\system32\qcap.dll

2011-10-27 19:35:19 ----A---- C:\windows\system32\qasf.dll

2011-10-27 19:35:19 ----A---- C:\windows\system32\PkgMgr.exe

2011-10-27 19:35:19 ----A---- C:\windows\system32\occache.dll

2011-10-27 19:35:19 ----A---- C:\windows\system32\mstask.dll

2011-10-27 19:35:19 ----A---- C:\windows\system32\msfeedsbs.dll

2011-10-27 19:35:19 ----A---- C:\windows\system32\certprop.dll

2011-10-27 19:35:18 ----A---- C:\windows\system32\wwanconn.dll

2011-10-27 19:35:18 ----A---- C:\windows\system32\wmdrmsdk.dll

2011-10-27 19:35:18 ----A---- C:\windows\system32\uxlib.dll

2011-10-27 19:35:18 ----A---- C:\windows\system32\ssText3d.scr

2011-10-27 19:35:18 ----A---- C:\windows\system32\srrstr.dll

2011-10-27 19:35:18 ----A---- C:\windows\system32\SmiEngine.dll

2011-10-27 19:35:18 ----A---- C:\windows\system32\slwga.dll

2011-10-27 19:35:18 ----A---- C:\windows\system32\nslookup.exe

2011-10-27 19:35:18 ----A---- C:\windows\system32\msvfw32.dll

2011-10-27 19:35:18 ----A---- C:\windows\system32\msrating.dll

2011-10-27 19:35:18 ----A---- C:\windows\system32\mciavi32.dll

2011-10-27 19:35:18 ----A---- C:\windows\system32\imm32.dll

2011-10-27 19:35:18 ----A---- C:\windows\system32\imgutil.dll

2011-10-27 19:35:18 ----A---- C:\windows\system32\audiodev.dll

2011-10-27 19:35:17 ----A---- C:\windows\system32\WPDShServiceObj.dll

2011-10-27 19:35:17 ----A---- C:\windows\system32\wimserv.exe

2011-10-27 19:35:17 ----A---- C:\windows\system32\TSpkg.dll

2011-10-27 19:35:17 ----A---- C:\windows\system32\sdrsvc.dll

2011-10-27 19:35:17 ----A---- C:\windows\system32\remotepg.dll

2011-10-27 19:35:17 ----A---- C:\windows\system32\rdpencom.dll

2011-10-27 19:35:17 ----A---- C:\windows\system32\raschap.dll

2011-10-27 19:35:17 ----A---- C:\windows\system32\QUTIL.DLL

2011-10-27 19:35:17 ----A---- C:\windows\system32\perfmon.exe

2011-10-27 19:35:17 ----A---- C:\windows\system32\NAPCRYPT.DLL

2011-10-27 19:35:17 ----A---- C:\windows\system32\msscp.dll

2011-10-27 19:35:17 ----A---- C:\windows\system32\input.dll

2011-10-27 19:35:17 ----A---- C:\windows\system32\drmmgrtn.dll

2011-10-27 19:35:17 ----A---- C:\windows\system32\diskraid.exe

2011-10-27 19:35:17 ----A---- C:\windows\system32\DevicePairingFolder.dll

2011-10-27 19:35:17 ----A---- C:\windows\system32\clusapi.dll

2011-10-27 19:35:17 ----A---- C:\windows\system32\browser.dll

2011-10-27 19:35:17 ----A---- C:\windows\system32\acppage.dll

2011-10-27 19:35:16 ----A---- C:\windows\system32\wpdwcn.dll

2011-10-27 19:35:16 ----A---- C:\windows\system32\wmpdxm.dll

2011-10-27 19:35:16 ----A---- C:\windows\system32\WindowsAnytimeUpgradeResults.exe

2011-10-27 19:35:16 ----A---- C:\windows\system32\vpnikeapi.dll

2011-10-27 19:35:16 ----A---- C:\windows\system32\vdsbas.dll

2011-10-27 19:35:16 ----A---- C:\windows\system32\UserAccountControlSettings.dll

2011-10-27 19:35:16 ----A---- C:\windows\system32\runonce.exe

2011-10-27 19:35:16 ----A---- C:\windows\system32\RegisterIEPKEYs.exe

2011-10-27 19:35:16 ----A---- C:\windows\system32\onexui.dll

2011-10-27 19:35:16 ----A---- C:\windows\system32\olepro32.dll

2011-10-27 19:35:16 ----A---- C:\windows\system32\ocsetapi.dll

2011-10-27 19:35:16 ----A---- C:\windows\system32\nltest.exe

2011-10-27 19:35:16 ----A---- C:\windows\system32\networkexplorer.dll

2011-10-27 19:35:16 ----A---- C:\windows\system32\Mcx2Svc.dll

2011-10-27 19:35:16 ----A---- C:\windows\system32\logagent.exe

2011-10-27 19:35:16 ----A---- C:\windows\system32\iTVData.dll

2011-10-27 19:35:16 ----A---- C:\windows\system32\inseng.dll

2011-10-27 19:35:16 ----A---- C:\windows\system32\dxdiagn.dll

2011-10-27 19:35:16 ----A---- C:\windows\bfsvc.exe

2011-10-27 19:35:15 ----A---- C:\windows\system32\sspisrv.dll

2011-10-27 19:35:14 ----A---- C:\windows\system32\wudriver.dll

2011-10-27 19:35:14 ----A---- C:\windows\system32\wmpshell.dll

2011-10-27 19:35:14 ----A---- C:\windows\system32\wmdrmdev.dll

2011-10-27 19:35:14 ----A---- C:\windows\system32\shacct.dll

2011-10-27 19:35:14 ----A---- C:\windows\system32\PnPUnattend.exe

2011-10-27 19:35:14 ----A---- C:\windows\system32\msvidc32.dll

2011-10-27 19:35:14 ----A---- C:\windows\system32\msiexec.exe

2011-10-27 19:35:14 ----A---- C:\windows\system32\MFPlay.dll

2011-10-27 19:35:14 ----A---- C:\windows\system32\lsmproxy.dll

2011-10-27 19:35:14 ----A---- C:\windows\system32\eapp3hst.dll

2011-10-27 19:35:14 ----A---- C:\windows\system32\drivers\rmcast.sys

2011-10-27 19:35:14 ----A---- C:\windows\system32\d3d10level9.dll

2011-10-27 19:35:14 ----A---- C:\windows\system32\bitsadmin.exe

2011-10-27 19:35:13 ----A---- C:\windows\system32\WUDFPlatform.dll

2011-10-27 19:35:13 ----A---- C:\windows\system32\WPDSp.dll

2011-10-27 19:35:13 ----A---- C:\windows\system32\unimdmat.dll

2011-10-27 19:35:13 ----A---- C:\windows\system32\tabcal.exe

2011-10-27 19:35:13 ----A---- C:\windows\system32\srvcli.dll

2011-10-27 19:35:13 ----A---- C:\windows\system32\sqlcese30.dll

2011-10-27 19:35:13 ----A---- C:\windows\system32\rdpd3d.dll

2011-10-27 19:35:13 ----A---- C:\windows\system32\PortableDeviceSyncProvider.dll

2011-10-27 19:35:13 ----A---- C:\windows\system32\pdh.dll

2011-10-27 19:35:13 ----A---- C:\windows\system32\OpcServices.dll

2011-10-27 19:35:13 ----A---- C:\windows\system32\ncryptui.dll

2011-10-27 19:35:13 ----A---- C:\windows\system32\mprapi.dll

2011-10-27 19:35:13 ----A---- C:\windows\system32\logman.exe

2011-10-27 19:35:13 ----A---- C:\windows\system32\iscsium.dll

2011-10-27 19:35:13 ----A---- C:\windows\system32\djoin.exe

2011-10-27 19:35:13 ----A---- C:\windows\system32\cscapi.dll

2011-10-27 19:35:13 ----A---- C:\windows\system32\Bubbles.scr

2011-10-27 19:35:12 ----A---- C:\windows\system32\wwanprotdim.dll

2011-10-27 19:35:12 ----A---- C:\windows\system32\WMPhoto.dll

2011-10-27 19:35:12 ----A---- C:\windows\system32\WMADMOD.DLL

2011-10-27 19:35:12 ----A---- C:\windows\system32\WindowsAnytimeUpgrade.exe

2011-10-27 19:35:12 ----A---- C:\windows\system32\wiavideo.dll

2011-10-27 19:35:12 ----A---- C:\windows\system32\utildll.dll

2011-10-27 19:35:12 ----A---- C:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2011-10-27 19:35:12 ----A---- C:\windows\system32\tsgqec.dll

2011-10-27 19:35:12 ----A---- C:\windows\system32\takeown.exe

2011-10-27 19:35:12 ----A---- C:\windows\system32\Ribbons.scr

2011-10-27 19:35:12 ----A---- C:\windows\system32\QSVRMGMT.DLL

2011-10-27 19:35:12 ----A---- C:\windows\system32\PortableDeviceStatus.dll

2011-10-27 19:35:12 ----A---- C:\windows\system32\olethk32.dll

2011-10-27 19:35:12 ----A---- C:\windows\system32\Mystify.scr

2011-10-27 19:35:12 ----A---- C:\windows\system32\MdSched.exe

2011-10-27 19:35:12 ----A---- C:\windows\system32\mapistub.dll

2011-10-27 19:35:12 ----A---- C:\windows\system32\mapi32.dll

2011-10-27 19:35:12 ----A---- C:\windows\system32\lpremove.exe

2011-10-27 19:35:12 ----A---- C:\windows\system32\fphc.dll

2011-10-27 19:35:12 ----A---- C:\windows\system32\dot3msm.dll

2011-10-27 19:35:12 ----A---- C:\windows\system32\avifil32.dll

2011-10-27 19:35:12 ----A---- C:\windows\system32\ActionQueue.dll

2011-10-27 19:35:11 ----A---- C:\windows\system32\WUDFx.dll

2011-10-27 19:35:11 ----A---- C:\windows\system32\WMVSDECD.DLL

2011-10-27 19:35:11 ----A---- C:\windows\system32\wmdrmnet.dll

2011-10-27 19:35:11 ----A---- C:\windows\system32\unattend.dll

2011-10-27 19:35:11 ----A---- C:\windows\system32\sppinst.dll

2011-10-27 19:35:11 ----A---- C:\windows\system32\qdv.dll

2011-10-27 19:35:11 ----A---- C:\windows\system32\QCLIPROV.DLL

2011-10-27 19:35:11 ----A---- C:\windows\system32\msyuv.dll

2011-10-27 19:35:11 ----A---- C:\windows\system32\msrle32.dll

2011-10-27 19:35:11 ----A---- C:\windows\system32\msnetobj.dll

2011-10-27 19:35:11 ----A---- C:\windows\system32\iyuv_32.dll

2011-10-27 19:35:11 ----A---- C:\windows\system32\imagehlp.dll

2011-10-27 19:35:11 ----A---- C:\windows\system32\EhStorAPI.dll

2011-10-27 19:35:11 ----A---- C:\windows\system32\cmstp.exe

2011-10-27 19:35:11 ----A---- C:\windows\system32\cca.dll

2011-10-27 19:35:10 ----A---- C:\windows\system32\WUDFHost.exe

2011-10-27 19:35:10 ----A---- C:\windows\system32\wuauclt.exe

2011-10-27 19:35:10 ----A---- C:\windows\system32\wsnmp32.dll

2011-10-27 19:35:10 ----A---- C:\windows\system32\WMSPDMOD.DLL

2011-10-27 19:35:10 ----A---- C:\windows\system32\vfwwdm32.dll

2011-10-27 19:35:10 ----A---- C:\windows\system32\umb.dll

2011-10-27 19:35:10 ----A---- C:\windows\system32\tsbyuv.dll

2011-10-27 19:35:10 ----A---- C:\windows\system32\setupcln.dll

2011-10-27 19:35:10 ----A---- C:\windows\system32\RelPost.exe

2011-10-27 19:35:10 ----A---- C:\windows\system32\relog.exe

2011-10-27 19:35:10 ----A---- C:\windows\system32\PrintIsolationProxy.dll

2011-10-27 19:35:10 ----A---- C:\windows\system32\pdhui.dll

2011-10-27 19:35:10 ----A---- C:\windows\system32\netiougc.exe

2011-10-27 19:35:10 ----A---- C:\windows\system32\MuiUnattend.exe

2011-10-27 19:35:10 ----A---- C:\windows\system32\msorcl32.dll

2011-10-27 19:35:10 ----A---- C:\windows\system32\iasrecst.dll

2011-10-27 19:35:10 ----A---- C:\windows\system32\drivers\tcpipreg.sys

2011-10-27 19:35:10 ----A---- C:\windows\system32\drivers\ndisuio.sys

2011-10-27 19:35:10 ----A---- C:\windows\system32\basesrv.dll

2011-10-27 19:35:10 ----A---- C:\windows\system32\AzSqlExt.dll

2011-10-27 19:35:09 ----A---- C:\windows\system32\wkscli.dll

2011-10-27 19:35:09 ----A---- C:\windows\system32\WavDest.dll

2011-10-27 19:35:09 ----A---- C:\windows\system32\syssetup.dll

2011-10-27 19:35:09 ----A---- C:\windows\system32\sppuinotify.dll

2011-10-27 19:35:09 ----A---- C:\windows\system32\spbcd.dll

2011-10-27 19:35:09 ----A---- C:\windows\system32\setbcdlocale.dll

2011-10-27 19:35:09 ----A---- C:\windows\system32\secproc_ssp_isv.dll

2011-10-27 19:35:09 ----A---- C:\windows\system32\secproc_ssp.dll

2011-10-27 19:35:09 ----A---- C:\windows\system32\resutils.dll

2011-10-27 19:35:09 ----A---- C:\windows\system32\rastapi.dll

2011-10-27 19:35:09 ----A---- C:\windows\system32\nrpsrv.dll

2011-10-27 19:35:09 ----A---- C:\windows\system32\netbtugc.exe

2011-10-27 19:35:09 ----A---- C:\windows\system32\mydocs.dll

2011-10-27 19:35:09 ----A---- C:\windows\system32\MultiDigiMon.exe

2011-10-27 19:35:09 ----A---- C:\windows\system32\itircl.dll

2011-10-27 19:35:09 ----A---- C:\windows\system32\iscsicli.exe

2011-10-27 19:35:09 ----A---- C:\windows\system32\diskpart.exe

2011-10-27 19:35:09 ----A---- C:\windows\system32\CertPolEng.dll

2011-10-27 19:35:09 ----A---- C:\windows\system32\amstream.dll

2011-10-27 19:35:08 ----A---- C:\windows\system32\wuapp.exe

2011-10-27 19:35:08 ----A---- C:\windows\system32\wmpps.dll

2011-10-27 19:35:08 ----A---- C:\windows\system32\WerFaultSecure.exe

2011-10-27 19:35:08 ----A---- C:\windows\system32\tlscsp.dll

2011-10-27 19:35:08 ----A---- C:\windows\system32\secur32.dll

2011-10-27 19:35:08 ----A---- C:\windows\system32\RMActivate_ssp_isv.exe

2011-10-27 19:35:08 ----A---- C:\windows\system32\RMActivate_ssp.exe

2011-10-27 19:35:08 ----A---- C:\windows\system32\ReAgentc.exe

2011-10-27 19:35:08 ----A---- C:\windows\system32\FXSTIFF.dll

2011-10-27 19:35:08 ----A---- C:\windows\system32\findstr.exe

2011-10-27 19:35:08 ----A---- C:\windows\system32\eappgnui.dll

2011-10-27 19:35:07 ----A---- C:\windows\system32\wiarpc.dll

2011-10-27 19:35:07 ----A---- C:\windows\system32\sppc.dll

2011-10-27 19:35:07 ----A---- C:\windows\system32\netutils.dll

2011-10-27 19:35:07 ----A---- C:\windows\system32\netapi32.dll

2011-10-27 19:35:07 ----A---- C:\windows\system32\muifontsetup.dll

2011-10-27 19:35:07 ----A---- C:\windows\system32\mobsync.exe

2011-10-27 19:35:07 ----A---- C:\windows\system32\mciqtz32.dll

2011-10-27 19:35:07 ----A---- C:\windows\system32\iccvid.dll

2011-10-27 19:35:07 ----A---- C:\windows\system32\cabinet.dll

2011-10-27 19:35:06 ----A---- C:\windows\system32\wdiasqmmodule.dll

2011-10-27 19:35:06 ----A---- C:\windows\system32\unlodctr.exe

2011-10-27 19:35:06 ----A---- C:\windows\system32\spopk.dll

2011-10-27 19:35:06 ----A---- C:\windows\system32\shimgvw.dll

2011-10-27 19:35:06 ----A---- C:\windows\system32\repair-bde.exe

2011-10-27 19:35:06 ----A---- C:\windows\system32\rdprefdrvapi.dll

2011-10-27 19:35:06 ----A---- C:\windows\system32\netcfg.exe

2011-10-27 19:35:06 ----A---- C:\windows\system32\msdmo.dll

2011-10-27 19:35:06 ----A---- C:\windows\system32\manage-bde.exe

2011-10-27 19:35:06 ----A---- C:\windows\system32\luainstall.dll

2011-10-27 19:35:06 ----A---- C:\windows\system32\inetmib1.dll

2011-10-27 19:35:06 ----A---- C:\windows\system32\HotStartUserAgent.dll

2011-10-27 19:35:06 ----A---- C:\windows\system32\drivers\usbrpm.sys

2011-10-27 19:35:06 ----A---- C:\windows\system32\drivers\tdi.sys

2011-10-27 19:35:06 ----A---- C:\windows\system32\drivers\CompositeBus.sys

2011-10-27 19:35:06 ----A---- C:\windows\system32\dosx.exe

2011-10-27 19:35:05 ----A---- C:\windows\system32\wups.dll

2011-10-27 19:35:05 ----A---- C:\windows\system32\WUDFCoinstaller.dll

2011-10-27 19:35:05 ----A---- C:\windows\system32\UIRibbonRes.dll

2011-10-27 19:35:05 ----A---- C:\windows\system32\profprov.dll

2011-10-27 19:35:05 ----A---- C:\windows\system32\perfts.dll

2011-10-27 19:35:05 ----A---- C:\windows\system32\odbcconf.dll

2011-10-27 19:35:05 ----A---- C:\windows\system32\drivers\cdrom.sys

2011-10-27 19:35:05 ----A---- C:\windows\system32\browcli.dll

2011-10-27 19:35:04 ----A---- C:\windows\system32\wshbth.dll

2011-10-27 19:35:04 ----A---- C:\windows\system32\TRAPI.dll

2011-10-27 19:35:04 ----A---- C:\windows\system32\schedcli.dll

2011-10-27 19:35:04 ----A---- C:\windows\system32\RDPENCDD.dll

2011-10-27 19:35:04 ----A---- C:\windows\system32\napdsnap.dll

2011-10-27 19:35:04 ----A---- C:\windows\system32\msfeedssync.exe

2011-10-27 19:35:04 ----A---- C:\windows\system32\icaapi.dll

2011-10-27 19:35:04 ----A---- C:\windows\system32\FXSMON.dll

2011-10-27 19:35:04 ----A---- C:\windows\system32\elsTrans.dll

2011-10-27 19:35:04 ----A---- C:\windows\system32\drivers\tunnel.sys

2011-10-27 19:35:04 ----A---- C:\windows\system32\drivers\dfsc.sys

2011-10-27 19:35:04 ----A---- C:\windows\system32\bitsperf.dll

2011-10-27 19:35:03 ----A---- C:\windows\system32\wsdchngr.dll

2011-10-27 19:35:03 ----A---- C:\windows\system32\sscore.dll

2011-10-27 19:35:03 ----A---- C:\windows\system32\LogonUI.exe

2011-10-27 19:35:03 ----A---- C:\windows\system32\dsauth.dll

2011-10-27 19:35:03 ----A---- C:\windows\system32\drivers\acpipmi.sys

2011-10-27 19:35:03 ----A---- C:\windows\system32\cscdll.dll

2011-10-27 19:35:02 ----A---- C:\windows\system32\wups2.dll

2011-10-27 19:35:02 ----A---- C:\windows\system32\shgina.dll

2011-10-27 19:35:02 ----A---- C:\windows\system32\riched32.dll

2011-10-27 19:35:02 ----A---- C:\windows\system32\rdpcfgex.dll

2011-10-27 19:35:02 ----A---- C:\windows\system32\drivers\WUDFRd.sys

2011-10-27 19:35:02 ----A---- C:\windows\system32\drivers\ndiswan.sys

2011-10-27 19:35:02 ----A---- C:\windows\system32\drivers\hidusb.sys

2011-10-27 19:35:02 ----A---- C:\windows\system32\drivers\appid.sys

2011-10-27 19:35:01 ----A---- C:\windows\system32\wshirda.dll

2011-10-27 19:35:01 ----A---- C:\windows\system32\drivers\IPMIDrv.sys

2011-10-27 19:35:00 ----A---- C:\windows\system32\spwmp.dll

2011-10-27 19:35:00 ----A---- C:\windows\system32\RDPREFDD.dll

2011-10-27 19:35:00 ----A---- C:\windows\system32\dxmasf.dll

2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\WUDFPf.sys

2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\wanarp.sys

2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\USBCAMD2.sys

2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\USBCAMD.sys

2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\umbus.sys

2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\tdtcp.sys

2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\tdpipe.sys

2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\sffp_sd.sys

2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\scfilter.sys

2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\RDPCDD.sys

2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\kbdhid.sys

2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\HdAudio.sys

2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\hdaudbus.sys

2011-10-27 19:35:00 ----A---- C:\windows\system32\C_ISCII.DLL

2011-10-27 19:35:00 ----A---- C:\windows\system32\browseui.dll

2011-10-27 19:34:59 ----A---- C:\windows\system32\wmploc.DLL

2011-10-27 19:34:59 ----A---- C:\windows\system32\shunimpl.dll

2011-10-27 19:34:58 ----A---- C:\windows\system32\pifmgr.dll

2011-10-27 19:34:58 ----A---- C:\windows\system32\nlsbres.dll

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDUS.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDUGHR1.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDTURME.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDTUQ.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDTUF.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDTAJIK.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDSG.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDSF.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDPO.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDNEPR.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDMON.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDMAORI.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDLT1.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\kbdlk41a.dll

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDINTEL.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDINTAM.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDINORI.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDINMAR.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDINKAN.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDINHIN.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDINBEN.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDGR1.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDGKL.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDGEO.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDCZ1.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDBULG.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDBLR.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDBASH.DLL

2011-10-27 19:34:58 ----A---- C:\windows\system32\dpnaddr.dll

2011-10-27 19:34:58 ----A---- C:\windows\system32\BlbEvents.dll

2011-10-27 19:34:57 ----A---- C:\windows\system32\spwizres.dll

2011-10-27 19:34:46 ----A---- C:\windows\system32\wdscore.dll

2011-10-27 19:34:38 ----A---- C:\windows\system32\wbemcomn.dll

2011-10-27 19:34:28 ----A---- C:\windows\system32\sqmapi.dll

2011-10-27 19:11:02 ----A---- C:\windows\system32\drivers\usbport.sys

2011-10-27 19:11:01 ----A---- C:\windows\system32\drivers\usbuhci.sys

2011-10-27 19:11:01 ----A---- C:\windows\system32\drivers\usbhub.sys

2011-10-27 19:11:01 ----A---- C:\windows\system32\drivers\usbehci.sys

2011-10-27 19:11:01 ----A---- C:\windows\system32\drivers\usbccgp.sys

2011-10-27 19:11:00 ----A---- C:\windows\system32\drivers\usbohci.sys

2011-10-27 19:11:00 ----A---- C:\windows\system32\drivers\usbd.sys

2011-10-27 19:10:56 ----A---- C:\windows\system32\esent.dll

2011-10-27 19:10:56 ----A---- C:\windows\system32\drivers\nvstor.sys

2011-10-27 19:10:56 ----A---- C:\windows\system32\drivers\ntfs.sys

2011-10-27 19:10:55 ----A---- C:\windows\system32\fsutil.exe

2011-10-27 19:10:55 ----A---- C:\windows\system32\drivers\USBSTOR.SYS

2011-10-27 19:10:55 ----A---- C:\windows\system32\drivers\storport.sys

2011-10-27 19:10:55 ----A---- C:\windows\system32\drivers\nvraid.sys

2011-10-27 19:10:55 ----A---- C:\windows\system32\drivers\iaStorV.sys

2011-10-27 19:10:55 ----A---- C:\windows\system32\drivers\amdxata.sys

2011-10-27 19:10:55 ----A---- C:\windows\system32\drivers\amdsata.sys

2011-10-26 16:22:54 ----D---- C:\Program Files\Common Files\DESIGNER

2011-10-26 16:20:48 ----D---- C:\Program Files\Microsoft Analysis Services

2011-10-26 16:19:07 ----D---- C:\ProgramData\Microsoft Help

2011-10-26 16:18:40 ----RHD---- C:\MSOCache

2011-10-26 14:19:07 ----D---- C:\Program Files\MSXML 4.0

2011-10-26 14:15:53 ----A---- C:\windows\system32\prevhost.exe

2011-10-26 14:15:38 ----A---- C:\windows\system32\ieframe.dll

2011-10-26 14:15:37 ----A---- C:\windows\system32\mshtml.dll

2011-10-26 14:15:35 ----A---- C:\windows\system32\wininet.dll

2011-10-26 14:15:35 ----A---- C:\windows\system32\iertutil.dll

2011-10-26 14:15:34 ----A---- C:\windows\system32\urlmon.dll

2011-10-26 14:15:34 ----A---- C:\windows\system32\mshtmled.dll

2011-10-26 14:15:34 ----A---- C:\windows\system32\msfeeds.dll

2011-10-26 14:15:34 ----A---- C:\windows\system32\ieui.dll

2011-10-26 14:15:33 ----A---- C:\windows\system32\url.dll

2011-10-26 14:15:33 ----A---- C:\windows\system32\jsproxy.dll

2011-10-26 14:15:25 ----A---- C:\windows\system32\xmllite.dll

2011-10-26 14:15:16 ----A---- C:\windows\system32\win32k.sys

2011-10-26 14:15:12 ----A---- C:\windows\system32\tquery.dll

2011-10-26 14:15:12 ----A---- C:\windows\system32\SearchProtocolHost.exe

2011-10-26 14:15:12 ----A---- C:\windows\system32\SearchIndexer.exe

2011-10-26 14:15:12 ----A---- C:\windows\system32\mssvp.dll

2011-10-26 14:15:12 ----A---- C:\windows\system32\mssrch.dll

2011-10-26 14:15:12 ----A---- C:\windows\system32\mssph.dll

2011-10-26 14:15:11 ----A---- C:\windows\system32\SearchFilterHost.exe

2011-10-26 14:15:11 ----A---- C:\windows\system32\mssphtb.dll

2011-10-26 14:15:11 ----A---- C:\windows\system32\msscntrs.dll

2011-10-26 14:15:07 ----A---- C:\windows\system32\drivers\srvnet.sys

2011-10-26 14:15:07 ----A---- C:\windows\system32\drivers\srv2.sys

2011-10-26 14:15:07 ----A---- C:\windows\system32\drivers\srv.sys

2011-10-26 14:15:05 ----A---- C:\windows\system32\drivers\tcpip.sys

2011-10-26 14:15:05 ----A---- C:\windows\system32\drivers\FWPKCLNT.SYS

2011-10-26 14:15:03 ----A---- C:\windows\system32\drivers\mrxsmb20.sys

2011-10-26 14:15:03 ----A---- C:\windows\system32\drivers\mrxsmb10.sys

2011-10-26 14:15:03 ----A---- C:\windows\system32\drivers\mrxsmb.sys

2011-10-26 14:15:02 ----AH---- C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2011-10-26 14:15:02 ----AH---- C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2011-10-26 14:15:02 ----A---- C:\windows\system32\winsrv.dll

2011-10-26 14:15:02 ----A---- C:\windows\system32\KernelBase.dll

2011-10-26 14:15:02 ----A---- C:\windows\system32\kernel32.dll

2011-10-26 14:15:02 ----A---- C:\windows\system32\conhost.exe

2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-util-l1-1-0.dll

2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll

2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll

2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll

2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-file-l1-1-0.dll

2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-security-base-l1-1-0.dll

2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-string-l1-1-0.dll

2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll

2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll

2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-io-l1-1-0.dll

2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll

2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll

2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll

2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-console-l1-1-0.dll

2011-10-26 14:14:59 ----A---- C:\windows\system32\drivers\afd.sys

2011-10-26 14:14:58 ----A---- C:\windows\system32\psisdecd.dll

2011-10-26 14:14:57 ----A---- C:\windows\system32\kerberos.dll

2011-10-26 14:14:56 ----A---- C:\windows\system32\WFS.exe

2011-10-26 14:14:56 ----A---- C:\windows\system32\FXSCOVER.exe

2011-10-26 14:14:55 ----A---- C:\windows\system32\vbscript.dll

2011-10-26 14:14:55 ----A---- C:\windows\system32\jscript.dll

2011-10-26 14:14:54 ----A---- C:\windows\system32\inetcomm.dll

2011-10-26 14:14:51 ----A---- C:\windows\system32\tzres.dll

2011-10-26 14:14:45 ----A---- C:\windows\system32\oleaut32.dll

2011-10-26 14:14:45 ----A---- C:\windows\system32\oleacc.dll

2011-10-26 14:14:38 ----A---- C:\windows\system32\CPFilters.dll

2011-10-26 14:14:37 ----A---- C:\windows\system32\sbe.dll

2011-10-26 14:14:37 ----A---- C:\windows\system32\EncDec.dll

2011-10-26 14:14:35 ----A---- C:\windows\system32\ntoskrnl.exe

2011-10-26 14:14:34 ----A---- C:\windows\system32\ntkrnlpa.exe

2011-10-26 14:14:25 ----A---- C:\windows\system32\odbctrac.dll

2011-10-26 14:14:25 ----A---- C:\windows\system32\odbcjt32.dll

2011-10-26 14:14:25 ----A---- C:\windows\system32\odbccu32.dll

2011-10-26 14:14:25 ----A---- C:\windows\system32\odbccr32.dll

2011-10-26 14:14:25 ----A---- C:\windows\system32\odbccp32.dll

2011-10-26 14:14:24 ----A---- C:\windows\system32\atmfd.dll

2011-10-26 14:14:23 ----A---- C:\windows\system32\fontsub.dll

2011-10-26 14:14:23 ----A---- C:\windows\system32\dnsrslvr.dll

2011-10-26 14:14:23 ----A---- C:\windows\system32\dnscacheugc.exe

2011-10-26 14:14:23 ----A---- C:\windows\system32\dnsapi.dll

2011-10-26 14:14:23 ----A---- C:\windows\system32\atmlib.dll

2011-10-26 14:14:22 ----A---- C:\windows\system32\XpsGdiConverter.dll

2011-10-26 14:14:20 ----A---- C:\windows\system32\umpnpmgr.dll

2011-10-26 14:14:20 ----A---- C:\windows\system32\cfgmgr32.dll

2011-10-26 14:14:12 ----A---- C:\windows\system32\drivers\bowser.sys

2011-10-26 14:13:53 ----A---- C:\windows\system32\XpsPrint.dll

2011-10-26 14:13:49 ----A---- C:\windows\system32\poqexec.exe

2011-10-26 14:13:49 ----A---- C:\windows\system32\mfc42.dll

2011-10-26 14:13:48 ----A---- C:\windows\system32\mfc42u.dll

2011-10-26 14:13:47 ----A---- C:\windows\explorer.exe

2011-10-26 14:13:45 ----A---- C:\windows\system32\d3d10_1core.dll

2011-10-26 14:13:45 ----A---- C:\windows\system32\d3d10_1.dll

2011-10-26 14:10:55 ----A---- C:\windows\system32\drivers\Diskdump.sys

2011-10-26 14:09:18 ----A---- C:\windows\system32\drivers\dxgmms1.sys

2011-10-26 14:09:18 ----A---- C:\windows\system32\drivers\dxgkrnl.sys

2011-10-26 14:09:18 ----A---- C:\windows\system32\cdd.dll

2011-10-26 13:07:59 ----D---- C:\Users\Franziska\AppData\Roaming\Avira

2011-10-26 13:07:33 ----A---- C:\windows\system32\drivers\ssmdrv.sys

2011-10-26 13:07:32 ----D---- C:\ProgramData\Avira

2011-10-26 13:07:32 ----D---- C:\Program Files\Avira

2011-10-26 13:07:32 ----A---- C:\windows\system32\drivers\avkmgr.sys

2011-10-26 13:07:32 ----A---- C:\windows\system32\drivers\avipbb.sys

2011-10-26 13:07:32 ----A---- C:\windows\system32\drivers\avgntflt.sys

2011-10-26 12:24:29 ----A---- C:\windows\BRWMARK.INI

2011-10-26 12:22:59 ----A---- C:\windows\system32\bd7030.dat

2011-10-26 12:22:24 ----N---- C:\windows\system32\BrDctF2S.dll

2011-10-26 12:22:24 ----N---- C:\windows\system32\BrDctF2L.dll

2011-10-26 12:22:24 ----N---- C:\windows\system32\BrDctF2.dll

2011-10-26 12:22:23 ----A---- C:\windows\system32\BrWia09b.dll

2011-10-26 12:22:23 ----A---- C:\windows\system32\BrUsi09a.dll

2011-10-26 12:22:22 ----A---- C:\windows\system32\BRTCPCON.DLL

2011-10-26 12:22:22 ----A---- C:\windows\system32\BRRBTOOL.EXE

2011-10-26 12:22:22 ----A---- C:\windows\system32\BRLMW03A.DLL

2011-10-26 12:22:21 ----N---- C:\windows\system32\NSSearch.dll

2011-10-26 12:22:21 ----D---- C:\Program Files\Brother

2011-10-26 12:22:21 ----A---- C:\windows\system32\BROSNMP.DLL

2011-10-26 12:22:19 ----A---- C:\windows\system32\BRLM03A.DLL

2011-10-26 12:22:18 ----A---- C:\windows\system32\BRLMW03A.INI

2011-10-26 12:21:55 ----D---- C:\Users\Franziska\AppData\Roaming\InstallShield

2011-10-26 12:21:10 ----D---- C:\Program Files\Nuance

2011-10-26 12:20:43 ----A---- C:\windows\maxlink.ini

2011-10-26 12:20:41 ----D---- C:\ProgramData\InstallShield

2011-10-26 12:20:15 ----D---- C:\Program Files\Common Files\ScanSoft Shared

2011-10-26 12:20:10 ----D---- C:\ProgramData\ScanSoft

2011-10-26 12:20:10 ----D---- C:\Program Files\ScanSoft

2011-10-26 12:19:39 ----D---- C:\Program Files\Microsoft Security Client

2011-10-26 12:19:31 ----D---- C:\ProgramData\Brother

2011-10-26 12:06:09 ----D---- C:\Users\Franziska\AppData\Roaming\Thunderbird

2011-10-26 12:05:14 ----D---- C:\Program Files\CCleaner

2011-10-26 11:32:19 ----D---- C:\Users\Franziska\AppData\Roaming\Identities

2011-10-26 11:32:11 ----SD---- C:\Users\Franziska\AppData\Roaming\Microsoft

2011-10-26 11:32:11 ----D---- C:\Users\Franziska\AppData\Roaming\Media Center Programs

2011-10-26 11:32:01 ----SHD---- C:\Programme

2011-10-26 11:32:01 ----SHD---- C:\ProgramData\Vorlagen

2011-10-26 11:32:01 ----SHD---- C:\ProgramData\Startmenü

2011-10-26 11:32:01 ----SHD---- C:\ProgramData\Favoriten

2011-10-26 11:32:01 ----SHD---- C:\ProgramData\Dokumente

2011-10-26 11:32:01 ----SHD---- C:\ProgramData\Anwendungsdaten

2011-10-26 11:32:01 ----SHD---- C:\Program Files\Gemeinsame Dateien

2011-10-26 11:32:01 ----SHD---- C:\Dokumente und Einstellungen

2011-10-26 10:43:21 ----D---- C:\Users\Franziska\AppData\Roaming\Mozilla

2011-10-26 10:43:14 ----D---- C:\Program Files\Mozilla Firefox

2011-10-26 10:41:48 ----D---- C:\Program Files\Mozilla Thunderbird

2011-10-26 10:26:29 ----ASH---- C:\pagefile.sys

2011-10-26 10:26:28 ----SHD---- C:\System Volume Information

2011-10-26 10:26:28 ----ASH---- C:\hiberfil.sys
 

======List of files/folders modified in the last 1 month======
 

2011-11-02 13:12:24 ----D---- C:\windows\Temp

2011-11-02 13:12:06 ----RD---- C:\Program Files

2011-11-02 12:48:45 ----D---- C:\windows\system32\config

2011-11-02 12:48:18 ----D---- C:\windows\System32

2011-11-02 12:48:18 ----D---- C:\windows\inf

2011-11-02 12:48:18 ----A---- C:\windows\system32\PerfStringBackup.INI

2011-11-02 12:48:05 ----D---- C:\windows\system32\drivers

2011-11-02 12:45:11 ----D---- C:\Windows

2011-11-02 11:28:42 ----D---- C:\windows\Prefetch

2011-11-02 10:29:51 ----SHD---- C:\windows\Installer

2011-11-02 10:16:21 ----D---- C:\windows\system32\catroot2

2011-11-02 10:15:18 ----RSD---- C:\windows\Media

2011-11-02 09:36:48 ----D---- C:\windows\Microsoft.NET

2011-11-02 09:36:21 ----RSD---- C:\windows\assembly

2011-11-02 09:04:24 ----HD---- C:\ProgramData

2011-11-01 19:11:00 ----D---- C:\windows\winsxs

2011-11-01 14:15:50 ----D---- C:\Program Files\Common Files

2011-11-01 14:00:56 ----D---- C:\windows\system32\catroot

2011-10-31 11:42:33 ----D---- C:\windows\Panther

2011-10-31 11:42:32 ----D---- C:\windows\Logs

2011-10-31 07:18:45 ----D---- C:\windows\system32\DriverStore

2011-10-31 07:15:00 ----D---- C:\Program Files\Windows Sidebar

2011-10-31 07:15:00 ----D---- C:\Program Files\Windows Mail

2011-10-31 07:15:00 ----D---- C:\Program Files\DVD Maker

2011-10-31 07:14:59 ----D---- C:\Program Files\Windows Portable Devices

2011-10-31 07:14:59 ----D---- C:\Program Files\Internet Explorer

2011-10-31 07:14:58 ----D---- C:\Program Files\Windows Photo Viewer

2011-10-31 07:14:58 ----D---- C:\Program Files\Windows Media Player

2011-10-31 07:14:58 ----D---- C:\Program Files\Windows Journal

2011-10-31 07:14:53 ----D---- C:\Program Files\Windows Defender

2011-10-31 07:14:52 ----D---- C:\windows\servicing

2011-10-31 07:14:52 ----D---- C:\windows\ehome

2011-10-31 07:14:52 ----D---- C:\windows\de-DE

2011-10-31 07:14:38 ----D---- C:\windows\system32\da-DK

2011-10-31 07:14:38 ----D---- C:\windows\PolicyDefinitions

2011-10-31 07:14:37 ----D---- C:\windows\system32\de-DE

2011-10-31 07:14:34 ----D---- C:\windows\system32\oobe

2011-10-31 07:14:33 ----D---- C:\windows\system32\sysprep

2011-10-31 07:14:33 ----D---- C:\windows\system32\migration

2011-10-31 07:14:32 ----D---- C:\windows\system32\sppui

2011-10-31 07:14:32 ----D---- C:\windows\system32\Setup

2011-10-31 07:14:32 ----D---- C:\windows\system32\manifeststore

2011-10-31 07:14:32 ----D---- C:\windows\system32\es-ES

2011-10-31 07:14:32 ----D---- C:\windows\system32\cs-CZ

2011-10-31 07:14:32 ----D---- C:\windows\system32\AdvancedInstallers

2011-10-31 07:14:31 ----D---- C:\windows\system32\drivers\de-DE

2011-10-31 07:14:30 ----D---- C:\windows\system32\wbem

2011-10-31 07:14:29 ----D---- C:\windows\system32\migwiz

2011-10-31 07:14:29 ----D---- C:\windows\system32\Dism

2011-10-31 07:13:48 ----RSD---- C:\windows\Fonts

2011-10-31 07:13:46 ----D---- C:\windows\AppPatch

2011-10-31 07:13:37 ----D---- C:\windows\system32\Boot

2011-10-31 07:07:07 ----A---- C:\windows\system32\msclmd.dll

2011-10-30 23:26:30 ----D---- C:\windows\system32\wdi

2011-10-26 18:36:58 ----D---- C:\windows\debug

2011-10-26 16:37:43 ----SD---- C:\ProgramData\Microsoft

2011-10-26 16:37:43 ----D---- C:\Program Files\Microsoft Office

2011-10-26 16:23:47 ----D---- C:\windows\system32\Tasks

2011-10-26 16:23:12 ----D---- C:\Program Files\Common Files\microsoft shared

2011-10-26 16:22:45 ----D---- C:\Program Files\Microsoft.NET

2011-10-26 16:20:49 ----D---- C:\windows\ShellNew

2011-10-26 14:36:13 ----D---- C:\Program Files\Microsoft Silverlight

2011-10-26 13:02:48 ----D---- C:\windows\system32\LogFiles

2011-10-26 12:24:24 ----D---- C:\windows\twain_32

2011-10-26 12:22:13 ----HD---- C:\Program Files\InstallShield Installation Information

2011-10-26 12:20:15 ----D---- C:\windows\SoftwareDistribution

2011-10-26 12:20:15 ----D---- C:\windows\Downloaded Program Files

2011-10-26 12:20:15 ----D---- C:\Program Files\Common Files\InstallShield

2011-10-26 12:19:40 ----D---- C:\Program Files\Microsoft Security Essentials

2011-10-26 11:54:54 ----D---- C:\windows\system32\restore

2011-10-26 11:32:17 ----SHD---- C:\$Recycle.Bin

2011-10-26 11:32:09 ----RD---- C:\Users

2011-10-26 11:32:01 ----D---- C:\Program Files\Windows NT

2011-10-26 11:29:45 ----D---- C:\windows\rescache

2011-10-05 10:09:48 ----A---- C:\windows\system32\MRT.exe
 

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R0 rdyboost;ReadyBoost; C:\windows\System32\drivers\rdyboost.sys [2010-11-20 173440]

R1 avipbb;avipbb; C:\windows\system32\DRIVERS\avipbb.sys [2011-10-11 134344]

R1 avkmgr;avkmgr; C:\windows\system32\DRIVERS\avkmgr.sys [2011-10-11 36000]

R1 MpFilter;Microsoft Malware Protection Driver; C:\windows\system32\DRIVERS\MpFilter.sys [2010-03-25 151216]

R1 ssmdrv;ssmdrv; C:\windows\system32\DRIVERS\ssmdrv.sys [2010-06-17 28520]

R2 avgntflt;avgntflt; C:\windows\system32\DRIVERS\avgntflt.sys [2011-10-11 74640]

R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd32.sys [2010-07-28 9023488]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHDA.sys [2010-07-06 3132712]

R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI; C:\windows\system32\drivers\IntcHdmi.sys [2010-03-15 127488]

R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\windows\system32\DRIVERS\L1E62x86.sys [2010-03-29 55848]

R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]

S2 Parvdm;Parvdm; C:\windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]

S3 aic78xx;aic78xx; C:\windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]

S3 amdagp;AMD AGP-Bus-Filtertreiber; C:\windows\system32\drivers\amdagp.sys [2009-07-14 53312]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]

S3 fssfltr;FssFltr; C:\windows\system32\DRIVERS\fssfltr.sys [2009-08-05 54632]

S3 pciide;pciide; C:\windows\system32\drivers\pciide.sys [2009-07-14 12368]

S3 sisagp;SIS AGP-Bus-Filter; C:\windows\system32\drivers\sisagp.sys [2009-07-14 52304]

S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]

S3 usbscan;USB-Scannertreiber; C:\windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]

S3 viaagp;VIA AGP-Bus-Filter; C:\windows\system32\drivers\viaagp.sys [2009-07-14 53328]

S3 ViaC7;VIA C7-Prozessortreiber; C:\windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
 

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]

R2 AntiVirMailService;Avira Email Schutz; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [2011-10-26 342480]

R2 AntiVirSchedulerService;Avira Planer; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2011-10-26 86224]

R2 AntiVirService;Avira Echtzeit Scanner; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2011-10-26 110032]

R2 AntiVirWebService;Avira Browser Schutz; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2011-10-26 463824]

R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2010-07-27 249136]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

S2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2010-03-25 17904]

S3 fsssvc;Windows Live Family Safety-Dienst; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864]

S3 ose;Office  Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]

S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]

S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\windows\system32\Wat\WatAdminSvc.exe [2010-10-15 1343400]
 

-----------------EOF-----------------

--- --- ---

info.txtRSIT Logfile:

Code:

logfile of random's system information tool 1.09 2011-11-02 13:12:27
 

======Uninstall list======
 

Adobe Flash Player 11 Plugin-->C:\windows\system32\Macromed\Flash\FlashUtil11c_Plugin.exe -maintain plugin

Adobe Reader X (10.1.1) - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-AA1000000001}

Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver-->"C:\Program Files\InstallShield Installation Information\{3108C217-BE83-42E4-AE9E-A56A2A92E549}\setup.exe" -runfromtemp -l0x0007 -removeonly

Avira Antivirus Premium 2012-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE

Brother MFL-Pro Suite DCP-7030-->"C:\Program Files\InstallShield Installation Information\{46E1B1F2-A279-4356-9B17-029F9CC72EAE}\Setup.exe"  -runfromtemp -l0x0007 UNINSTALL Reg=ALL2FB -removeonly

CCleaner-->"C:\Program Files\CCleaner\uninst.exe"

Definition update for Microsoft Office 2010 (KB982726) 32-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{28857979-5507-4C10-A922-FF709A19D38C}" "1031" "0"

Intel(R) Graphics Media Accelerator Driver-->C:\Program Files\Intel\Intel(R) Graphics Media Accelerator Driver\Uninstall\setup.exe -uninstall

Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}

Malwarebytes' Anti-Malware Version 1.51.2.1300-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"

Microsoft .NET Framework 4 Client Profile DEU Language Pack-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\ClientLP\Setup.exe /repair /x86 /lcid 1031 /parameterfolder ClientLP

Microsoft .NET Framework 4 Client Profile DEU Language Pack-->MsiExec.exe /X{F750C986-5310-3A5A-95F8-4EC71C8AC01C}

Microsoft .NET Framework 4 Client Profile-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe /repair /x86 /parameterfolder Client

Microsoft .NET Framework 4 Client Profile-->MsiExec.exe /X{3C3901C5-3455-3E0A-A214-0B093A5070A6}

Microsoft Antimalware Service DE-DE Language Pack-->MsiExec.exe /X{84ED5482-CFB0-4DD9-BF18-489FFDACD18A}

Microsoft Antimalware-->MsiExec.exe /X{E62A1F01-07B7-4541-A835-EE5B0BF064C2}

Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}

Microsoft Office Access MUI (German) 2010-->MsiExec.exe /X{90140000-0015-0407-0000-0000000FF1CE}

Microsoft Office Excel MUI (German) 2010-->MsiExec.exe /X{90140000-0016-0407-0000-0000000FF1CE}

Microsoft Office Home and Student 2010-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe" /uninstall SINGLEIMAGE /dll OSETUP.DLL

Microsoft Office OneNote MUI (German) 2010-->MsiExec.exe /X{90140000-00A1-0407-0000-0000000FF1CE}

Microsoft Office Outlook MUI (German) 2010-->MsiExec.exe /X{90140000-001A-0407-0000-0000000FF1CE}

Microsoft Office PowerPoint MUI (German) 2010-->MsiExec.exe /X{90140000-0018-0407-0000-0000000FF1CE}

Microsoft Office Proof (English) 2010-->MsiExec.exe /X{90140000-001F-0409-0000-0000000FF1CE}

Microsoft Office Proof (French) 2010-->MsiExec.exe /X{90140000-001F-040C-0000-0000000FF1CE}

Microsoft Office Proof (German) 2010-->MsiExec.exe /X{90140000-001F-0407-0000-0000000FF1CE}

Microsoft Office Proof (Italian) 2010-->MsiExec.exe /X{90140000-001F-0410-0000-0000000FF1CE}

Microsoft Office Proofing (German) 2010-->MsiExec.exe /X{90140000-002C-0407-0000-0000000FF1CE}

Microsoft Office Publisher MUI (German) 2010-->MsiExec.exe /X{90140000-0019-0407-0000-0000000FF1CE}

Microsoft Office Shared MUI (German) 2010-->MsiExec.exe /X{90140000-006E-0407-0000-0000000FF1CE}

Microsoft Office Single Image 2010-->MsiExec.exe /X{90140000-003D-0000-0000-0000000FF1CE}

Microsoft Office Word MUI (German) 2010-->MsiExec.exe /X{90140000-001B-0407-0000-0000000FF1CE}

Microsoft Search Enhancement Pack-->MsiExec.exe /X{928B06E4-DDAA-476A-926A-641620326327}

Microsoft Security Client DE-DE Language Pack-->MsiExec.exe /I{859B9BCA-5376-4566-9F88-C6C9DAA7A925}

Microsoft Security Client-->MsiExec.exe /I{77A776C4-D10F-416D-88F0-53F2D9DCD9B3}

Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}

Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}

Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}

Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219-->MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}

Mozilla Firefox 7.0.1 (x86 de)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe

Mozilla Thunderbird (7.0.1)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe

MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}

MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}

PaperPort Image Printer-->MsiExec.exe /X{2BC2781A-F7F6-452E-95EB-018A522F1B2C}

Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe"  -removeonly

ScanSoft PaperPort 11-->MsiExec.exe /I{02570AE0-BEE0-4A6C-BE3F-D806E9F2EA17}

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)-->c:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {728D9A6A-2206-31E8-9F65-C3EABEFCF53E} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)-->c:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {2CE2EB39-45C8-32D4-8A99-5529C38F1B99} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)-->c:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {7E97AB83-C1FE-38DE-B848-877E0A4BD81E} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)-->c:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {DB31DEDD-BF95-31E7-A9B7-5480561CEFF3} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)-->c:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\ClientLP\setup.exe /uninstallpatch {728D9A6A-2206-31E8-9F65-C3EABEFCF53E} /parameterfolder ClientLP

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)-->c:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\ClientLP\setup.exe /uninstallpatch {2CE2EB39-45C8-32D4-8A99-5529C38F1B99} /parameterfolder ClientLP

Security Update for Microsoft Excel 2010 (KB2553070)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{294BAA9E-9209-497F-A71F-7E52EFB194D4}" "1031" "0"

Security Update for Microsoft Office 2010 (KB2289078)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{1D1A4F08-2F17-475B-BA72-476CE5992FEE}" "1031" "0"

Security Update for Microsoft Office 2010 (KB2553091)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{07CA44F3-F5B3-4D12-8C91-EDC5FE91D45C}" "1031" "0"

Security Update for Microsoft Office 2010 (KB2553096)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{10802A6D-EDBF-4383-BCBD-9D5B32F56D35}" "1031" "0"

Security Update for Microsoft Office 2010 (KB2584066)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{EEB4DDD0-08EA-4787-BDAB-D38D67A35CD5}" "1031" "0"

Security Update for Microsoft PowerPoint 2010 (KB2519975)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{45D7C5CD-B967-44AF-9DAB-E5C8545558AD}" "1031" "0"

Security Update for Microsoft Publisher 2010 (KB2409055)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{C3C277D5-36E3-4B1A-926A-175B2BC019CF}" "1031" "0"

Security Update for Microsoft Word 2010 (KB2345000)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{A6D422EE-1196-45EE-B9AE-6B5B64975E8B}" "1031" "0"

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)-->c:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {5E9CF3A4-ADB3-3080-A8BF-976A28340758} /parameterfolder Client

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)-->c:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {81EBB9D7-173C-32E3-B477-149C8DE075E4} /parameterfolder Client

Update for Microsoft Office 2010 (KB2202188)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{86B7A074-265D-420C-9E1E-7A920EF0ECA7}" "1031" "0"

Update for Microsoft Office 2010 (KB2494150)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}" "1031" "0"

Update for Microsoft Office 2010 (KB2523113)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{C0FF04BF-A05E-408B-81CA-B7FACDA508A3}" "1031" "0"

Update for Microsoft Office 2010 (KB2553065)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{A8686D24-1E89-43A1-973E-05A258D2B3F8}" "1031" "0"

Update for Microsoft Office 2010 (KB2566458)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{EFB525A0-E1C0-4E32-9968-FE401BC87363}" "1031" "0"

Update for Microsoft OneNote 2010 (KB2493983)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{309EEC22-83CE-4109-B019-BA9392FAA322}" "1031" "0"

Update for Microsoft Outlook Social Connector (KB2583935)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001A-0407-0000-0000000FF1CE}" "{EDED840F-DD92-47ED-A2E4-63F6AC745B92}" "1031" "0"

Update for Microsoft Outlook Social Connector (KB2583935)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{EDF9874C-9E37-4110-9FC3-094247E114DF}" "1031" "0"

Windows Live Anmelde-Assistent-->MsiExec.exe /I{52B97218-98CB-4B8B-9283-D213C85E1AA4}

Windows Live Call-->MsiExec.exe /I{5FC68772-6D56-41C6-9DF1-24E868198AE6}

Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}

Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe

Windows Live Essentials-->MsiExec.exe /I{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}

Windows Live Family Safety-->MsiExec.exe /X{994223F3-A99B-4DDD-9E1D-0190A17C6860}

Windows Live Fotogalerie-->MsiExec.exe /X{2BA722D1-48D1-406E-9123-8AE5431D63EF}

Windows Live Mail-->MsiExec.exe /I{C4D738F7-996A-4C81-B8FA-C4E26D767E41}

Windows Live Messenger-->MsiExec.exe /X{41E654A9-26D0-4EAC-854B-0FA824FFFABB}

Windows Live Movie Maker-->MsiExec.exe /X{3EFEF049-23D4-4B46-8903-4592FEA51018}

Windows Live Sync-->MsiExec.exe /X{76618402-179D-4699-A66B-D351C59436BC}

Windows Live Toolbar-->MsiExec.exe /X{70B7A167-0B88-445D-A3EA-97C73AA88CAC}

Windows Live Writer-->MsiExec.exe /X{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}

Windows Live-Uploadtool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
 

======System event log======
 

Computer Name: WIN-Q5NRK5FKD4T

Event Code: 7036

Message: Dienst "Windows Search" befindet sich jetzt im Status "Beendet".

Record Number: 1958

Source Name: Service Control Manager

Time Written: 20101015105913.372667-000

Event Type: Informationen

User: 
 

Computer Name: WIN-Q5NRK5FKD4T

Event Code: 7040

Message: Der Starttyp des Diensts "Windows Search" wurde von Automatisch starten in Deaktiviert geändert.

Record Number: 1957

Source Name: Service Control Manager

Time Written: 20101015105912.561465-000

Event Type: Informationen

User: 
 

Computer Name: WIN-Q5NRK5FKD4T

Event Code: 104

Message: Die Protokolldatei "Setup" wurde gelöscht.

Record Number: 1956

Source Name: Microsoft-Windows-Eventlog

Time Written: 20101015105900.674244-000

Event Type: Informationen

User: 
 

Computer Name: WIN-Q5NRK5FKD4T

Event Code: 104

Message: Die Protokolldatei "Application" wurde gelöscht.

Record Number: 1955

Source Name: Microsoft-Windows-Eventlog

Time Written: 20101015105900.487044-000

Event Type: Informationen

User: 
 

Computer Name: WIN-Q5NRK5FKD4T

Event Code: 104

Message: Die Protokolldatei "System" wurde gelöscht.

Record Number: 1954

Source Name: Microsoft-Windows-Eventlog

Time Written: 20101015105900.440244-000

Event Type: Informationen

User: 
 

=====Application event log=====
 

Computer Name: WIN-Q5NRK5FKD4T

Event Code: 1

Message: Der Windows-Sicherheitscenterdienst wurde gestartet.

Record Number: 541

Source Name: SecurityCenter

Time Written: 20101015110132.000000-000

Event Type: Informationen

User: 
 

Computer Name: WIN-Q5NRK5FKD4T

Event Code: 900

Message: Der Softwareschutzdienst wird gestartet.
 

Record Number: 540

Source Name: Microsoft-Windows-Security-SPP

Time Written: 20101015110101.000000-000

Event Type: Informationen

User: 
 

Computer Name: WIN-Q5NRK5FKD4T

Event Code: 1003

Message: Windows Search wurde gestartet.
 

Record Number: 539

Source Name: Microsoft-Windows-Search

Time Written: 20101015105913.000000-000

Event Type: Informationen

User: 
 

Computer Name: WIN-Q5NRK5FKD4T

Event Code: 1013

Message: Windows Search wurde normal beendet.
 

Record Number: 538

Source Name: Microsoft-Windows-Search

Time Written: 20101015105913.000000-000

Event Type: Informationen

User: 
 

Computer Name: WIN-Q5NRK5FKD4T

Event Code: 103

Message: Windows (1696) Windows: Das Datenbankmodul hat die Instanz (0) beendet.

Record Number: 537

Source Name: ESENT

Time Written: 20101015105913.000000-000

Event Type: Informationen

User: 
 

=====Security event log=====
 

Computer Name: WIN-Q5NRK5FKD4T

Event Code: 4624

Message: Ein Konto wurde erfolgreich angemeldet.
 

Antragsteller:

        Sicherheits-ID:                S-1-5-18

        Kontoname:                WIN-Q5NRK5FKD4T$

        Kontodomäne:                WORKGROUP

        Anmelde-ID:                0x3e7
 

Anmeldetyp:                        5
 

Neue Anmeldung:

        Sicherheits-ID:                S-1-5-18

        Kontoname:                SYSTEM

        Kontodomäne:                NT-AUTORITÄT

        Anmelde-ID:                0x3e7

        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}
 

Prozessinformationen:

        Prozess-ID:                0x1ec

        Prozessname:                C:\Windows\System32\services.exe
 

Netzwerkinformationen:

        Arbeitsstationsname:        

        Quellnetzwerkadresse:        -

        Quellport:                -
 

Detaillierte Authentifizierungsinformationen:

        Anmeldeprozess:                Advapi  

        Authentifizierungspaket:        Negotiate

        Übertragene Dienste:        -

        Paketname (nur NTLM):        -

        Schlüssellänge:                0
 

Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den zugegriffen wurde.
 

Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe".
 

Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).
 

Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete Konto.
 

Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer verfügbar und kann in manchen Fällen leer bleiben.
 

Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen Anmeldeanforderung.

         - Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem KDC-Ereignis zu korrelieren.

        - Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.

        - Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.

        - Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel angefordert wurde, ist dieser Wert 0.

Record Number: 507

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20101015105916.040271-000

Event Type: Überwachung erfolgreich

User: 
 

Computer Name: WIN-Q5NRK5FKD4T

Event Code: 4672

Message: Einer neuen Anmeldung wurden besondere Rechte zugewiesen.
 

Antragsteller:

        Sicherheits-ID:                S-1-5-18

        Kontoname:                SYSTEM

        Kontodomäne:                NT-AUTORITÄT

        Anmelde-ID:                0x3e7
 

Berechtigungen:                SeAssignPrimaryTokenPrivilege

                        SeTcbPrivilege

                        SeSecurityPrivilege

                        SeTakeOwnershipPrivilege

                        SeLoadDriverPrivilege

                        SeBackupPrivilege

                        SeRestorePrivilege

                        SeDebugPrivilege

                        SeAuditPrivilege

                        SeSystemEnvironmentPrivilege

                        SeImpersonatePrivilege

Record Number: 506

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20101015105913.887467-000

Event Type: Überwachung erfolgreich

User: 
 

Computer Name: WIN-Q5NRK5FKD4T

Event Code: 4624

Message: Ein Konto wurde erfolgreich angemeldet.
 

Antragsteller:

        Sicherheits-ID:                S-1-5-18

        Kontoname:                WIN-Q5NRK5FKD4T$

        Kontodomäne:                WORKGROUP

        Anmelde-ID:                0x3e7
 

Anmeldetyp:                        5
 

Neue Anmeldung:

        Sicherheits-ID:                S-1-5-18

        Kontoname:                SYSTEM

        Kontodomäne:                NT-AUTORITÄT

        Anmelde-ID:                0x3e7

        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}
 

Prozessinformationen:

        Prozess-ID:                0x1ec

        Prozessname:                C:\Windows\System32\services.exe
 

Netzwerkinformationen:

        Arbeitsstationsname:        

        Quellnetzwerkadresse:        -

        Quellport:                -
 

Detaillierte Authentifizierungsinformationen:

        Anmeldeprozess:                Advapi  

        Authentifizierungspaket:        Negotiate

        Übertragene Dienste:        -

        Paketname (nur NTLM):        -

        Schlüssellänge:                0
 

Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den zugegriffen wurde.
 

Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe".
 

Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).
 

Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete Konto.
 

Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer verfügbar und kann in manchen Fällen leer bleiben.
 

Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen Anmeldeanforderung.

         - Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem KDC-Ereignis zu korrelieren.

        - Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.

        - Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.

        - Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel angefordert wurde, ist dieser Wert 0.

Record Number: 505

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20101015105913.887467-000

Event Type: Überwachung erfolgreich

User: 
 

Computer Name: WIN-Q5NRK5FKD4T

Event Code: 4738

Message: Ein Benutzerkonto wurde geändert.
 

Antragsteller:

        Sicherheits-ID:                S-1-5-21-4132121745-112448264-3429239847-500

        Kontoname:                Administrator

        Kontodomäne:                WIN-Q5NRK5FKD4T

        Anmelde-ID:                0x1faa2
 

Zielkonto:

        Sicherheits-ID:                S-1-5-21-4132121745-112448264-3429239847-500

        Kontoname:                Administrator

        Kontodomäne:                WIN-Q5NRK5FKD4T
 

Geänderte Attribute:

        SAM-Kontoname:        -

        Anzeigename:                -

        Benutzerprinzipalname:        -

        Stammverzeichnis:                -

        Stammlaufwerk:                -

        Skriptpfad:                -

        Profilpfad:                -

        Benutzerarbeitsstationen:        -

        Letzte Kennwortänderung:        -

        Konto gültig bis:                -

        Primäre Gruppen-ID:        -

        Darf delegieren an:        -

        Alter Benutzerkontensteuerungswert:                0x211

        Neuer Benutzerkontensteuerungswert:                0x211

        Benutzerkontensteuerung:        -

        Benutzerparameter:        -

        SID-Verlauf:                -

        Anmeldezeiten:                -
 

Weitere Informationen:

        Berechtigungen:                -

Record Number: 504

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20101015105900.892645-000

Event Type: Überwachung erfolgreich

User: 
 

Computer Name: WIN-Q5NRK5FKD4T

Event Code: 1102

Message: Das Überwachungsprotokoll wurde gelöscht.

Subjekt:

        Sicherheits-ID:        S-1-5-21-4132121745-112448264-3429239847-500

        Kontoname:        Administrator

        Domänenname:        WIN-Q5NRK5FKD4T

        Anmelde-ID:        0x1faa2

Record Number: 503

Source Name: Microsoft-Windows-Eventlog

Time Written: 20101015105900.596244-000

Event Type: Überwachung erfolgreich

User: 
 

======Environment variables======
 

"ComSpec"=%SystemRoot%\system32\cmd.exe

"FP_NO_HOST_CHECK"=NO

"OS"=Windows_NT

"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

"PROCESSOR_ARCHITECTURE"=x86

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

"USERNAME"=SYSTEM

"windir"=%SystemRoot%

"PSModulePath"=%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\

"NUMBER_OF_PROCESSORS"=2

"PROCESSOR_LEVEL"=6

"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 10, GenuineIntel

"PROCESSOR_REVISION"=170a

"configsetroot"=%SystemRoot%\ConfigSetRoot
 

-----------------EOF-----------------

--- --- ---

EDIT: sorry, Doppelpost...

Führ bitte auch ESET aus, danach sehen wir weiter:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Das ist das logfile von ESET:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=aca1b3df0d30994491502ffc8c7c5538
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-11-02 04:14:25
# local_time=2011-11-02 05:14:25 (+0100, Mitteleuropäische Zeit )
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=512 16777215 100 0 12162 12162 0 0
# compatibility_mode=1792 16777215 100 0 617254 617254 0 0
# compatibility_mode=5893 16776574 100 94 258 72714497 0 0
# compatibility_mode=8192 67108863 100 0 6413 6413 0 0
# scanned=148946
# found=0
# cleaned=0
# scan_time=2369

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=aca1b3df0d30994491502ffc8c7c5538
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-11-02 04:14:25
# local_time=2011-11-02 05:14:25 (+0100, Mitteleuropäische Zeit )
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=512 16777215 100 0 12162 12162 0 0
# compatibility_mode=1792 16777215 100 0 617254 617254 0 0
# compatibility_mode=5893 16776574 100 94 258 72714497 0 0
# compatibility_mode=8192 67108863 100 0 6413 6413 0 0
# scanned=148946
# found=0
# cleaned=0
# scan_time=2369

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

OTL Logfile:

Code:

OTL logfile created on: 03.11.2011 07:26:10 - Run 1

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Franziska\Desktop

 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,93 Gb Total Physical Memory | 1,34 Gb Available Physical Memory | 69,26% Memory free

3,87 Gb Paging File | 3,03 Gb Available in Paging File | 78,43% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files

Drive C: | 460,78 Gb Total Space | 433,65 Gb Free Space | 94,11% Space Free | Partition Type: NTFS

Drive F: | 596,17 Gb Total Space | 374,83 Gb Free Space | 62,87% Space Free | Partition Type: NTFS

Drive G: | 1,87 Gb Total Space | 0,84 Gb Free Space | 45,06% Space Free | Partition Type: FAT32

 

Computer Name: FRANZISKA-PC | User Name: Franziska | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.11.03 07:22:46 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Franziska\Desktop\OTL.exe

PRC - [2011.10.26 16:47:15 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2011.10.26 16:46:28 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe

PRC - [2011.10.26 16:46:26 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.10.26 16:46:18 | 000,342,480 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe

PRC - [2011.10.26 16:46:16 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.10.26 16:46:15 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.06.24 05:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2010.11.20 13:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2010.07.27 13:46:08 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

PRC - [2009.03.30 15:00:54 | 000,221,184 | ---- | M] (Brother Industries, Ltd.) -- C:\Programme\Brother\Brmfcmon\BrMfcMon.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2009.02.27 16:38:20 | 000,139,264 | R--- | M] () -- C:\Programme\Brother\BrUtilities\BrLogAPI.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.10.26 16:47:15 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.10.26 16:46:28 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)

SRV - [2011.10.26 16:46:18 | 000,342,480 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)

SRV - [2011.10.26 16:46:16 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2010.10.15 10:41:51 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)

SRV - [2010.03.25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)

SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.10.11 15:00:01 | 000,134,344 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.10.11 15:00:01 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2010.03.29 10:15:37 | 000,055,848 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1E62x86.sys -- (L1E)

DRV - [2010.03.25 21:30:22 | 000,042,368 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)

DRV - [2010.03.15 20:14:48 | 000,127,488 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3E FA 70 DB 65 99 CC 01  [binary data]

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010.10.15 10:00:50 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.10.26 10:43:14 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.10.26 10:41:49 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

 

[2011.10.26 10:43:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Franziska\AppData\Roaming\mozilla\Extensions

[2011.10.26 10:43:14 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2011.09.29 08:09:51 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.09.29 02:24:37 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2011.09.29 02:24:37 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2011.09.29 02:24:37 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.09.29 02:24:37 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4AAC6283-3DB7-45A9-8046-DF1FED708EE9}: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.11.03 07:22:44 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Franziska\Desktop\OTL.exe

[2011.11.02 13:12:06 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro

[2011.11.02 13:12:06 | 000,000,000 | ---D | C] -- C:\rsit

[2011.11.02 09:04:30 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Malwarebytes

[2011.11.02 09:04:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.11.02 09:04:20 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys

[2011.11.02 09:04:20 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2011.11.01 16:12:58 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Macromedia

[2011.11.01 16:12:41 | 000,000,000 | ---D | C] -- C:\windows\System32\Macromed

[2011.11.01 14:24:58 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Adobe

[2011.11.01 14:24:58 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Adobe

[2011.11.01 14:15:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe

[2011.11.01 14:15:50 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe

[2011.11.01 14:14:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe

[2011.10.31 07:58:01 | 000,000,000 | ---D | C] -- C:\windows\System32\EventProviders

[2011.10.31 07:10:46 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Brother

[2011.10.31 06:58:59 | 000,000,000 | ---D | C] -- C:\windows\System32\SPReview

[2011.10.27 19:35:22 | 000,093,696 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\windows\System32\fms.dll

[2011.10.26 16:49:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2011.10.26 16:23:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office

[2011.10.26 16:22:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER

[2011.10.26 16:20:48 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Analysis Services

[2011.10.26 16:19:30 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Microsoft Help

[2011.10.26 16:19:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help

[2011.10.26 16:18:40 | 000,000,000 | RH-D | C] -- C:\MSOCache

[2011.10.26 14:19:07 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0

[2011.10.26 13:07:59 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Avira

[2011.10.26 13:07:33 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\ssmdrv.sys

[2011.10.26 13:07:32 | 000,134,344 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avipbb.sys

[2011.10.26 13:07:32 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avgntflt.sys

[2011.10.26 13:07:32 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avkmgr.sys

[2011.10.26 13:07:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2011.10.26 13:07:32 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2011.10.26 12:34:01 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Diagnostics

[2011.10.26 12:27:04 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Scansoft

[2011.10.26 12:24:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother

[2011.10.26 12:22:24 | 000,073,728 | ---- | C] (Brother Industries Ltd.) -- C:\windows\System32\BrDctF2.dll

[2011.10.26 12:22:24 | 000,005,632 | ---- | C] (Brother Industries Ltd.) -- C:\windows\System32\BrDctF2L.dll

[2011.10.26 12:22:24 | 000,003,072 | ---- | C] (Brother Industries Ltd.) -- C:\windows\System32\BrDctF2S.dll

[2011.10.26 12:22:23 | 001,534,464 | ---- | C] (Brother Industries, Ltd.) -- C:\windows\System32\BrWia09b.dll

[2011.10.26 12:22:23 | 000,053,760 | ---- | C] (Brother Industries, Ltd.) -- C:\windows\System32\BrUsi09a.dll

[2011.10.26 12:22:22 | 000,111,928 | ---- | C] (Brother Industries Ltd) -- C:\windows\System32\BRRBTOOL.EXE

[2011.10.26 12:22:22 | 000,077,824 | ---- | C] (Brother Industries, Ltd.) -- C:\windows\System32\BRLMW03A.DLL

[2011.10.26 12:22:21 | 000,176,128 | ---- | C] (Brother Industries, Ltd.) -- C:\windows\System32\BROSNMP.DLL

[2011.10.26 12:22:21 | 000,167,936 | ---- | C] (brother) -- C:\windows\System32\NSSearch.dll

[2011.10.26 12:22:21 | 000,000,000 | ---D | C] -- C:\Program Files\Brother

[2011.10.26 12:22:19 | 000,024,223 | ---- | C] (Brother Industries, Ltd) -- C:\windows\System32\BRLM03A.DLL

[2011.10.26 12:21:55 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\InstallShield

[2011.10.26 12:21:10 | 000,000,000 | ---D | C] -- C:\Program Files\Nuance

[2011.10.26 12:20:41 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallShield

[2011.10.26 12:20:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScanSoft PaperPort 11

[2011.10.26 12:20:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ScanSoft Shared

[2011.10.26 12:20:10 | 000,000,000 | ---D | C] -- C:\ProgramData\ScanSoft

[2011.10.26 12:20:10 | 000,000,000 | ---D | C] -- C:\Program Files\ScanSoft

[2011.10.26 12:19:39 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client

[2011.10.26 12:19:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Brother

[2011.10.26 12:06:09 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Thunderbird

[2011.10.26 12:06:09 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Thunderbird

[2011.10.26 12:05:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2011.10.26 12:05:14 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2011.10.26 11:32:27 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

[2011.10.26 11:32:27 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Searches

[2011.10.26 11:32:27 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

[2011.10.26 11:32:19 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Identities

[2011.10.26 11:32:17 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Contacts

[2011.10.26 11:32:13 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\VirtualStore

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Vorlagen

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\AppData\Local\Verlauf

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\AppData\Local\Temporary Internet Files

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Startmenü

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\SendTo

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Recent

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Netzwerkumgebung

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Lokale Einstellungen

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Documents\Eigene Videos

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Documents\Eigene Musik

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Eigene Dateien

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Documents\Eigene Bilder

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Druckumgebung

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Cookies

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\AppData\Local\Anwendungsdaten

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Anwendungsdaten

[2011.10.26 11:32:11 | 000,000,000 | --SD | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Videos

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Saved Games

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Pictures

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Music

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Links

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Favorites

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Downloads

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Documents

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Desktop

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

[2011.10.26 11:32:11 | 000,000,000 | -H-D | C] -- C:\Users\Franziska\AppData

[2011.10.26 11:32:11 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Temp

[2011.10.26 11:32:11 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Microsoft

[2011.10.26 11:32:11 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Media Center Programs

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Programme

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten

[2011.10.26 10:43:21 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Mozilla

[2011.10.26 10:43:21 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Mozilla

[2011.10.26 10:43:14 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox

[2011.10.26 10:41:48 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird

[2011.10.26 10:26:28 | 000,000,000 | -HSD | C] -- C:\System Volume Information

[2010.07.28 19:20:56 | 000,004,096 | ---- | C] ( ) -- C:\windows\System32\IGFXDEVLib.dll

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.11.03 07:22:46 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Franziska\Desktop\OTL.exe

[2011.11.03 07:06:07 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat

[2011.11.03 07:05:58 | 1558,159,360 | -HS- | M] () -- C:\hiberfil.sys

[2011.11.03 07:05:18 | 000,012,544 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.11.03 07:05:17 | 000,012,544 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.11.02 14:43:52 | 000,653,928 | ---- | M] () -- C:\windows\System32\perfh007.dat

[2011.11.02 14:43:52 | 000,615,810 | ---- | M] () -- C:\windows\System32\perfh009.dat

[2011.11.02 14:43:52 | 000,129,800 | ---- | M] () -- C:\windows\System32\perfc007.dat

[2011.11.02 14:43:52 | 000,106,190 | ---- | M] () -- C:\windows\System32\perfc009.dat

[2011.11.01 14:16:28 | 000,001,997 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2011.10.31 16:53:54 | 000,000,432 | ---- | M] () -- C:\windows\BRWMARK.INI

[2011.10.31 12:30:38 | 000,341,504 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT

[2011.10.26 13:43:22 | 000,006,012 | ---- | M] () -- C:\Users\Franziska\Documents\Holzhauer Franziska.pfx

[2011.10.26 12:24:29 | 000,000,065 | ---- | M] () -- C:\windows\System32\bd7030.dat

[2011.10.26 12:20:15 | 000,002,153 | ---- | M] () -- C:\windows\epplauncher.mif

[2011.10.26 12:05:15 | 000,000,969 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.10.26 11:31:23 | 000,052,953 | ---- | M] () -- C:\windows\System32\license.rtf

[2011.10.26 10:43:15 | 000,001,100 | ---- | M] () -- C:\Users\Public\Desktop\Firefox.lnk

[2011.10.26 10:41:49 | 000,002,040 | ---- | M] () -- C:\Users\Public\Desktop\Thunderbird.lnk

[2011.10.11 15:00:01 | 000,134,344 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avipbb.sys

[2011.10.11 15:00:01 | 000,074,640 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avgntflt.sys

[2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avkmgr.sys

 
 ========== Files Created - No Company Name ==========

 

[2011.11.01 14:16:28 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

[2011.11.01 14:16:28 | 000,001,997 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2011.10.27 19:36:05 | 000,146,852 | ---- | C] () -- C:\windows\System32\systemsf.ebd

[2011.10.27 19:35:04 | 000,010,429 | ---- | C] () -- C:\windows\System32\ScavengeSpace.xml

[2011.10.27 19:34:57 | 000,105,559 | ---- | C] () -- C:\windows\System32\RacRules.xml

[2011.10.26 13:43:20 | 000,006,012 | ---- | C] () -- C:\Users\Franziska\Documents\Holzhauer Franziska.pfx

[2011.10.26 12:24:29 | 000,000,432 | ---- | C] () -- C:\windows\BRWMARK.INI

[2011.10.26 12:22:59 | 000,000,065 | ---- | C] () -- C:\windows\System32\bd7030.dat

[2011.10.26 12:22:22 | 000,045,056 | ---- | C] () -- C:\windows\System32\BRTCPCON.DLL

[2011.10.26 12:22:18 | 000,000,114 | ---- | C] () -- C:\windows\System32\BRLMW03A.INI

[2011.10.26 12:20:43 | 000,031,864 | ---- | C] () -- C:\windows\maxlink.ini

[2011.10.26 12:20:15 | 000,002,153 | ---- | C] () -- C:\windows\epplauncher.mif

[2011.10.26 12:05:15 | 000,000,969 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.10.26 11:33:03 | 000,001,413 | ---- | C] () -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

[2011.10.26 10:43:15 | 000,001,112 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2011.10.26 10:43:15 | 000,001,100 | ---- | C] () -- C:\Users\Public\Desktop\Firefox.lnk

[2011.10.26 10:41:49 | 000,002,052 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk

[2011.10.26 10:41:49 | 000,002,040 | ---- | C] () -- C:\Users\Public\Desktop\Thunderbird.lnk

[2011.10.26 10:26:28 | 1558,159,360 | -HS- | C] () -- C:\hiberfil.sys

[2010.06.02 21:05:28 | 000,439,308 | ---- | C] () -- C:\windows\System32\igcompkrng500.bin

[2010.06.02 21:05:24 | 000,982,240 | ---- | C] () -- C:\windows\System32\igkrng500.bin

[2010.06.02 21:05:24 | 000,092,356 | ---- | C] () -- C:\windows\System32\igfcg500m.bin

[2010.06.02 20:19:12 | 000,000,151 | ---- | C] () -- C:\windows\System32\GfxUI.exe.config

[2010.06.02 20:15:30 | 000,208,896 | ---- | C] () -- C:\windows\System32\iglhsip32.dll

[2010.06.02 20:15:28 | 000,143,360 | ---- | C] () -- C:\windows\System32\iglhcp32.dll

[2010.03.15 20:14:34 | 000,005,120 | ---- | C] () -- C:\windows\System32\HdmiCoin.dll

[2009.07.14 09:47:43 | 000,653,928 | ---- | C] () -- C:\windows\System32\perfh007.dat

[2009.07.14 09:47:43 | 000,295,922 | ---- | C] () -- C:\windows\System32\perfi007.dat

[2009.07.14 09:47:43 | 000,129,800 | ---- | C] () -- C:\windows\System32\perfc007.dat

[2009.07.14 09:47:43 | 000,038,104 | ---- | C] () -- C:\windows\System32\perfd007.dat

[2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat

[2009.07.14 05:33:53 | 000,341,504 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT

[2009.07.14 03:05:48 | 000,615,810 | ---- | C] () -- C:\windows\System32\perfh009.dat

[2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\windows\System32\perfi009.dat

[2009.07.14 03:05:48 | 000,106,190 | ---- | C] () -- C:\windows\System32\perfc009.dat

[2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\windows\System32\perfd009.dat

[2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\windows\System32\NOISE.DAT

[2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\windows\System32\dssec.dat

[2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin

[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\windows\System32\BthpanContextHandler.dll

[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\windows\System32\BWContextHandler.dll

[2009.07.13 23:09:19 | 000,139,824 | ---- | C] () -- C:\windows\System32\igfcg500.bin

[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\windows\System32\mlang.dat

 
 ========== LOP Check ==========

 

[2011.10.26 12:06:09 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Thunderbird

[2009.07.14 05:53:46 | 000,009,700 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.11.01 14:24:58 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Adobe

[2011.10.26 13:07:59 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Avira

[2011.10.31 07:10:46 | 000,000,000 | R--D | M] -- C:\Users\Franziska\AppData\Roaming\Brother

[2011.10.26 11:32:19 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Identities

[2011.10.26 12:21:55 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\InstallShield

[2011.11.01 16:12:58 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Macromedia

[2011.11.02 09:04:30 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Malwarebytes

[2009.07.14 09:56:41 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Media Center Programs

[2011.11.02 16:28:10 | 000,000,000 | --SD | M] -- C:\Users\Franziska\AppData\Roaming\Microsoft

[2011.10.26 10:43:28 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Mozilla

[2011.10.26 12:06:09 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Thunderbird

 
 < %APPDATA%\*.exe /s >

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys

[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys

[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys

[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys

[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

 
 < MD5 for: IASTORV.SYS  >

[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys

[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys

[2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys

[2011.03.11 06:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys

[2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

[2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys

[2011.03.11 06:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll

[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll

[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys

[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys

[2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys

[2011.03.11 06:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys

[2011.03.11 06:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys

[2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys

[2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll

[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll

[2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll

[2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe

[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe

[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe

[2009.10.28 06:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe

[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe

[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe

[2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

--- --- ---

OTL Logfile:

Code:

OTL logfile created on: 03.11.2011 07:26:10 - Run 1

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Franziska\Desktop

 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,93 Gb Total Physical Memory | 1,34 Gb Available Physical Memory | 69,26% Memory free

3,87 Gb Paging File | 3,03 Gb Available in Paging File | 78,43% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files

Drive C: | 460,78 Gb Total Space | 433,65 Gb Free Space | 94,11% Space Free | Partition Type: NTFS

Drive F: | 596,17 Gb Total Space | 374,83 Gb Free Space | 62,87% Space Free | Partition Type: NTFS

Drive G: | 1,87 Gb Total Space | 0,84 Gb Free Space | 45,06% Space Free | Partition Type: FAT32

 

Computer Name: FRANZISKA-PC | User Name: Franziska | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.11.03 07:22:46 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Franziska\Desktop\OTL.exe

PRC - [2011.10.26 16:47:15 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2011.10.26 16:46:28 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe

PRC - [2011.10.26 16:46:26 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.10.26 16:46:18 | 000,342,480 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe

PRC - [2011.10.26 16:46:16 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.10.26 16:46:15 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.06.24 05:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2010.11.20 13:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2010.07.27 13:46:08 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

PRC - [2009.03.30 15:00:54 | 000,221,184 | ---- | M] (Brother Industries, Ltd.) -- C:\Programme\Brother\Brmfcmon\BrMfcMon.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2009.02.27 16:38:20 | 000,139,264 | R--- | M] () -- C:\Programme\Brother\BrUtilities\BrLogAPI.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.10.26 16:47:15 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.10.26 16:46:28 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)

SRV - [2011.10.26 16:46:18 | 000,342,480 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)

SRV - [2011.10.26 16:46:16 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2010.10.15 10:41:51 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)

SRV - [2010.03.25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)

SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.10.11 15:00:01 | 000,134,344 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.10.11 15:00:01 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2010.03.29 10:15:37 | 000,055,848 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1E62x86.sys -- (L1E)

DRV - [2010.03.25 21:30:22 | 000,042,368 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)

DRV - [2010.03.15 20:14:48 | 000,127,488 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3E FA 70 DB 65 99 CC 01  [binary data]

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010.10.15 10:00:50 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.10.26 10:43:14 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.10.26 10:41:49 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

 

[2011.10.26 10:43:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Franziska\AppData\Roaming\mozilla\Extensions

[2011.10.26 10:43:14 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2011.09.29 08:09:51 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.09.29 02:24:37 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2011.09.29 02:24:37 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2011.09.29 02:24:37 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.09.29 02:24:37 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4AAC6283-3DB7-45A9-8046-DF1FED708EE9}: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.11.03 07:22:44 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Franziska\Desktop\OTL.exe

[2011.11.02 13:12:06 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro

[2011.11.02 13:12:06 | 000,000,000 | ---D | C] -- C:\rsit

[2011.11.02 09:04:30 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Malwarebytes

[2011.11.02 09:04:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.11.02 09:04:20 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys

[2011.11.02 09:04:20 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2011.11.01 16:12:58 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Macromedia

[2011.11.01 16:12:41 | 000,000,000 | ---D | C] -- C:\windows\System32\Macromed

[2011.11.01 14:24:58 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Adobe

[2011.11.01 14:24:58 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Adobe

[2011.11.01 14:15:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe

[2011.11.01 14:15:50 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe

[2011.11.01 14:14:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe

[2011.10.31 07:58:01 | 000,000,000 | ---D | C] -- C:\windows\System32\EventProviders

[2011.10.31 07:10:46 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Brother

[2011.10.31 06:58:59 | 000,000,000 | ---D | C] -- C:\windows\System32\SPReview

[2011.10.27 19:35:22 | 000,093,696 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\windows\System32\fms.dll

[2011.10.26 16:49:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2011.10.26 16:23:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office

[2011.10.26 16:22:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER

[2011.10.26 16:20:48 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Analysis Services

[2011.10.26 16:19:30 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Microsoft Help

[2011.10.26 16:19:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help

[2011.10.26 16:18:40 | 000,000,000 | RH-D | C] -- C:\MSOCache

[2011.10.26 14:19:07 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0

[2011.10.26 13:07:59 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Avira

[2011.10.26 13:07:33 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\ssmdrv.sys

[2011.10.26 13:07:32 | 000,134,344 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avipbb.sys

[2011.10.26 13:07:32 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avgntflt.sys

[2011.10.26 13:07:32 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avkmgr.sys

[2011.10.26 13:07:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2011.10.26 13:07:32 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2011.10.26 12:34:01 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Diagnostics

[2011.10.26 12:27:04 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Scansoft

[2011.10.26 12:24:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother

[2011.10.26 12:22:24 | 000,073,728 | ---- | C] (Brother Industries Ltd.) -- C:\windows\System32\BrDctF2.dll

[2011.10.26 12:22:24 | 000,005,632 | ---- | C] (Brother Industries Ltd.) -- C:\windows\System32\BrDctF2L.dll

[2011.10.26 12:22:24 | 000,003,072 | ---- | C] (Brother Industries Ltd.) -- C:\windows\System32\BrDctF2S.dll

[2011.10.26 12:22:23 | 001,534,464 | ---- | C] (Brother Industries, Ltd.) -- C:\windows\System32\BrWia09b.dll

[2011.10.26 12:22:23 | 000,053,760 | ---- | C] (Brother Industries, Ltd.) -- C:\windows\System32\BrUsi09a.dll

[2011.10.26 12:22:22 | 000,111,928 | ---- | C] (Brother Industries Ltd) -- C:\windows\System32\BRRBTOOL.EXE

[2011.10.26 12:22:22 | 000,077,824 | ---- | C] (Brother Industries, Ltd.) -- C:\windows\System32\BRLMW03A.DLL

[2011.10.26 12:22:21 | 000,176,128 | ---- | C] (Brother Industries, Ltd.) -- C:\windows\System32\BROSNMP.DLL

[2011.10.26 12:22:21 | 000,167,936 | ---- | C] (brother) -- C:\windows\System32\NSSearch.dll

[2011.10.26 12:22:21 | 000,000,000 | ---D | C] -- C:\Program Files\Brother

[2011.10.26 12:22:19 | 000,024,223 | ---- | C] (Brother Industries, Ltd) -- C:\windows\System32\BRLM03A.DLL

[2011.10.26 12:21:55 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\InstallShield

[2011.10.26 12:21:10 | 000,000,000 | ---D | C] -- C:\Program Files\Nuance

[2011.10.26 12:20:41 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallShield

[2011.10.26 12:20:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScanSoft PaperPort 11

[2011.10.26 12:20:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ScanSoft Shared

[2011.10.26 12:20:10 | 000,000,000 | ---D | C] -- C:\ProgramData\ScanSoft

[2011.10.26 12:20:10 | 000,000,000 | ---D | C] -- C:\Program Files\ScanSoft

[2011.10.26 12:19:39 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client

[2011.10.26 12:19:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Brother

[2011.10.26 12:06:09 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Thunderbird

[2011.10.26 12:06:09 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Thunderbird

[2011.10.26 12:05:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2011.10.26 12:05:14 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2011.10.26 11:32:27 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

[2011.10.26 11:32:27 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Searches

[2011.10.26 11:32:27 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

[2011.10.26 11:32:19 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Identities

[2011.10.26 11:32:17 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Contacts

[2011.10.26 11:32:13 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\VirtualStore

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Vorlagen

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\AppData\Local\Verlauf

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\AppData\Local\Temporary Internet Files

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Startmenü

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\SendTo

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Recent

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Netzwerkumgebung

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Lokale Einstellungen

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Documents\Eigene Videos

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Documents\Eigene Musik

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Eigene Dateien

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Documents\Eigene Bilder

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Druckumgebung

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Cookies

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\AppData\Local\Anwendungsdaten

[2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Anwendungsdaten

[2011.10.26 11:32:11 | 000,000,000 | --SD | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Videos

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Saved Games

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Pictures

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Music

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Links

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Favorites

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Downloads

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Documents

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Desktop

[2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

[2011.10.26 11:32:11 | 000,000,000 | -H-D | C] -- C:\Users\Franziska\AppData

[2011.10.26 11:32:11 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Temp

[2011.10.26 11:32:11 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Microsoft

[2011.10.26 11:32:11 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Media Center Programs

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Programme

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente

[2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten

[2011.10.26 10:43:21 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Mozilla

[2011.10.26 10:43:21 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Mozilla

[2011.10.26 10:43:14 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox

[2011.10.26 10:41:48 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird

[2011.10.26 10:26:28 | 000,000,000 | -HSD | C] -- C:\System Volume Information

[2010.07.28 19:20:56 | 000,004,096 | ---- | C] ( ) -- C:\windows\System32\IGFXDEVLib.dll

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.11.03 07:22:46 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Franziska\Desktop\OTL.exe

[2011.11.03 07:06:07 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat

[2011.11.03 07:05:58 | 1558,159,360 | -HS- | M] () -- C:\hiberfil.sys

[2011.11.03 07:05:18 | 000,012,544 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.11.03 07:05:17 | 000,012,544 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.11.02 14:43:52 | 000,653,928 | ---- | M] () -- C:\windows\System32\perfh007.dat

[2011.11.02 14:43:52 | 000,615,810 | ---- | M] () -- C:\windows\System32\perfh009.dat

[2011.11.02 14:43:52 | 000,129,800 | ---- | M] () -- C:\windows\System32\perfc007.dat

[2011.11.02 14:43:52 | 000,106,190 | ---- | M] () -- C:\windows\System32\perfc009.dat

[2011.11.01 14:16:28 | 000,001,997 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2011.10.31 16:53:54 | 000,000,432 | ---- | M] () -- C:\windows\BRWMARK.INI

[2011.10.31 12:30:38 | 000,341,504 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT

[2011.10.26 13:43:22 | 000,006,012 | ---- | M] () -- C:\Users\Franziska\Documents\Holzhauer Franziska.pfx

[2011.10.26 12:24:29 | 000,000,065 | ---- | M] () -- C:\windows\System32\bd7030.dat

[2011.10.26 12:20:15 | 000,002,153 | ---- | M] () -- C:\windows\epplauncher.mif

[2011.10.26 12:05:15 | 000,000,969 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.10.26 11:31:23 | 000,052,953 | ---- | M] () -- C:\windows\System32\license.rtf

[2011.10.26 10:43:15 | 000,001,100 | ---- | M] () -- C:\Users\Public\Desktop\Firefox.lnk

[2011.10.26 10:41:49 | 000,002,040 | ---- | M] () -- C:\Users\Public\Desktop\Thunderbird.lnk

[2011.10.11 15:00:01 | 000,134,344 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avipbb.sys

[2011.10.11 15:00:01 | 000,074,640 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avgntflt.sys

[2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avkmgr.sys

 
 ========== Files Created - No Company Name ==========

 

[2011.11.01 14:16:28 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

[2011.11.01 14:16:28 | 000,001,997 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2011.10.27 19:36:05 | 000,146,852 | ---- | C] () -- C:\windows\System32\systemsf.ebd

[2011.10.27 19:35:04 | 000,010,429 | ---- | C] () -- C:\windows\System32\ScavengeSpace.xml

[2011.10.27 19:34:57 | 000,105,559 | ---- | C] () -- C:\windows\System32\RacRules.xml

[2011.10.26 13:43:20 | 000,006,012 | ---- | C] () -- C:\Users\Franziska\Documents\Holzhauer Franziska.pfx

[2011.10.26 12:24:29 | 000,000,432 | ---- | C] () -- C:\windows\BRWMARK.INI

[2011.10.26 12:22:59 | 000,000,065 | ---- | C] () -- C:\windows\System32\bd7030.dat

[2011.10.26 12:22:22 | 000,045,056 | ---- | C] () -- C:\windows\System32\BRTCPCON.DLL

[2011.10.26 12:22:18 | 000,000,114 | ---- | C] () -- C:\windows\System32\BRLMW03A.INI

[2011.10.26 12:20:43 | 000,031,864 | ---- | C] () -- C:\windows\maxlink.ini

[2011.10.26 12:20:15 | 000,002,153 | ---- | C] () -- C:\windows\epplauncher.mif

[2011.10.26 12:05:15 | 000,000,969 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.10.26 11:33:03 | 000,001,413 | ---- | C] () -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

[2011.10.26 10:43:15 | 000,001,112 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2011.10.26 10:43:15 | 000,001,100 | ---- | C] () -- C:\Users\Public\Desktop\Firefox.lnk

[2011.10.26 10:41:49 | 000,002,052 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk

[2011.10.26 10:41:49 | 000,002,040 | ---- | C] () -- C:\Users\Public\Desktop\Thunderbird.lnk

[2011.10.26 10:26:28 | 1558,159,360 | -HS- | C] () -- C:\hiberfil.sys

[2010.06.02 21:05:28 | 000,439,308 | ---- | C] () -- C:\windows\System32\igcompkrng500.bin

[2010.06.02 21:05:24 | 000,982,240 | ---- | C] () -- C:\windows\System32\igkrng500.bin

[2010.06.02 21:05:24 | 000,092,356 | ---- | C] () -- C:\windows\System32\igfcg500m.bin

[2010.06.02 20:19:12 | 000,000,151 | ---- | C] () -- C:\windows\System32\GfxUI.exe.config

[2010.06.02 20:15:30 | 000,208,896 | ---- | C] () -- C:\windows\System32\iglhsip32.dll

[2010.06.02 20:15:28 | 000,143,360 | ---- | C] () -- C:\windows\System32\iglhcp32.dll

[2010.03.15 20:14:34 | 000,005,120 | ---- | C] () -- C:\windows\System32\HdmiCoin.dll

[2009.07.14 09:47:43 | 000,653,928 | ---- | C] () -- C:\windows\System32\perfh007.dat

[2009.07.14 09:47:43 | 000,295,922 | ---- | C] () -- C:\windows\System32\perfi007.dat

[2009.07.14 09:47:43 | 000,129,800 | ---- | C] () -- C:\windows\System32\perfc007.dat

[2009.07.14 09:47:43 | 000,038,104 | ---- | C] () -- C:\windows\System32\perfd007.dat

[2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat

[2009.07.14 05:33:53 | 000,341,504 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT

[2009.07.14 03:05:48 | 000,615,810 | ---- | C] () -- C:\windows\System32\perfh009.dat

[2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\windows\System32\perfi009.dat

[2009.07.14 03:05:48 | 000,106,190 | ---- | C] () -- C:\windows\System32\perfc009.dat

[2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\windows\System32\perfd009.dat

[2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\windows\System32\NOISE.DAT

[2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\windows\System32\dssec.dat

[2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin

[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\windows\System32\BthpanContextHandler.dll

[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\windows\System32\BWContextHandler.dll

[2009.07.13 23:09:19 | 000,139,824 | ---- | C] () -- C:\windows\System32\igfcg500.bin

[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\windows\System32\mlang.dat

 
 ========== LOP Check ==========

 

[2011.10.26 12:06:09 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Thunderbird

[2009.07.14 05:53:46 | 000,009,700 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.11.01 14:24:58 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Adobe

[2011.10.26 13:07:59 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Avira

[2011.10.31 07:10:46 | 000,000,000 | R--D | M] -- C:\Users\Franziska\AppData\Roaming\Brother

[2011.10.26 11:32:19 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Identities

[2011.10.26 12:21:55 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\InstallShield

[2011.11.01 16:12:58 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Macromedia

[2011.11.02 09:04:30 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Malwarebytes

[2009.07.14 09:56:41 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Media Center Programs

[2011.11.02 16:28:10 | 000,000,000 | --SD | M] -- C:\Users\Franziska\AppData\Roaming\Microsoft

[2011.10.26 10:43:28 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Mozilla

[2011.10.26 12:06:09 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Thunderbird

 
 < %APPDATA%\*.exe /s >

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys

[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys

[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys

[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys

[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

 
 < MD5 for: IASTORV.SYS  >

[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys

[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys

[2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys

[2011.03.11 06:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys

[2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

[2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys

[2011.03.11 06:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll

[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll

[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys

[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys

[2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys

[2011.03.11 06:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys

[2011.03.11 06:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys

[2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys

[2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll

[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll

[2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll

[2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe

[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe

[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe

[2009.10.28 06:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe

[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe

[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe

[2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

--- --- ---

Log ist unauffällig. Entweder war der gefunde Link von Malwarebytes ein Fehlalarm oder ein unbedeutender Überrest.

Noch Probleme oder gab es überhaupt welche?

Hallo Cosinus,

erstmal danke für deine prompte und kompetente Hilfe! Nein, Probleme sind mir keine aufgefallen (aber ich weiß das ja auch nicht so wirklich, auf was ich achten muss...), auch ein erneuter Avira- sowie Malwarebytes-Scan war unauffällig. Wollte eben einfach auf Nummer sicher gehen, da ich relativ viel mit dem Computer arbeite und da keine Probleme möchte.

Liebe Grüße,
Lady Curious