Trojaner-Board - Umleitung auf searchcompletion.com

OSAM:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

http://www.online-solutions.ru/en/

Saved at 19:26:13 on 24.03.2012
 

OS: Windows XP Professional Service Pack 3 (Build 2600)

Default Browser: Mozilla Corporation Firefox 11.0
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Boot Execute]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----

"BootExecute" - ? - OODBS  (File not found)
 

[Common]

-----( %SystemRoot%\Tasks )-----

"AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe

"Game_Booster_Startup.job" - "IObit" - C:\Programme\IObit\Game Booster\gbtray.exe

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"javacpl.cpl" - "Oracle Corporation" - C:\WINDOWS\system32\javacpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Anchorfree HSS Adapter" (taphss) - "AnchorFree Inc" - C:\WINDOWS\System32\DRIVERS\taphss.sys

"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)

"cpuz130" (cpuz130) - ? - C:\DOKUME~1\Matthias\LOKALE~1\Temp\cpuz130\cpuz_x32.sys  (File not found)

"cpuz135" (cpuz135) - "CPUID" - C:\WINDOWS\system32\drivers\cpuz135_x32.sys

"DAEMON Tools Virtual Bus Driver" (dtsoftbus01) - "DT Soft Ltd" - C:\WINDOWS\System32\DRIVERS\dtsoftbus01.sys

"dgderdrv" (dgderdrv) - "Devguru Co., Ltd" - C:\WINDOWS\System32\drivers\dgderdrv.sys

"ElbyCDFL" (ElbyCDFL) - "SlySoft, Inc." - C:\WINDOWS\System32\Drivers\ElbyCDFL.sys

"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\WINDOWS\System32\Drivers\ElbyCDIO.sys

"fssj" (fssj) - ? - C:\WINDOWS\System32\drivers\akkvboq.sys  (File found, but it contains no detailed information)

"giveio" (giveio) - ? - C:\WINDOWS\System32\giveio.sys  (File found, but it contains no detailed information)

"Hotspot Shield Helper Miniport" (HssDrv) - "AnchorFree Inc." - C:\WINDOWS\System32\DRIVERS\HssDrv.sys

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS

"SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS

"SCDEmu" (SCDEmu) - "PowerISO Computing, Inc." - C:\WINDOWS\system32\drivers\SCDEmu.sys

"speedfan" (speedfan) - "Almico Software" - C:\WINDOWS\System32\speedfan.sys

"StarOpen" (StarOpen) - ? - C:\WINDOWS\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)

"SWDUMon" (SWDUMon) - ? - C:\WINDOWS\System32\DRIVERS\SWDUMon.sys  (File found, but it contains no detailed information)

"TAP-Win32 Adapter V9" (tap0901) - "The OpenVPN Project" - C:\WINDOWS\System32\DRIVERS\tap0901.sys

"TCP/IP-Protokolltreiber" (Tcpip) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\tcpip.sys

"VMware Bridge Protocol" (VMnetBridge) - "VMware, Inc." - C:\WINDOWS\System32\DRIVERS\vmnetbridge.sys

"VMware hcmon" (hcmon) - "VMware, Inc." - C:\WINDOWS\system32\drivers\hcmon.sys

"VMware kbd" (vmkbd) - "VMware, Inc." - C:\WINDOWS\system32\drivers\VMkbd.sys

"VMware Network Application Interface" (VMnetuserif) - "VMware, Inc." - C:\WINDOWS\system32\drivers\vmnetuserif.sys

"VMware vmx86" (vmx86) - "VMware, Inc." - C:\WINDOWS\system32\Drivers\vmx86.sys

"XDva394" (XDva394) - ? - C:\WINDOWS\system32\XDva394.sys  (File not found)
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

AutorunsDisabled "AutorunsDisabled" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "SABShellExecuteHook Class" - "SuperAdBlocker.com" - C:\Programme\SUPERAntiSpyware\SASSEH.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? -   (File not found | COM-object registry key not found)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{32683183-48a0-441b-a342-7c2a440a9478} "Media Band" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll

{967B2D40-8B7D-4127-9049-61EA0C2C6DCE} "PowerISO" - "PowerISO Computing, Inc." - C:\Programme\PowerISO\PWRISOSH.DLL

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? -   (File not found | COM-object registry key not found)

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----

{32683183-48a0-441b-a342-7c2a440a9478} "{32683183-48a0-441b-a342-7c2a440a9478}" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - ? - C:\Programme\Oracle\JavaFX 2.0 Runtime\bin\npjpi160_29.dll  (File not found) / http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.7.0_03" - "Oracle Corporation" - C:\Programme\Java\jre7\bin\jp2iexp.dll / http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab

{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.7.0_03" - "Oracle Corporation" - C:\Programme\Java\jre7\bin\npjpi170_03.dll / http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.7.0_03" - "Oracle Corporation" - C:\Programme\Java\jre7\bin\ssv.dll / http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab

{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX / http://download.eset.com/special/eos/OnlineScanner.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash11e.ocx / http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Programme\Java\jre7\bin\jp2ssv.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\Matthias\Startmenü\Programme\Autostart\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"ccleaner" - "Piriform Ltd" - "C:\Programme\CCleaner\CCleaner.exe" /AUTO

"KiesPDLR" - ? - C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce )-----

"Malwarebytes Anti-Malware (cleanup)" - "Malwarebytes Corporation" - rundll32.exe "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Programme\Bonjour\mDNSResponder.exe

"FABS - Helping agent for MAGIX media database" (Fabs) - "MAGIX AG" - C:\Programme\Gemeinsame Dateien\MAGIX Services\Database\bin\FABS.exe

"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Programme\Gemeinsame Dateien\MAGIX Services\Database\bin\fbserver.exe

"Hotspot Shield Monitoring Service" (HssWd) - ? - C:\Programme\Hotspot Shield\bin\hsswd.exe  (File found, but it contains no detailed information)

"Hotspot Shield Routing Service" (HssSrv) - ? - C:\Programme\Hotspot Shield\HssWPR\hsssrv.exe

"Hotspot Shield Service" (hshld) - ? - C:\Programme\Hotspot Shield\bin\openvpnas.exe  (File found, but it contains no detailed information)

"Hotspot Shield Tray Service" (HssTrayService) - ? - C:\Programme\Hotspot Shield\bin\HssTrayService.EXE  (File found, but it contains no detailed information)

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe

"Java Quick Starter" (JavaQuickStarterService) - "Oracle Corporation" - C:\Programme\Java\jre7\bin\jqs.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"MSSQL$SONY_MEDIAMGR" (MSSQL$SONY_MEDIAMGR) - "Microsoft Corporation" - C:\Programme\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe

"MSSQLServerADHelper" (MSSQLServerADHelper) - "Microsoft Corporation" - C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe

"NMSAccess" (NMSAccess) - ? - C:\Programme\CDBurnerXP\NMSAccessU.exe  (File found, but it contains no detailed information)

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE

"SAS Core Service" (!SASCORE) - "SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASCORE.EXE

"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Programme\Skype\Updater\Updater.exe

"SQLAgent$SONY_MEDIAMGR" (SQLAgent$SONY_MEDIAMGR) - "Microsoft Corporation" - C:\Programme\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE

"VMware Authorization Service" (VMAuthdService) - "VMware, Inc." - C:\Programme\VMware\VMware Player\vmware-authd.exe

"VMware DHCP Service" (VMnetDHCP) - "VMware, Inc." - C:\WINDOWS\system32\vmnetdhcp.exe

"VMware NAT Service" (VMware NAT Service) - "VMware, Inc." - C:\WINDOWS\system32\vmnat.exe

"VMware USB Arbitration Service" (VMUSBArbService) - "VMware, Inc." - C:\Programme\Gemeinsame Dateien\VMware\USB\vmware-usbarbitrator.exe

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

"Windows Presentation Foundation Font Cache 4.0.0.0" (WPFFontCache_v0400) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"!SASWinLogon" - "SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL

"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"VMCI sockets DGRAM" - "VMware, Inc." - C:\WINDOWS\system32\vsocklib.dll

"VMCI sockets STREAM" - "VMware, Inc." - C:\WINDOWS\system32\vsocklib.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit http://forum.online-solutions.ru

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-03-25 11:24:06

-----------------------------

11:24:06.687    OS Version: Windows 5.1.2600 Service Pack 3

11:24:06.687    Number of processors: 1 586 0x1601

11:24:06.687    ComputerName: MUHAHAHA-FPGDH9  UserName: Matthias

11:24:10.015    Initialize success

11:25:24.281    AVAST engine defs: 12032500

11:26:24.609    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0

11:26:24.609    Disk 0 Vendor: FUJITSU_ 0040 Size: 76319MB BusType: 3

11:26:24.625    Disk 0 MBR read successfully

11:26:24.625    Disk 0 MBR scan

11:26:24.671    Disk 0 Windows XP default MBR code

11:26:24.671    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        76308 MB offset 63

11:26:24.671    Disk 0 scanning sectors +156280320

11:26:24.796    Disk 0 scanning C:\WINDOWS\system32\drivers

11:27:00.078    Service scanning

11:27:31.046    Modules scanning

11:27:37.093    Disk 0 trace - called modules:

11:27:37.109    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll iaStor.sys 

11:27:37.109    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a2d5030]

11:27:37.109    3 CLASSPNP.SYS[ba0f8fd7] -> nt!IofCallDriver -> \Device\00000081[0x8a279350]

11:27:37.109    5 ACPI.sys[b9f7e620] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x8a2d6028]

11:27:37.953    AVAST engine scan C:\WINDOWS

11:27:44.437    AVAST engine scan C:\WINDOWS\system32

11:30:27.171    AVAST engine scan C:\WINDOWS\system32\drivers

11:30:43.265    AVAST engine scan C:\Dokumente und Einstellungen\Matthias

11:47:57.390    AVAST engine scan C:\Dokumente und Einstellungen\All Users

11:50:09.140    Scan finished successfully

11:50:28.671    Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\Matthias\Desktop\MBR.dat"

11:50:28.687    The log file has been saved successfully to "C:\Dokumente und Einstellungen\Matthias\Desktop\aswMBR.txt"

GMER:

Code:

GMER 1.0.15.15641 - http://www.gmer.net

Rootkit scan 2012-03-25 14:58:48

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 FUJITSU_ rev.0040

Running: g4uxumpj.exe; Driver: C:\DOKUME~1\Matthias\LOKALE~1\Temp\ugldqpod.sys
 
 

---- Kernel code sections - GMER 1.0.15 ----
 

?               csperlm.sys                                                                                        Das System kann die angegebene Datei nicht finden. !

?               C:\DOKUME~1\Matthias\LOKALE~1\Temp\aswMBR.sys                                                      Das System kann die angegebene Datei nicht finden. !
 

---- User code sections - GMER 1.0.15 ----
 

.text           C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[1568] ntdll.dll!DbgUiRemoteBreakin  7C9620EC 1 Byte  [C3]
 

---- Devices - GMER 1.0.15 ----
 

Device          \Driver\usbhub \Device\0000008f                                                                    hcmon.sys (VMware USB monitor/VMware, Inc.)
 

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                            VMkbd.sys (VMware keyboard filter driver (32-bit)/VMware, Inc.)

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                            VMkbd.sys (VMware keyboard filter driver (32-bit)/VMware, Inc.)
 

Device          \Driver\usbuhci \Device\USBPDO-0                                                                   hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbehci \Device\USBPDO-1                                                                   hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbuhci \Device\USBPDO-2                                                                   hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbuhci \Device\USBPDO-3                                                                   hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbehci \Device\USBPDO-4                                                                   hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbuhci \Device\USBPDO-5                                                                   hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbuhci \Device\USBPDO-6                                                                   hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbhub \Device\USBPDO-8                                                                    hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbhub \Device\USBPDO-9                                                                    hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbhub \Device\USBPDO-11                                                                   hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbhub \Device\USBPDO-12                                                                   hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbhub \Device\00000091                                                                    hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbhub \Device\00000085                                                                    hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbhub \Device\00000086                                                                    hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbhub \Device\00000087                                                                    hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbhub \Device\00000088                                                                    hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbhub \Device\00000089                                                                    hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbuhci \Device\USBFDO-0                                                                   hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbuhci \Device\USBFDO-1                                                                   hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbehci \Device\USBFDO-2                                                                   hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbuhci \Device\USBFDO-3                                                                   hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbuhci \Device\USBFDO-4                                                                   hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbuhci \Device\USBFDO-5                                                                   hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbhub \Device\0000008a                                                                    hcmon.sys (VMware USB monitor/VMware, Inc.)

Device          \Driver\usbehci \Device\USBFDO-6                                                                   hcmon.sys (VMware USB monitor/VMware, Inc.)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060970bb0                        

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060970bb0@e8e5d6ea882d           0x52 0xCD 0x00 0x26 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060970bb0@549b12622abb           0x16 0x6C 0x0A 0x09 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001060970bb0 (not active ControlSet)    

Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001060970bb0@e8e5d6ea882d               0x52 0xCD 0x00 0x26 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001060970bb0@549b12622abb               0x16 0x6C 0x0A 0x09 ...

Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System                                              

Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG14.00.00.01PROFESSIONAL              484223FE67129E64EC31C055FC88809E66D6ED759D4147479954543B32794E04DFBCD9128D7FCAC2C65BCA8E0F4D11E4989041A21D9DABEF39BC6E55E0AB4B5AD73AA394DF6AF2DBE465B595E15F8ED560BAAE3E2281BE4F7980CCAA55AA897278FE53B47CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A6A0AC4980AC7933A2D97226D213B5555D575E7D6A3B9808BD7E119942BE78D03C3B44F2CA17F229D3B9307AC7E332A05002D55EB3348D231BE13C3F79D1F85C2B0F7A9FB0170D8D0324CFA0E509AD314867458E79CB32F36463E9BB03E1A77238CD132E513E9CD05AC5B899752181A1F0D35833564C95978CC8EAC4630269891FE4EE9ECC55E54700CE7DD4494C7141F75C6E46F7CA9D7A69AC9001435CE24B0311F0E7E1BBEF777CC1B131DE3B089570696DB6B06C75BE397DB18CEB2A81166665807075E0079CBE766E87D0B41256513740E8796D0A3A197A2878503E727E32C90A98914A3D28959ACFA16392206FF25754326C9D0DF58DBB5447037A2BC8B2F7FBAD6291E43B39ABF6BB7AC40882152F1ADDC7DFF52FFDAA18F1BA5AE07198FE4BF7B86495AEC0FE090A22CB62E35B76082B6E2BFE57B483D9E4D4E68E2677416FAE0A82AD0E2B3BAD3187BF8C9B4A39984EE78AA5156259847F51C2F54848F5E
 

---- EOF - GMER 1.0.15 ----

MBAM hat nichts und SASW nur 2 Cookies gefunden.
Das eigentliche Problem, nämlich dass die Suche umgeleitet wird, besteht jedoch immernoch.

Und um den nächsten Eintrag vorwegzunehmen, hier ein neues OTL-Log:

Code:

OTL logfile created on: 02.04.2012 22:46:52 - Run 5

OTL by OldTimer - Version 3.2.39.1     Folder = C:\Dokumente und Einstellungen\Matthias\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,49 Gb Total Physical Memory | 0,98 Gb Available Physical Memory | 65,86% Memory free

3,59 Gb Paging File | 3,35 Gb Available in Paging File | 93,22% Paging File free

Paging file location(s): C:\pagefile.sys 2300 3064 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 74,52 Gb Total Space | 21,30 Gb Free Space | 28,58% Space Free | Partition Type: NTFS

Drive D: | 695,29 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

Drive F: | 2328,76 Gb Total Space | 1898,87 Gb Free Space | 81,54% Space Free | Partition Type: NTFS

 

Computer Name: MUHAHAHA-FPGDH9 | User Name: Matthias | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Dokumente und Einstellungen\Matthias\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Programme\Java\jre7\bin\jqs.exe (Oracle Corporation)

PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)

PRC - C:\Programme\IObit\Game Booster\gbtray.exe (IObit)

PRC - C:\WINDOWS\system32\vmnat.exe (VMware, Inc.)

PRC - C:\WINDOWS\system32\vmnetdhcp.exe (VMware, Inc.)

PRC - C:\Programme\VMware\VMware Player\vmware-authd.exe (VMware, Inc.)

PRC - C:\Programme\Hotspot Shield\bin\openvpnas.exe ()

PRC - C:\Programme\Hotspot Shield\bin\hsswd.exe ()

PRC - C:\Programme\Hotspot Shield\HssWPR\hsssrv.exe (AnchorFree Inc.)

PRC - C:\Programme\Gemeinsame Dateien\VMware\USB\vmware-usbarbitrator.exe (VMware, Inc.)

PRC - C:\Programme\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)

PRC - C:\Programme\Gemeinsame Dateien\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

PRC - C:\Programme\CDBurnerXP\NMSAccessU.exe ()

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\LSI SoftModem\agrsmsvc.exe (LSI Corporation)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Programme\VMware\VMware Player\libxml2.dll ()

MOD - C:\Programme\Hotspot Shield\bin\openvpnas.exe ()

MOD - C:\Programme\Hotspot Shield\bin\hsswd.exe ()

MOD - C:\Programme\IObit\Game Booster\sqlite3.dll ()

MOD - C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll ()

MOD - C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll ()

MOD - C:\Programme\CDBurnerXP\NMSAccessU.exe ()

MOD - C:\Programme\Hotspot Shield\bin\libidn-11.dll ()

MOD - C:\Programme\Hotspot Shield\bin\libssl32.dll ()

MOD - C:\Programme\Hotspot Shield\bin\libeay32.dll ()

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (JavaQuickStarterService) -- C:\Programme\Java\jre7\bin\jqs.exe (Oracle Corporation)

SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)

SRV - (SkypeUpdate) -- C:\Programme\Skype\Updater\Updater.exe (Skype Technologies)

SRV - (VMware NAT Service) -- C:\WINDOWS\system32\vmnat.exe (VMware, Inc.)

SRV - (VMnetDHCP) -- C:\WINDOWS\system32\vmnetdhcp.exe (VMware, Inc.)

SRV - (VMAuthdService) -- C:\Programme\VMware\VMware Player\vmware-authd.exe (VMware, Inc.)

SRV - (HssTrayService) -- C:\Programme\Hotspot Shield\bin\HssTrayService.exe ()

SRV - (hshld) -- C:\Programme\Hotspot Shield\bin\openvpnas.exe ()

SRV - (HssWd) -- C:\Programme\Hotspot Shield\bin\hsswd.exe ()

SRV - (HssSrv) -- C:\Programme\Hotspot Shield\HssWPR\hsssrv.exe (AnchorFree Inc.)

SRV - (VMUSBArbService) -- C:\Programme\Gemeinsame Dateien\VMware\USB\vmware-usbarbitrator.exe (VMware, Inc.)

SRV - (!SASCORE) -- C:\Programme\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)

SRV - (Fabs) -- C:\Programme\Gemeinsame Dateien\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)

SRV - (FirebirdServerMAGIXInstance) -- C:\Programme\Gemeinsame Dateien\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)

SRV - (NMSAccess) -- C:\Programme\CDBurnerXP\NMSAccessU.exe ()

SRV - (AVerScheduleService) -- C:\Programme\Gemeinsame Dateien\AVerMedia\Service\AVerScheduleService.exe ()

SRV - (AVerRemote) -- C:\Programme\Gemeinsame Dateien\AVerMedia\Service\AVerRemote.exe (AVerMedia)

SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)

SRV - (MSSQL$SONY_MEDIAMGR) -- C:\Programme\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (Microsoft Corporation)

SRV - (SQLAgent$SONY_MEDIAMGR) -- C:\Programme\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (Microsoft Corporation)

SRV - (AgereModemAudio) -- C:\Programme\LSI SoftModem\agrsmsvc.exe (LSI Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (XDva394) -- C:\WINDOWS\system32\XDva394.sys File not found

DRV - (PCIDump) --  File not found

DRV - (cpuz130) -- C:\DOKUME~1\Matthias\LOKALE~1\Temp\cpuz130\cpuz_x32.sys File not found

DRV - (catchme) -- C:\ComboFix\catchme.sys File not found

DRV - (dtsoftbus01) -- C:\WINDOWS\system32\drivers\dtsoftbus01.sys (DT Soft Ltd)

DRV - (SWDUMon) -- C:\WINDOWS\system32\drivers\SWDUMon.sys ()

DRV - (vmx86) -- C:\WINDOWS\system32\drivers\vmx86.sys (VMware, Inc.)

DRV - (vmkbd) -- C:\WINDOWS\system32\drivers\VMkbd.sys (VMware, Inc.)

DRV - (VMnetBridge) -- C:\WINDOWS\system32\drivers\vmnetbridge.sys (VMware, Inc.)

DRV - (VMnetuserif) -- C:\WINDOWS\system32\drivers\vmnetuserif.sys (VMware, Inc.)

DRV - (VMnetAdapter) -- C:\WINDOWS\system32\drivers\vmnetadapter.sys (VMware, Inc.)

DRV - (sscemdm) -- C:\WINDOWS\system32\drivers\sscemdm.sys (MCCI Corporation)

DRV - (ssceserd) SAMSUNG Mobile Modem Diagnostic Serial Port V2 (WDM) -- C:\WINDOWS\system32\drivers\ssceserd.sys (MCCI Corporation)

DRV - (sscebus) SAMSUNG USB Composite Device V2 driver (WDM) -- C:\WINDOWS\system32\drivers\sscebus.sys (MCCI Corporation)

DRV - (sscemdfl) -- C:\WINDOWS\system32\drivers\sscemdfl.sys (MCCI Corporation)

DRV - (ssudserd) SAMSUNG Mobile USB Diagnostic Serial Port(DEVGURU Ver.) -- C:\WINDOWS\system32\drivers\ssudserd.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

DRV - (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.) -- C:\WINDOWS\system32\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

DRV - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) -- C:\WINDOWS\system32\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

DRV - (sscdmdm) -- C:\WINDOWS\system32\drivers\sscdmdm.sys (MCCI Corporation)

DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\WINDOWS\system32\drivers\sscdbus.sys (MCCI Corporation)

DRV - (sscdmdfl) -- C:\WINDOWS\system32\drivers\sscdmdfl.sys (MCCI Corporation)

DRV - (ssadmdm) -- C:\WINDOWS\system32\drivers\ssadmdm.sys (MCCI Corporation)

DRV - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) -- C:\WINDOWS\system32\drivers\ssadbus.sys (MCCI Corporation)

DRV - (ssadserd) SAMSUNG Android USB Diagnostic Serial Port (WDM) -- C:\WINDOWS\system32\drivers\ssadserd.sys (MCCI Corporation)

DRV - (androidusb) -- C:\WINDOWS\system32\drivers\ssadadb.sys (Google Inc)

DRV - (ssadmdfl) SAMSUNG Android USB Modem (Filter) -- C:\WINDOWS\system32\drivers\ssadmdfl.sys (MCCI Corporation)

DRV - (hcmon) -- C:\WINDOWS\system32\drivers\hcmon.sys (VMware, Inc.)

DRV - (vmusb) -- C:\WINDOWS\system32\drivers\vmusb.sys (VMware, Inc.)

DRV - (vmci) -- C:\WINDOWS\system32\drivers\vmci.sys (VMware, Inc.)

DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)

DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)

DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)

DRV - (tap0901) -- C:\WINDOWS\system32\drivers\tap0901.sys (The OpenVPN Project)

DRV - (SCDEmu) -- C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)

DRV - (HssDrv) -- C:\WINDOWS\system32\drivers\HssDrv.sys (AnchorFree Inc.)

DRV - (taphss) -- C:\WINDOWS\system32\drivers\taphss.sys (AnchorFree Inc)

DRV - (speedfan) -- C:\WINDOWS\system32\speedfan.sys (Almico Software)

DRV - (dgderdrv) -- C:\WINDOWS\system32\drivers\dgderdrv.sys (Devguru Co., Ltd)

DRV - (cpuz135) -- C:\WINDOWS\system32\drivers\cpuz135_x32.sys (CPUID)

DRV - (RTL8187B) -- C:\WINDOWS\system32\drivers\RTL8187B.sys (Realtek Semiconductor Corporation                           )

DRV - (Monfilt) -- C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)

DRV - (Ambfilt) -- C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)

DRV - (StarOpen) -- C:\WINDOWS\System32\drivers\StarOpen.sys ()

DRV - (AVerAF35) -- C:\WINDOWS\system32\drivers\AVerAF35.sys (AVerMedia TECHNOLOGIES, Inc.)

DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation                           )

DRV - (MPE) -- C:\WINDOWS\system32\drivers\MPE.sys (Microsoft Corporation)

DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\rtl8139.sys (Realtek Semiconductor Corporation)

DRV - (MTsensor) -- C:\WINDOWS\system32\drivers\ATKACPI.sys ()

DRV - (ElbyCDFL) -- C:\WINDOWS\system32\drivers\ElbyCDFL.sys (SlySoft, Inc.)

DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (LSI Corporation)

DRV - (giveio) -- C:\WINDOWS\system32\giveio.sys ()

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = http://www.google.de/

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = http://www.google.de/

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = http://www.google.de/

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Default_Page_URL = http://www.google.de/

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://www.google.de/

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.google.de/

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-21-1645522239-796845957-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = http://www.google.de/

IE - HKU\S-1-5-21-1645522239-796845957-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

IE - HKU\S-1-5-21-1645522239-796845957-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = http://www.google.de/

IE - HKU\S-1-5-21-1645522239-796845957-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = http://www.google.de/

IE - HKU\S-1-5-21-1645522239-796845957-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Start Default_Page_URL = http://www.google.de/

IE - HKU\S-1-5-21-1645522239-796845957-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://www.google.de/

IE - HKU\S-1-5-21-1645522239-796845957-839522115-1003\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-1645522239-796845957-839522115-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.google.de/

IE - HKU\S-1-5-21-1645522239-796845957-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: ""

FF - prefs.js..browser.search.selectedEngine: ""

FF - prefs.js..browser.startup.homepage: ""

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20110323

FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.8

FF - prefs.js..browser.search.defaultengine: ""

FF - prefs.js..browser.search.order.1: ""

FF - prefs.js..browser.search.useDBForOrder: ""

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)

FF - HKLM\Software\MozillaPlugins\@idsoftware.com/QuakeLive: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\id Software\QuakeLive\npquakezero.dll (id Software Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.2.1: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.2.1: C:\Programme\Oracle\JavaFX 2.0 Runtime\bin\new_plugin\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.03.17 11:58:05 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.02.24 10:35:34 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 11.0.1\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2011.10.29 19:45:05 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 11.0.1\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins

 

[2011.02.16 21:14:36 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mozilla\Extensions

[2011.02.16 21:14:36 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2012.01.17 21:30:29 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mozilla\Firefox\Profiles\g2l788se.Standard-Benutzer\extensions

[2012.02.16 22:10:30 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mozilla\Firefox\Profiles\hv5g430i.default\extensions

[2011.11.19 01:58:44 | 000,000,000 | ---D | M] (WOT) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mozilla\Firefox\Profiles\hv5g430i.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

[2011.12.24 01:20:03 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mozilla\Firefox\Profiles\hv5g430i.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2011.11.22 21:44:47 | 000,000,000 | ---D | M] (Cookies Manager+) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mozilla\Firefox\Profiles\hv5g430i.default\extensions\{bb6bc1bb-f824-4702-90cd-35e2fb24f25d}

[2011.12.27 23:32:40 | 000,000,000 | ---D | M] (Memory Fox) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mozilla\Firefox\Profiles\hv5g430i.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}

[2011.11.24 20:20:53 | 000,000,000 | ---D | M] (Nokia Maps 3D browser plugin) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mozilla\Firefox\Profiles\hv5g430i.default\extensions\maps@ovi.com

[2012.03.29 21:43:33 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mozilla\Firefox\Profiles\mpuj3mov.pt\extensions

[2012.03.02 22:49:39 | 000,000,000 | ---D | M] (WOT) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mozilla\Firefox\Profiles\mpuj3mov.pt\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

[2012.03.29 21:43:33 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mozilla\Firefox\Profiles\mpuj3mov.pt\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2012.02.04 13:03:19 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2011.07.19 23:04:03 | 000,000,000 | ---D | M] (Hotspot Shield Helper (Please allow this installation)) -- C:\Programme\Mozilla Firefox\extensions\afurladvisor@anchorfree.com

() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\MATTHIAS\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HV5G430I.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\MATTHIAS\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HV5G430I.DEFAULT\EXTENSIONS\ICH@MALTEGOETZ.DE.XPI

[2012.03.17 11:58:04 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll

[2012.01.23 12:50:38 | 000,170,080 | ---- | M] (Tracker Software Products (Canada) Ltd.) -- C:\Programme\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll

[2011.11.05 05:38:54 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.11.05 05:32:18 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml

[2011.11.05 05:38:54 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml

[2011.11.05 05:38:54 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.11.05 05:38:54 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.11.05 05:38:54 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Shockwave Flash (Disabled) = C:\Dokumente und Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Programme\Google\Chrome\Application\17.0.963.56\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Programme\Google\Chrome\Application\17.0.963.56\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Programme\Google\Chrome\Application\17.0.963.56\pdf.dll

CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Programme\Mozilla Firefox\plugins\np-mswmp.dll

CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Programme\Mozilla Firefox\plugins\NPOFFICE.DLL

CHR - plugin: PDF-XChange Viewer (Enabled) = C:\Programme\Mozilla Firefox\plugins\npPDFXCviewNPPlugin.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin6.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin7.dll

CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npdrmv2.dll

CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npwmsdrm.dll

CHR - plugin: Google Update (Enabled) = C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll

CHR - plugin: Java(TM) Platform SE 7 U3 (Enabled) = C:\Programme\Java\jre7\bin\plugin2\npjp2.dll

CHR - plugin: Java Deployment Toolkit 7.0.30.5 (Enabled) = C:\WINDOWS\system32\npDeployJava1.dll

CHR - plugin: VLC Web Plugin (Enabled) = C:\Programme\VideoLAN\VLC\npvlc.dll

CHR - plugin: iTunes Application Detector (Enabled) = C:\Programme\iTunes\Mozilla Plugins\npitunes.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: Angry Birds = C:\Dokumente und Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.1.2.1_0\

CHR - Extension: Click to activate/deactivate ProxTube = C:\Dokumente und Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\mkdbaehcjcomcnnjhlmnfddpgoafpcko\1.0.5_0\

 

O1 HOSTS File: ([2012.03.24 01:29:58 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O4 - HKU\S-1-5-21-1645522239-796845957-839522115-1003..\Run: [ccleaner] C:\Programme\CCleaner\CCleaner.exe (Piriform Ltd)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-1645522239-796845957-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-1645522239-796845957-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-1645522239-796845957-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-21-1645522239-796845957-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105 File not found

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000 File not found

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\vsocklib.dll (VMware, Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\vsocklib.dll (VMware, Inc.)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1521F33A-179E-4A62-A9EF-877725B62DDE}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1521F33A-179E-4A62-A9EF-877725B62DDE}: NameServer = 85.88.19.10,94.75.228.28

O18 - Protocol\Handler\AutorunsDisabled - No CLSID value found

O18 - Protocol\Handler\AutorunsDisabled\ms-help - No CLSID value found

O18 - Protocol\Handler\AutorunsDisabled\skype-ie-addon-data - No CLSID value found

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Programme\SUPERAntiSpyware\SASWINLO.DLL) - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2011.10.12 17:15:41 | 000,000,143 | R--- | M] () - D:\autorun.inf -- [ CDFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O34 - HKLM BootExecute: (OODBS)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: 6to4 -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

 

MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^AVer HID Receiver.lnk - C:\Programme\Gemeinsame Dateien\AVerMedia\AVerQuick\AVerHIDReceiver.exe - ()

MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^AVerQuick.lnk - C:\Programme\Gemeinsame Dateien\AVerMedia\AVerQuick\AVerQuick.exe - (AVerMedia TECHNOLOGIES, Inc.)

MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Dienst-Manager.lnk - C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe - (Microsoft Corporation)

MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Windows Search.lnk -  - File not found

MsConfig - StartUpReg: Alcmtr - hkey= - key= - C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)

MsConfig - StartUpReg: APSDaemon - hkey= - key= - C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

MsConfig - StartUpReg: BluetoothAuthenticationAgent - hkey= - key= -  File not found

MsConfig - StartUpReg: CloneCDTray - hkey= - key= - C:\Programme\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.)

MsConfig - StartUpReg: DAEMON Tools Lite - hkey= - key= - C:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

MsConfig - StartUpReg: DWQueuedReporting - hkey= - key= - C:\Programme\Gemeinsame Dateien\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)

MsConfig - StartUpReg: FILSHtray - hkey= - key= - C:\Programme\FILSHtray\FILSHtray.exe (FILSH Media GmbH)

MsConfig - StartUpReg: HotKeysCmds - hkey= - key= -  File not found

MsConfig - StartUpReg: IgfxTray - hkey= - key= -  File not found

MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Programme\iTunes\iTunesHelper.exe (Apple Inc.)

MsConfig - StartUpReg: KiesHelper - hkey= - key= - C:\Programme\Samsung\Kies\KiesHelper.exe (Samsung)

MsConfig - StartUpReg: KiesPDLR - hkey= - key= - C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()

MsConfig - StartUpReg: KiesTrayAgent - hkey= - key= - C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)

MsConfig - StartUpReg: MSConfig - hkey= - key= - C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE (Microsoft Corporation)

MsConfig - StartUpReg: Persistence - hkey= - key= -  File not found

MsConfig - StartUpReg: PWRISOVM.EXE - hkey= - key= - C:\Programme\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)

MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Programme\QuickTime\QTTask.exe (Apple Inc.)

MsConfig - StartUpReg: RTHDCPL - hkey= - key= - C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.)

MsConfig - StartUpReg: Skype - hkey= - key= - C:\Programme\Skype\Phone\Skype.exe (Skype Technologies S.A.)

MsConfig - StartUpReg: SkyTel - hkey= - key= - C:\WINDOWS\SkyTel.exe (Realtek Semiconductor Corp.)

MsConfig - StartUpReg: SlimDrivers - hkey= - key= - C:\Programme\SlimDrivers\SlimDrivers.exe (SlimWare Utilities, Inc.)

MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

MsConfig - StartUpReg: SUPERAntiSpyware - hkey= - key= - C:\Programme\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)

MsConfig - StartUpReg: uTorrent - hkey= - key= - C:\Programme\uTorrent\uTorrent.exe (BitTorrent, Inc.)

MsConfig - State: "system.ini" - 0

MsConfig - State: "win.ini" - 0

MsConfig - State: "bootini" - 0

MsConfig - State: "services" - 2

MsConfig - State: "startup" - 2

 

SafeBootMin: !SASCORE - C:\Programme\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: sermouse.sys - Driver

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vds - Service

SafeBootMin: vga.sys - Driver

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

SafeBootNet: !SASCORE - C:\Programme\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: hitmanpro35 - Reg Error: Value error.

SafeBootNet: hitmanpro35.sys - Reg Error: Value error.

SafeBootNet: HitmanPro35Crusader - Reg Error: Value error.

SafeBootNet: hitmanpro36 - Reg Error: Value error.

SafeBootNet: hitmanpro36.sys - Reg Error: Value error.

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: sermouse.sys - Driver

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vga.sys - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8

ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders

ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework

ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate

ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

ActiveX: AutorunsDisabled - 

ActiveX: Microsoft Base Smart Card Crypto Provider Package - 

 

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.lhacm - C:\WINDOWS\System32\lhacm.acm (Microsoft Corporation)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: VIDC.CFHD - C:\WINDOWS\System32\cfhd.dll (CineForm Inc.)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: VIDC.FPS1 - C:\WINDOWS\System32\frapsvid.dll (Beepa P/L)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: VIDC.VMnc - C:\WINDOWS\System32\vmnc.dll (VMware, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.04.02 12:31:32 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Matthias\Recent

[2012.04.01 23:31:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Matthias\Desktop\ZEROING IN

[2012.04.01 23:31:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Matthias\Desktop\OUTRIDER

[2012.04.01 23:31:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Matthias\Desktop\INTENSIVE CARE

[2012.04.01 00:25:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\iTunes

[2012.04.01 00:24:46 | 000,000,000 | ---D | C] -- C:\Programme\iPod

[2012.04.01 00:24:42 | 000,000,000 | ---D | C] -- C:\Programme\iTunes

[2012.03.31 21:45:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Matthias\Eigene Dateien\PowerGramo Records

[2012.03.31 21:45:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Dokumente\PowerGramo Offline Records

[2012.03.31 21:45:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Desktop

[2012.03.31 21:45:01 | 000,000,000 | ---D | C] -- C:\Programme\Freebird

[2012.03.31 12:44:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Matthias\Desktop\osam_autorun_manager_5_0_portable

[2012.03.24 21:59:45 | 000,000,000 | ---D | C] -- C:\CFLog

[2012.03.24 21:25:01 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Dokumente und Einstellungen\Matthias\Desktop\aswMBR.exe

[2012.03.24 01:30:31 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2012.03.24 01:07:30 | 004,443,082 | R--- | C] (Swearware) -- C:\Dokumente und Einstellungen\Matthias\Desktop\ComboFix.exe

[2012.03.22 22:47:32 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine

[2012.03.22 16:01:25 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.03.20 17:35:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\id Software

[2012.03.20 17:35:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\id Software

[2012.03.20 09:15:07 | 000,000,000 | ---D | C] -- C:\Programme\ESET

[2012.03.17 13:40:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\SUPERAntiSpyware.com

[2012.03.17 13:39:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com

[2012.03.17 13:39:34 | 000,000,000 | ---D | C] -- C:\Programme\SUPERAntiSpyware

[2012.03.17 13:37:12 | 000,594,432 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Matthias\Desktop\OTL.exe

[2012.03.17 13:26:12 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\Matthias\Desktop\HiJackThis204.exe

[2012.03.17 13:22:12 | 002,066,480 | ---- | C] (Kaspersky Lab ZAO) -- C:\Dokumente und Einstellungen\Matthias\Desktop\TDSSKiller.exe

[2012.03.13 17:34:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited

[2012.03.13 17:34:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Canneverbe Limited

[2012.03.13 17:34:20 | 000,000,000 | ---D | C] -- C:\Programme\CDBurnerXP

[2012.03.12 20:42:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Matthias\Startmenü\Programme\Total Commander

[2012.03.12 20:42:55 | 000,000,000 | ---D | C] -- C:\totalcmd

[2012.03.12 20:42:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\GHISLER

[2012.03.11 14:56:06 | 000,000,000 | ---D | C] -- C:\Programme\Nero

[2012.03.11 14:56:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Nero

[2012.03.11 14:55:51 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Nero

[2012.03.11 14:55:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nero

[2012.03.11 14:47:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Matthias\Desktop\IsoBusterPortable

[2012.03.08 20:36:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Matthias\Desktop\sony vegas

[2012.03.06 18:08:17 | 004,763,456 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\Dokumente und Einstellungen\Matthias\Desktop\procexp.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.04.02 15:05:31 | 000,000,246 | ---- | M] () -- C:\WINDOWS\tasks\Game_Booster_Startup.job

[2012.04.02 12:38:40 | 000,518,532 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat

[2012.04.02 12:38:40 | 000,494,050 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2012.04.02 12:38:40 | 000,103,166 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat

[2012.04.02 12:38:40 | 000,085,524 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2012.04.02 12:31:53 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2012.04.02 12:31:25 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012.03.30 07:35:54 | 000,225,280 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.03.29 16:11:57 | 000,092,846 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\bushido-3176 - Bearbeitet.jpg

[2012.03.29 15:33:37 | 000,001,509 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\.recently-used.xbel

[2012.03.29 14:59:56 | 001,224,266 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\MTZ_Wegweiser_2012-page-002.jpg

[2012.03.26 19:13:21 | 000,032,582 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\537163_178331635620059_100003296723515_262490_1154377036_n.jpg

[2012.03.25 11:53:58 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\g4uxumpj.exe

[2012.03.25 11:50:28 | 000,000,512 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\MBR.dat

[2012.03.24 23:04:24 | 000,059,746 | ---- | M] () -- C:\__rzi_0.573

[2012.03.24 21:25:03 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Dokumente und Einstellungen\Matthias\Desktop\aswMBR.exe

[2012.03.24 01:29:58 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2012.03.24 01:07:46 | 004,443,082 | R--- | M] (Swearware) -- C:\Dokumente und Einstellungen\Matthias\Desktop\ComboFix.exe

[2012.03.21 18:42:08 | 002,066,480 | ---- | M] (Kaspersky Lab ZAO) -- C:\Dokumente und Einstellungen\Matthias\Desktop\TDSSKiller.exe

[2012.03.21 12:11:35 | 000,275,760 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2012.03.20 22:39:30 | 000,594,432 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Matthias\Desktop\OTL.exe

[2012.03.18 17:29:21 | 000,176,958 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\2012-03-18_162919.bmp

[2012.03.16 20:45:13 | 002,979,894 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\b.bmp

[2012.03.16 20:43:18 | 002,605,734 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\a.bmp

[2012.03.13 14:44:07 | 397,579,491 | ---- | M] () -- C:\reg_sensipearl-wmvFullHigh-1.wmv

[2012.03.11 11:36:36 | 007,744,129 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\18. Massiv feat. Baba Saad - Hart und Gerecht (Orginal).mp3

[2012.03.09 23:35:29 | 006,410,240 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\Baba Saad - Mein Job (Manuel Charr).mp3

[2012.03.09 08:57:10 | 000,000,545 | ---- | M] () -- C:\WINDOWS\UC.PIF

[2012.03.09 08:57:10 | 000,000,545 | ---- | M] () -- C:\WINDOWS\RAR.PIF

[2012.03.09 08:57:10 | 000,000,545 | ---- | M] () -- C:\WINDOWS\NOCLOSE.PIF

[2012.03.09 08:57:10 | 000,000,545 | ---- | M] () -- C:\WINDOWS\LHA.PIF

[2012.03.09 08:57:10 | 000,000,545 | ---- | M] () -- C:\WINDOWS\ARJ.PIF

 
 ========== Files Created - No Company Name ==========

 

[2012.03.31 14:10:10 | 000,000,246 | ---- | C] () -- C:\WINDOWS\tasks\Game_Booster_Startup.job

[2012.03.29 15:33:37 | 000,001,509 | ---- | C] () -- C:\Dokumente und Einstellungen\Matthias\.recently-used.xbel

[2012.03.29 14:59:53 | 001,224,266 | ---- | C] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\MTZ_Wegweiser_2012-page-002.jpg

[2012.03.26 19:13:20 | 000,032,582 | ---- | C] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\537163_178331635620059_100003296723515_262490_1154377036_n.jpg

[2012.03.25 11:53:58 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\g4uxumpj.exe

[2012.03.25 11:50:28 | 000,000,512 | ---- | C] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\MBR.dat

[2012.03.24 23:04:24 | 000,059,746 | ---- | C] () -- C:\__rzi_0.573

[2012.03.18 17:29:21 | 000,176,958 | ---- | C] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\2012-03-18_162919.bmp

[2012.03.16 20:38:28 | 002,979,894 | ---- | C] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\b.bmp

[2012.03.16 20:38:03 | 002,605,734 | ---- | C] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\a.bmp

[2012.03.13 17:34:22 | 000,001,527 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\CDBurnerXP.lnk

[2012.03.13 17:34:21 | 000,005,504 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys

[2012.03.13 14:05:38 | 007,744,129 | ---- | C] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\18. Massiv feat. Baba Saad - Hart und Gerecht (Orginal).mp3

[2012.03.13 14:00:09 | 397,579,491 | ---- | C] () -- C:\reg_sensipearl-wmvFullHigh-1.wmv

[2012.03.12 20:42:55 | 000,000,545 | ---- | C] () -- C:\WINDOWS\UC.PIF

[2012.03.12 20:42:55 | 000,000,545 | ---- | C] () -- C:\WINDOWS\RAR.PIF

[2012.03.12 20:42:55 | 000,000,545 | ---- | C] () -- C:\WINDOWS\NOCLOSE.PIF

[2012.03.12 20:42:55 | 000,000,545 | ---- | C] () -- C:\WINDOWS\LHA.PIF

[2012.03.12 20:42:55 | 000,000,545 | ---- | C] () -- C:\WINDOWS\ARJ.PIF

[2012.03.09 23:35:16 | 006,410,240 | ---- | C] () -- C:\Dokumente und Einstellungen\Matthias\Desktop\Baba Saad - Mein Job (Manuel Charr).mp3

[2012.03.03 17:58:09 | 000,000,288 | ---- | C] () -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\.backup.dm

[2012.02.15 21:54:23 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

[2011.12.05 14:22:12 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2011.10.31 19:45:19 | 000,000,048 | ---- | C] () -- C:\WINDOWS\WININIT.INI

[2011.08.31 20:19:17 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2011.08.28 12:27:24 | 000,000,042 | ---- | C] () -- C:\WINDOWS\oodjobd.INI

[2011.08.05 16:11:33 | 000,012,984 | ---- | C] () -- C:\WINDOWS\System32\drivers\SWDUMon.sys

[2011.08.04 19:21:46 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll

[2011.07.30 18:23:48 | 000,068,352 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat

[2011.06.28 15:22:24 | 000,023,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys

[2011.06.24 15:59:01 | 000,000,041 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib

[2011.06.19 16:39:28 | 000,001,492 | ---- | C] () -- C:\Dokumente und Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\RecConfig.xml

[2011.06.16 19:57:45 | 000,530,168 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat

[2011.06.16 19:57:42 | 002,775,560 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-1645522239-796845957-839522115-1003-0.dat

[2011.06.16 19:57:42 | 000,266,830 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat

[2011.02.17 17:08:42 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2011.02.17 17:08:42 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2011.02.17 17:08:42 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2011.02.17 17:08:42 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2011.02.17 17:08:42 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2011.02.16 19:38:42 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\AVerIO.dll

[2011.02.16 19:38:42 | 000,003,456 | R--- | C] () -- C:\WINDOWS\System32\AVerIO.sys

[2011.02.16 19:38:30 | 000,598,016 | R--- | C] () -- C:\WINDOWS\System32\sptlib21.dll

[2011.02.16 19:38:30 | 000,307,200 | R--- | C] () -- C:\WINDOWS\System32\sptlib01.dll

[2011.02.16 19:38:30 | 000,294,912 | R--- | C] () -- C:\WINDOWS\System32\sptlib11.dll

[2011.02.16 19:38:30 | 000,290,816 | R--- | C] () -- C:\WINDOWS\System32\sptlib22.dll

[2011.02.16 19:38:30 | 000,249,856 | R--- | C] () -- C:\WINDOWS\System32\sptlib03.dll

[2011.02.16 19:38:30 | 000,225,280 | R--- | C] () -- C:\WINDOWS\System32\sptlib02.dll

[2011.02.16 19:38:30 | 000,135,168 | R--- | C] () -- C:\WINDOWS\System32\sptlib12.dll

[2011.02.16 19:28:08 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll

[2011.02.16 16:37:46 | 001,498,560 | ---- | C] () -- C:\WINDOWS\System32\igkrng400.bin

[2011.02.16 16:35:19 | 000,451,072 | ---- | C] () -- C:\WINDOWS\System32\ISSRemoveSP.exe

[2011.02.16 16:34:31 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe

[2011.02.16 15:54:35 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat

[2011.02.16 14:45:44 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2011.02.16 14:44:31 | 000,225,280 | ---- | C] () -- C:\Dokumente und Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.02.15 21:41:16 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2011.02.15 21:37:08 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2011.02.15 21:32:25 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2011.02.15 21:31:20 | 000,275,760 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2011.01.29 18:00:24 | 000,030,568 | ---- | C] () -- C:\WINDOWS\MusiccityDownload.exe

[2011.01.29 18:00:22 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll

[2011.01.29 18:00:22 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll

[2011.01.29 18:00:22 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll

[2011.01.29 18:00:22 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll

 
 ========== LOP Check ==========

 

[2011.02.16 19:39:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVerTV

[2012.03.13 17:34:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited

[2011.06.17 17:09:07 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ

[2011.11.03 17:16:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite

[2011.08.12 18:49:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Hitman Pro

[2012.02.04 14:02:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HitmanPro

[2012.01.07 20:15:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hssff

[2011.06.20 23:00:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IconTweaker

[2012.03.20 17:35:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\id Software

[2011.09.06 17:16:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IObit

[2011.12.24 15:20:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX

[2012.01.28 00:52:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Panda Security

[2011.02.16 20:32:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Samsung

[2011.08.03 20:00:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SlySoft

[2011.06.18 21:57:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sony

[2011.06.20 22:45:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software

[2011.02.15 22:04:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

[2011.08.22 20:12:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\.minecraft

[2012.03.02 14:15:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Amazon

[2011.06.20 13:38:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Auslogics

[2011.10.16 13:58:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\BANDISOFT

[2012.02.13 19:11:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Binreader

[2012.03.13 17:34:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Canneverbe Limited

[2011.08.30 21:50:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Canon

[2011.10.20 18:49:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\CCE

[2012.03.08 17:19:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\DAEMON Tools Lite

[2011.12.12 21:27:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\DVDVideoSoft

[2011.12.12 21:27:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\DVDVideoSoftIEHelpers

[2012.03.12 20:42:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\GHISLER

[2012.03.29 15:32:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\gtk-2.0

[2011.07.15 23:34:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\JAM Software

[2011.02.17 22:17:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\KC Softwares

[2011.10.23 14:00:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\KillSwitch

[2011.12.25 21:39:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\MAGIX

[2012.04.01 00:23:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mp3tag

[2011.12.01 17:05:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Nik Software

[2012.02.24 10:37:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Oracle

[2012.01.28 00:56:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Panda Security

[2011.06.18 22:03:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Publish Providers

[2012.02.28 22:09:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Rovio

[2011.02.16 20:31:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung

[2012.02.27 22:07:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Solveig Multimedia

[2011.07.17 00:01:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Sony

[2011.11.26 23:51:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\TERMINAL Studio

[2011.02.16 21:14:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Thunderbird

[2012.03.20 22:50:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\TS3Client

[2011.06.20 22:44:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\TuneUp Software

[2012.02.05 18:36:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\updatetool

[2012.03.18 12:54:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\uTorrent

[2011.06.19 15:30:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Windows Search

[2011.02.16 20:14:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\XMedia Recode

[2012.04.02 15:05:31 | 000,000,246 | ---- | M] () -- C:\WINDOWS\Tasks\Game_Booster_Startup.job

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.08.22 20:12:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\.minecraft

[2011.02.16 16:46:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Adobe

[2012.03.02 14:15:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Amazon

[2011.11.16 22:45:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Apple Computer

[2011.06.20 13:38:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Auslogics

[2011.10.16 13:58:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\BANDISOFT

[2012.02.13 19:11:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Binreader

[2012.03.13 17:34:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Canneverbe Limited

[2011.08.30 21:50:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Canon

[2011.10.20 18:49:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\CCE

[2012.03.08 17:19:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\DAEMON Tools Lite

[2011.10.29 15:46:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\dvdcss

[2011.12.12 21:27:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\DVDVideoSoft

[2011.12.12 21:27:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\DVDVideoSoftIEHelpers

[2011.06.17 19:58:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\FastStone

[2012.03.12 20:42:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\GHISLER

[2012.03.29 15:32:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\gtk-2.0

[2011.02.15 21:43:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Identities

[2011.07.15 23:34:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\JAM Software

[2011.02.17 22:17:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\KC Softwares

[2011.10.23 14:00:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\KillSwitch

[2011.02.16 16:46:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Macromedia

[2011.12.25 21:39:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\MAGIX

[2011.02.16 17:41:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Malwarebytes

[2011.10.26 15:01:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Media Player Classic

[2012.02.27 21:44:02 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Microsoft

[2011.02.16 14:45:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mozilla

[2012.04.01 00:23:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mp3tag

[2011.12.01 17:05:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Nik Software

[2012.02.24 10:37:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Oracle

[2012.01.28 00:56:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Panda Security

[2011.06.18 22:03:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Publish Providers

[2012.02.28 22:09:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Rovio

[2011.02.16 20:31:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung

[2012.04.01 12:58:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Skype

[2012.02.27 22:07:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Solveig Multimedia

[2011.07.17 00:01:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Sony

[2011.02.16 20:21:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Sun

[2012.03.17 13:40:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\SUPERAntiSpyware.com

[2011.10.30 00:45:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\teamspeak2

[2011.11.26 23:51:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\TERMINAL Studio

[2011.02.16 21:14:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Thunderbird

[2012.03.20 22:50:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\TS3Client

[2011.06.20 22:44:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\TuneUp Software

[2012.02.05 18:36:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\updatetool

[2012.03.18 12:54:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\uTorrent

[2012.04.01 22:41:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\vlc

[2012.03.25 00:47:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\VMware

[2011.06.19 15:30:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Windows Search

[2011.02.16 14:49:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\WinRAR

[2011.02.16 20:14:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\XMedia Recode

 
 < %APPDATA%\*.exe /s >

[2011.04.16 12:18:52 | 000,647,168 | ---- | M] (IDEVFH) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Mozilla\Firefox\Profiles\hv5g430i.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}\components\afom.exe

[2012.03.18 21:25:04 | 000,106,408 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\FirmwareUpdateTemp\AGENT\AgentInstaller.exe

[2012.03.18 21:25:04 | 000,101,288 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\FirmwareUpdateTemp\AGENT\AgentUpdate.exe

[2012.03.18 21:25:05 | 000,021,416 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\FirmwareUpdateTemp\AGENT\KiesPDLR.exe

[2011.12.27 16:21:06 | 000,937,360 | ---- | M] (Samsung) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\UpdateTemp\backup\Kies.exe

[2011.12.27 16:21:10 | 000,278,928 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\UpdateTemp\backup\KiesDriverInstaller.exe

[2011.12.23 14:03:40 | 000,304,640 | ---- | M] (Samsung) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\UpdateTemp\backup\KiesLogger.exe

[2011.12.27 16:21:08 | 003,508,624 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\UpdateTemp\backup\KiesTrayAgent.exe

[2011.12.23 13:59:48 | 000,284,672 | ---- | M] (Mobileleader Co., Ltd.) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\UpdateTemp\backup\External\DeviceModules\DeviceDataService.exe

[2011.12.23 13:59:50 | 000,691,712 | ---- | M] (Mobileleader Co., Ltd.) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\UpdateTemp\backup\External\DeviceModules\DeviceManager.exe

[2011.12.27 16:21:12 | 000,067,472 | ---- | M] (Samsung) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\UpdateTemp\backup\External\DeviceModules\Kies_Tutorial.exe

[2011.12.23 13:59:20 | 000,106,408 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\UpdateTemp\backup\External\FirmwareUpdate\AgentInstaller.exe

[2011.12.23 13:59:20 | 000,101,288 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\UpdateTemp\backup\External\FirmwareUpdate\AgentUpdate.exe

[2011.12.27 16:21:16 | 000,131,984 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\UpdateTemp\backup\External\FirmwareUpdate\BinaryLoaderMgr.exe

[2011.12.27 16:21:18 | 000,021,392 | ---- | M] () -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\UpdateTemp\backup\External\FirmwareUpdate\KiesPDLR.exe

[2011.12.27 16:21:20 | 003,569,984 | ---- | M] (Freeware) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\UpdateTemp\backup\External\MediaModules\MyFreeCodecPack.exe

[2011.12.27 16:21:22 | 000,371,088 | ---- | M] (ml) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\UpdateTemp\Temp\Kies.Update.exe

[2012.02.03 10:50:30 | 000,371,088 | ---- | M] (ml) -- C:\Dokumente und Einstellungen\Matthias\Anwendungsdaten\Samsung\Kies\UpdateTemp\Updater\Kies.Update.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2008.04.14 09:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

[2008.04.14 09:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys

[2008.04.14 01:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ERDNT\cache\agp440.sys

[2008.04.14 01:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys

[2008.04.14 01:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

 
 < MD5 for: ATAPI.SYS  >

[2003.04.02 13:00:00 | 010,180,476 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys

[2008.04.14 09:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2008.04.14 09:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys

[2002.08.29 02:27:50 | 000,086,912 | ---- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys

[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys

[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys

[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys

 
 < MD5 for: EVENTLOG.DLL  >

[2008.04.14 08:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ERDNT\cache\eventlog.dll

[2008.04.14 08:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll

[2008.04.14 08:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll

[2003.04.02 13:00:00 | 000,049,152 | ---- | M] (Microsoft Corporation) MD5=B9358A1FB66CF656328FD8B792B2CCC4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

 
 < MD5 for: IASTOR.SYS  >

[2008.12.08 21:47:30 | 000,327,192 | ---- | M] (Intel Corporation) MD5=8EF427C54497C5F8A7A645990E4278C7 -- C:\Dokumente und Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\SlimWare Utilities Inc\SlimDrivers\Backups\20110805T141725781250\pci\ven_8086&dev_2829&cc_0106\iaStor.sys

[2008.09.12 13:32:56 | 000,327,192 | ---- | M] (Intel Corporation) MD5=8EF427C54497C5F8A7A645990E4278C7 -- C:\drivers\kdrv0\IaStor.sys

[2008.12.08 21:47:30 | 000,327,192 | ---- | M] (Intel Corporation) MD5=8EF427C54497C5F8A7A645990E4278C7 -- C:\WINDOWS\NLDRV\001\iastor.sys

[2008.09.12 13:32:56 | 000,327,192 | ---- | M] (Intel Corporation) MD5=8EF427C54497C5F8A7A645990E4278C7 -- C:\WINDOWS\OEMDIR\iaStor.sys

[2008.12.08 21:47:30 | 000,327,192 | ---- | M] (Intel Corporation) MD5=8EF427C54497C5F8A7A645990E4278C7 -- C:\WINDOWS\system32\drivers\iaStor.sys

 
 < MD5 for: NETLOGON.DLL  >

[2008.04.14 08:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ERDNT\cache\netlogon.dll

[2008.04.14 08:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll

[2008.04.14 08:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll

[2003.04.02 13:00:00 | 000,399,360 | ---- | M] (Microsoft Corporation) MD5=BCA549B21E651111CE7BAD0FC8C45F4B -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

 
 < MD5 for: SCECLI.DLL  >

[2008.04.14 08:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ERDNT\cache\scecli.dll

[2008.04.14 08:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll

[2008.04.14 08:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll

[2003.04.02 13:00:00 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=ADD49C10F5DADFA81912D124FE1C9A99 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2008.04.14 08:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ERDNT\cache\user32.dll

[2008.04.14 08:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll

[2008.04.14 08:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll

[2003.04.02 13:00:00 | 000,561,664 | ---- | M] (Microsoft Corporation) MD5=E3DAFFDB1C86C1AEAC1B205F6CF67009 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.04.14 08:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ERDNT\cache\userinit.exe

[2008.04.14 08:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe

[2008.04.14 08:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe

[2003.04.02 13:00:00 | 000,022,528 | ---- | M] (Microsoft Corporation) MD5=BEBD3F08461F9A88E5ABCE0CB9707000 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2003.04.02 13:00:00 | 000,521,728 | ---- | M] (Microsoft Corporation) MD5=616896B708286DA98D6A099293F181D7 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe

[2012.01.13 15:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2008.04.14 08:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ERDNT\cache\winlogon.exe

[2008.04.14 08:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe

[2008.04.14 08:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2003.04.02 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys

[2003.04.02 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2011.02.15 22:30:46 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav

[2011.02.15 22:30:46 | 000,630,784 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav

[2011.02.15 22:30:46 | 000,425,984 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 <           >
 

< End of report >