Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Rechner hängt minutenlang, temporär extrem langsam, hohe cpu-Auslastung (https://www.trojaner-board.de/118325-rechner-haengt-minutenlang-temporaer-extrem-langsam-hohe-cpu-auslastung.html)

dipl ingwer 25.07.2012 07:40
Eigentlich gab es in letzter Zeit keine anderen Nutzer an diesem Rechner, auch der ADMIN war nicht dran.

Code:

# AdwCleaner v1.703 - Logfile created 07/25/2012 at 08:33:51
# Updated 20/07/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Admin - sdd_LAPTOP
# Running from : C:\Dokumente und Einstellungen\Admin\Eigene Dateien\Downloads\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****

Key Found : HKCU\Software\AppDataLow\Software\pdfforge
Key Found : HKCU\Software\AppDataLow\Software\Search Settings
Key Found : HKCU\Software\pdfforge.org

***** [Registre - GUID] *****

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FE063DB1-4EC0-403E-8DD8-394C54984B2C}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [7830 octets] - [23/07/2012 16:38:38]
AdwCleaner[S1].txt - [8062 octets] - [24/07/2012 10:20:17]
AdwCleaner[R2].txt - [1293 octets] - [25/07/2012 08:33:51]

########## EOF - C:\AdwCleaner[R2].txt - [1421 octets] ##########
Einen guten Tag und nochmals ein Zwischen-Danke!

cosinus 25.07.2012 11:19
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S2].txt.

dipl ingwer 25.07.2012 12:45
Code:
# AdwCleaner v1.703 - Logfile created 07/25/2012 at 13:21:14
# Updated 20/07/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Admin - sdd_LAPTOP
# Running from : C:\Dokumente und Einstellungen\Admin\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\pdfforge
Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings
Key Deleted : HKCU\Software\pdfforge.org

***** [Registre - GUID] *****

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FE063DB1-4EC0-403E-8DD8-394C54984B2C}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [7830 octets] - [23/07/2012 16:38:38]
AdwCleaner[S1].txt - [8062 octets] - [24/07/2012 10:20:17]
AdwCleaner[R2].txt - [1422 octets] - [25/07/2012 08:33:51]
AdwCleaner[R3].txt - [859 octets] - [25/07/2012 09:04:49]
AdwCleaner[S2].txt - [1409 octets] - [25/07/2012 13:21:14]

########## EOF - C:\AdwCleaner[S2].txt - [1537 octets] ##########

cosinus 25.07.2012 13:23
Systempartition nach NTFS konvertieren
  1. Start, Ausführen, cmd eintippen und ok

  2. Diesen Befehl eintippen und mit der Eingabetaste ausführen => convert %systemdrive% /fs:ntfs

  3. Die aktuelle Bezeichnung der Systempartition (idR ist das C: ) eintippen (siehst Du im Arbeitsplatz - wenn "Lokaler Datenträger" da nur steht hat die Systempartition keine Bezeichnung also nichts eintippen bei aktueller Laufwerksbezeichnung) - notfalls einen einfachen Namen für diese Partition vergeben im Arbeitsplatz über Rechtsklick => Eigenschaften und diesen dann eintippen bei der Abfrage

  4. Bestätigen, dass das Laufwerk für den exklusiven Zugriff gesperrt werden muss mit J

  5. Hinweis, dass das Laufwerk beim nächsten Windows-Start konvertiert werden soll mit J bestätigen und Windows neu starten, geduldig sein, denn das Konvertieren dauertn einen Moment!



Mach ein neues OTL-Log wenn Windows mit der Konvertierung durch ist.
Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

dipl ingwer 25.07.2012 13:23
Hallo Cosinus, ein Nachtrag:

Der Rechner fährt nach wie vor sehr langsam hoch, bis der Taskmanager und Programme gestartet werden können, dauert es etwa 10 Minuten.

Seltsamerweise geht übrigens, seitdem die Probleme bestehen, nach dem langsamen Windows-Start immer der Datei-Explorer auf und zeigt den Pfad C:\Programme\ATI\CIM an, obwohl dies vorher nicht automatisch passierte und ich es auch nicht bewusst geändert habe.

Keine Ahnung, warum das so ist und ob das was zu bedeuten hat...

Läuft der Rechner erst ein Mal und sind die Programme wie Outlook oder Firefox gestartet, geht alles ganz ordentlich. CPU Auslastung auf beiden Prozessoren okay, auch wenn es kurzzeitig auf dem einen Prozessor hin und wieder mal auf über 30 oder gar 50 % hochschnellt.

Konvertiert wurde, danach ge-otl-t.
Tja, mir fällt dazu mal wieder nichts ein...

OTL Logfile:
Code:
OTL logfile created on: 25.07.2012 20:03:25 - Run 4
OTL by OldTimer - Version 3.2.54.1    Folder = C:\Dokumente und Einstellungen\ingwer\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
895,20 Mb Total Physical Memory | 570,16 Mb Available Physical Memory | 63,69% Memory free
2,12 Gb Paging File | 1,69 Gb Available in Paging File | 79,62% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 44,71 Gb Total Space | 6,58 Gb Free Space | 14,71% Space Free | Partition Type: NTFS
Drive D: | 67,07 Gb Total Space | 11,99 Gb Free Space | 17,88% Space Free | Partition Type: NTFS
Drive F: | 1397,26 Gb Total Space | 156,60 Gb Free Space | 11,21% Space Free | Partition Type: NTFS
Drive G: | 931,51 Gb Total Space | 53,05 Gb Free Space | 5,70% Space Free | Partition Type: NTFS
 
Computer Name: sdd_LAPTOP | User Name: ingwer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.24 21:54:22 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\ingwer\Desktop\OTL.exe
PRC - [2012.05.08 20:04:00 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 20:03:58 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 20:03:58 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 20:03:58 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.05.04 19:29:46 | 000,161,664 | ---- | M] (Oracle Corporation) -- C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
PRC - [2012.01.17 11:07:54 | 000,252,296 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2010.03.04 23:38:00 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe
PRC - [2008.04.14 03:22:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.02.25 21:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2006.08.07 13:11:00 | 000,573,440 | ---- | M] (Motorola Inc.) -- C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe
PRC - [2003.09.16 15:50:18 | 000,061,440 | ---- | M] (KYOCERA MITA CORPORATION) -- C:\Programme\Kyocera\FileUtility\SFUSVC.exe
PRC - [2002.12.16 16:51:24 | 000,036,864 | ---- | M] (Hewlett-Packard) -- C:\Programme\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.05.08 20:04:00 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2012.04.04 07:53:56 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
MOD - [2010.03.04 23:38:00 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe
MOD - [2009.06.03 19:00:42 | 000,200,704 | ---- | M] () -- C:\Programme\ImageConverter Plus\gpgate.dll
MOD - [2009.06.03 18:45:16 | 001,179,648 | ---- | M] () -- C:\Programme\ImageConverter Plus\fcrtl.dll
MOD - [2005.01.06 18:33:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\redmonnt.dll
MOD - [2003.08.29 10:24:06 | 000,094,274 | ---- | M] () -- C:\WINDOWS\system32\HPBHEALR.DLL
MOD - [2001.10.28 17:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.07.19 17:27:08 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.19 10:49:22 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.05.08 20:04:00 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 20:03:58 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.04 19:29:46 | 000,161,664 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010.03.04 23:38:00 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccess)
SRV - [2008.05.02 02:42:06 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2007.06.28 11:31:38 | 000,079,136 | ---- | M] (Hewlett-Packard Company) [Disabled | Stopped] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2007.06.01 10:21:30 | 000,271,920 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2007.02.25 21:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2004.01.05 11:44:28 | 000,065,795 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\hpzipm12.exe -- (Pml Driver HPZ12)
SRV - [2003.09.16 15:50:18 | 000,061,440 | ---- | M] (KYOCERA MITA CORPORATION) [Auto | Running] -- C:\Programme\Kyocera\FileUtility\SFUSVC.exe -- (SFUSVC)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (Tosrfcom)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\sunkfiltp.sys -- (Sunkfiltp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\sunkfilt6.sys -- (SunkFilt6)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Hot CPU Tester Pro 4 LE\SysInfo.sys -- (7ByteIo)
DRV - [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.05.08 20:04:00 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 20:04:00 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.04.23 13:39:54 | 000,043,488 | ---- | M] (Oak Technology Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\AFS2K.SYS -- (AFS2K)
DRV - [2011.10.11 15:00:02 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 15:14:28 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.11.12 14:48:56 | 000,005,504 | ---- | M] () [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2008.04.13 19:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2008.02.29 03:13:24 | 000,036,880 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2008.02.29 03:13:16 | 000,035,344 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2007.10.26 02:20:36 | 000,549,184 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211)
DRV - [2007.08.24 11:46:48 | 000,005,760 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2007.07.04 22:55:40 | 002,304,000 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2007.01.24 18:08:40 | 000,005,632 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\kbfiltr.sys -- (kbfiltr)
DRV - [2006.12.14 16:44:06 | 000,085,120 | R--- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2006.11.03 09:32:30 | 004,394,496 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService)
DRV - [2006.08.07 13:13:00 | 000,980,608 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial)
DRV - [2005.07.14 12:14:34 | 000,027,904 | ---- | M] (REDC) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\risdptsk.sys -- (risdptsk)
DRV - [2005.07.12 19:00:30 | 000,051,328 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2004.08.04 12:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2004.08.04 12:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)
DRV - [2004.08.03 22:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139)
DRV - [2004.07.23 14:55:50 | 000,046,536 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sunkfilt62.sys -- (SunkFilt62)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes,DefaultScope = {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes\{31CF9EBE-5755-4a1d-AC25-2834D952D9B4}: "URL" = hxxp://search.pdfcreator-toolbar.org/search?p=Q&ts=ne&w={searchTerms}&csrc=search-field
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes\{B7306BAC-00CC-4318-96FE-26FDD56FCAF7}: "URL" = hxxp://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms}
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes\{BDD3C6FB-37A8-4753-A59C-DB89B6B28E61}: "URL" = hxxp://www.berlinonline.de/berliner-zeitung/archiv/.bin/index.fcgi?q={searchTerms}
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes\{C37E2250-61E7-4DEC-ACD7-9EC8DB64D8CC}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=827316&p={searchTerms}
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes\{CE628715-3D4D-4D12-A846-76E20CF91D4B}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes\{E88E0043-C9D4-4e33-8555-FEE4F5B63060}: "URL" = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.77
FF - prefs.js..extensions.enabledItems: en-US@dictionaries.addons.mozilla.org:4.0.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.12.2.16749
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.736
FF - prefs.js..network.proxy.type: 4
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Ask.com"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&SearchSource=3&q={searchTerms}"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "about:home"
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2008.02.08 21:04:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2008.02.08 21:04:46 | 000,000,000 | ---D | M]
 
[2008.09.16 12:52:24 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Extensions
[2012.07.25 16:10:11 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\extensions
[2012.06.28 15:57:50 | 000,000,000 | ---D | M] (IE Tab 2 (FF 3.6+)) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
[2012.01.21 16:18:10 | 000,000,000 | ---D | M] (Vuze Remote Community Toolbar) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2012.06.28 13:41:18 | 000,000,000 | ---D | M] (Bitdefender QuickScan) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011.07.17 19:16:44 | 000,000,000 | ---D | M] (British English Dictionary) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\extensions\en-GB@dictionaries.addons.mozilla.org
[2012.05.19 11:01:52 | 000,000,000 | ---D | M] (United States English Spellchecker) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\extensions\en-US@dictionaries.addons.mozilla.org
[2012.07.25 16:10:11 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\extensions\staged
[2011.07.16 11:48:10 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.05.11 16:41:46 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ingwer\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HFFFQQ59.DEFAULT\EXTENSIONS\{1BC9BA34-1EED-42CA-A505-6D2F1A935BBB}
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ingwer\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HFFFQQ59.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ingwer\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HFFFQQ59.DEFAULT\EXTENSIONS\{E001C731-5E37-4538-A5CB-8168736A2360}
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ingwer\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HFFFQQ59.DEFAULT\EXTENSIONS\EN-GB@DICTIONARIES.ADDONS.MOZILLA.ORG
[2012.07.19 17:27:28 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.06.20 12:58:34 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.20 12:58:34 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.06.20 12:58:34 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.20 12:58:34 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.20 12:58:34 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.20 12:58:34 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.07.03 13:02:58 | 000,442,918 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 15216 more lines...
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Programme\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll ()
O3 - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\Toolbar\WebBrowser: (no name) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - No CLSID value found.
O3 - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll ()
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DXDllRegExe] dxdllreg.exe File not found
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [SMSERIAL] C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [StatusClient] C:\Programme\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe (Hewlett-Packard)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TomcatStartup] C:\Programme\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe (Hewlett-Packard)
O4 - Startup: C:\Dokumente und Einstellungen\Admin\Startmenü\Programme\Autostart\OpenOffice.org 2.3.lnk =  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1645522239-492894223-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Download by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} hxxp://download.bitdefender.com/resources/scan8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} hxxp://support.f-secure.com/ols/fscax.cab (F-Secure Online Scanner 3.3)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0E0E5112-412A-4DE7-A790-4C20ECD9D335}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Programme\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\programme\gemeinsame dateien\logitech\bluetooth\LBTWlgn.dll) - c:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.04.18 20:28:40 | 000,000,641 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011.07.29 19:34:15 | 000,000,000 | RH-D | M] - F:\autorun -- [ NTFS ]
O32 - Unable to obtain root file information for disk F:\
O33 - MountPoints2\{f935f2cb-4f35-11dd-8a5a-0015af664f0e}\Shell - "" = AutoRun
O33 - MountPoints2\{f935f2cb-4f35-11dd-8a5a-0015af664f0e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f935f2cb-4f35-11dd-8a5a-0015af664f0e}\Shell\AutoRun\command - "" = F:\LaunchU3.exe
O34 - HKLM BootExecute: (autocheck autochk /r \??\G:)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - Services: "Apple Mobile Device"
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^HP Digital Imaging Monitor.lnk - C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe - (Hewlett-Packard Co.)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^HP Image Zone Schnellstart.lnk - C:\Programme\HP\Digital Imaging\bin\hpqthb08.exe - (Hewlett-Packard Co.)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^SkyMonk.lnk -  - File not found
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^ingwer^Startmenü^Programme^Autostart^OpenOffice.org 3.1.lnk - C:\Programme\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig - StartUpReg: Sunkist2k - hkey= - key= - C:\Programme\Multimedia Card Reader\shwicon2k.exe (Alcor Micro, Corp.)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: WdfLoadGroup -
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: nm -  File not found
SafeBootNet: nm.sys -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: WdfLoadGroup -
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Programme\Gemeinsame Dateien\LightScribe\LSRunOnce.exe"
ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9309DD7E-EBFE-3C95-8B47-30D3A012F606} - .NET Framework
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C3C986D6-06B1-43BF-90DD-BE30756C00DE} - RevokedRootsUpdate
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.ac3filter - C:\WINDOWS\System32\ac3filter.acm ()
Drivers32: msacm.avis - C:\WINDOWS\System32\ff_acm.acm ()
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.I420 - C:\WINDOWS\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.LEAD - LCODCCMP.DLL File not found
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.25 13:18:42 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\ingwer\Recent
[2012.07.20 14:05:45 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.07.20 12:30:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.07.20 12:30:12 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.07.20 12:30:12 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.07.19 09:29:30 | 000,000,000 | ---D | C] -- C:\Programme\Overland
[2012.07.06 07:29:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\.elfohilfe
[2012.07.04 11:50:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ingwer\Desktop\1207 logs
[2012.07.04 10:14:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ingwer\Eigene Dateien\eMule Downloads
[2012.07.02 14:45:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Malwarebytes
[2012.07.02 14:43:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.07.02 11:08:29 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\ingwer\Desktop\OTL.exe
[2012.07.02 10:45:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ingwer\Startmenü\Programme\HiJackThis
[2012.07.02 10:45:07 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2012.07.01 01:28:02 | 000,000,000 | ---D | C] -- C:\Programme\gmer
[2012.06.30 23:49:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Advanced Task Manager
[2012.06.30 23:49:26 | 000,000,000 | ---D | C] -- C:\Programme\Innovative Solutions
[2012.06.29 16:24:15 | 000,000,000 | ---D | C] -- C:\Programme\Oracle
[2012.06.29 13:24:50 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2012.06.28 19:04:07 | 000,000,000 | ---D | C] -- C:\ProcessExplorer_152
[2012.06.27 16:27:38 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\ingwer\Startmenü\Programme\Verwaltung
[2012.06.27 14:26:10 | 000,000,000 | ---D | C] -- C:\Programme\Hot CPU Tester Pro 4 LE
[2010.08.21 15:10:02 | 000,429,123 | ---- | C] (Sillysot Software                                          ) -- C:\Programme\setup-Iconoid-x86.exe
[2008.03.26 12:45:00 | 023,344,432 | ---- | C] (Apple Inc.) -- C:\Programme\QuickTimeInstaller.exe
[2006.02.22 17:30:04 | 000,405,504 | ---- | C] (cyberLAB GmbH) -- C:\Programme\zinsrechner.exe
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[12 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.25 19:59:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.25 19:48:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.07.25 15:42:14 | 000,013,678 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.07.25 15:35:29 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.25 15:35:28 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job
[2012.07.25 15:33:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.07.24 21:54:22 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\ingwer\Desktop\OTL.exe
[2012.07.24 19:28:06 | 000,051,712 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.24 18:54:56 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2012.07.23 16:37:58 | 000,632,049 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\adwcleaner.exe
[2012.07.20 12:30:26 | 000,000,671 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.20 04:03:36 | 000,358,544 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.07.05 19:10:26 | 000,032,285 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Microsoft Office Outlook - Memoformat.pdf
[2012.07.05 12:16:20 | 000,002,433 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\HiJackThis.lnk
[2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.07.02 11:07:36 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Defogger.exe
[2012.07.02 09:29:34 | 000,002,477 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Microsoft Word.lnk
[2012.07.02 08:34:24 | 000,000,266 | -HS- | M] () -- C:\boot.ini
[2012.07.01 01:41:04 | 000,000,747 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Verknüpfung mit hpqthb08.exe (wenn Scannen mit 5510).lnk
[2012.06.30 23:49:34 | 000,000,710 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Advanced Task Manager.lnk
[2012.06.29 16:18:14 | 000,000,002 | ---- | M] () -- C:\WINDOWS\System32\TempWmicBatchFile.bat
[2012.06.28 19:17:16 | 000,000,507 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Verknüpfung mit procexp.exe.lnk
[2012.06.28 15:27:34 | 000,282,215 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\census.cache
[2012.06.28 15:07:10 | 000,234,801 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\ars.cache
[2012.06.28 13:49:46 | 000,000,036 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\housecall.guid.cache
[2012.06.27 21:23:40 | 000,463,144 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.06.27 21:23:38 | 000,444,506 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.06.27 21:23:38 | 000,086,308 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.06.27 21:23:38 | 000,072,764 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.06.27 20:15:56 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\rp_stats.dat
[2012.06.27 20:15:56 | 000,000,044 | ---- | M] () -- C:\WINDOWS\System32\rp_rules.dat
[2012.06.27 16:54:00 | 000,029,674 | ---- | M] () -- C:\HCTEJun27-165358.dmp
[2012.06.27 16:52:20 | 000,029,674 | ---- | M] () -- C:\HCTEJun27-165218.dmp
[2012.06.27 16:49:04 | 000,029,674 | ---- | M] () -- C:\HCTEJun27-164902.dmp
[2012.06.27 16:47:42 | 000,029,674 | ---- | M] () -- C:\HCTEJun27-164738.dmp
[2012.06.27 14:26:50 | 000,029,674 | ---- | M] () -- C:\HCTEJun27-142646.dmp
[2012.06.26 19:21:20 | 000,002,607 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Microsoft Office Outlook 2007.lnk
[2012.06.26 13:56:58 | 000,000,569 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[12 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.23 16:38:10 | 000,632,049 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\adwcleaner.exe
[2012.07.20 12:30:25 | 000,000,671 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.05 19:10:16 | 000,032,285 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Microsoft Office Outlook - Memoformat.pdf
[2012.07.03 14:58:07 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2012.07.02 11:08:53 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Defogger.exe
[2012.07.02 10:45:11 | 000,002,433 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\HiJackThis.lnk
[2012.07.01 01:41:02 | 000,000,747 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Verknüpfung mit hpqthb08.exe (wenn Scannen mit 5510).lnk
[2012.06.30 23:49:32 | 000,000,710 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Advanced Task Manager.lnk
[2012.06.29 16:18:00 | 000,000,002 | ---- | C] () -- C:\WINDOWS\System32\TempWmicBatchFile.bat
[2012.06.28 19:17:14 | 000,000,507 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Verknüpfung mit procexp.exe.lnk
[2012.06.28 15:27:33 | 000,282,215 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\census.cache
[2012.06.28 15:07:09 | 000,234,801 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\ars.cache
[2012.06.28 13:49:45 | 000,000,036 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\housecall.guid.cache
[2012.06.27 16:53:58 | 000,029,674 | ---- | C] () -- C:\HCTEJun27-165358.dmp
[2012.06.27 16:52:18 | 000,029,674 | ---- | C] () -- C:\HCTEJun27-165218.dmp
[2012.06.27 16:49:02 | 000,029,674 | ---- | C] () -- C:\HCTEJun27-164902.dmp
[2012.06.27 16:47:38 | 000,029,674 | ---- | C] () -- C:\HCTEJun27-164738.dmp
[2012.06.27 14:26:46 | 000,029,674 | ---- | C] () -- C:\HCTEJun27-142646.dmp
[2012.05.09 20:04:07 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.04.28 21:19:38 | 000,005,504 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2012.04.23 14:04:13 | 000,038,879 | ---- | C] () -- C:\WINDOWS\hpomdl03.dat.temp
[2012.04.23 14:04:13 | 000,029,240 | ---- | C] () -- C:\WINDOWS\hpoins03.dat.temp
[2012.04.23 13:31:16 | 000,565,248 | R--- | C] () -- C:\WINDOWS\System32\hpotscl.dll
[2012.04.23 13:24:36 | 000,038,879 | ---- | C] () -- C:\WINDOWS\hpomdl03.dat
[2012.04.23 13:24:36 | 000,029,240 | ---- | C] () -- C:\WINDOWS\hpoins03.dat
[2012.02.15 04:18:25 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.02.12 15:25:24 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat
[2012.02.12 15:25:24 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat
[2012.02.09 21:10:19 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2012.01.31 15:43:26 | 000,104,152 | ---- | C] () -- C:\WINDOWS\hpoins04.dat.temp
[2012.01.31 15:43:25 | 000,017,176 | ---- | C] () -- C:\WINDOWS\hpomdl04.dat.temp
[2012.01.12 09:39:34 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2012.01.10 10:43:14 | 000,017,990 | ---- | C] () -- C:\WINDOWS\hplj1010.ini
[2012.01.07 13:07:12 | 000,000,105 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2011.12.05 22:04:00 | 000,059,904 | ---- | C] () -- C:\WINDOWS\System32\OpenVideo.dll
[2011.12.05 22:03:52 | 000,054,784 | ---- | C] () -- C:\WINDOWS\System32\OVDecode.dll
[2011.07.16 11:45:29 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2011.07.08 17:14:59 | 000,000,553 | R--- | C] () -- C:\WINDOWS\System32\drivers\AW1012d.ini
[2010.08.21 15:25:02 | 000,206,817 | ---- | C] () -- C:\Programme\source.zip
[2010.01.11 16:06:34 | 000,051,712 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.12.05 03:22:09 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\$_hpcst$.hpc
[2009.08.17 16:52:56 | 000,000,718 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\German
[2008.05.25 21:46:09 | 000,000,874 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\.recently-used.xbel
[2008.05.22 12:04:32 | 000,000,073 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\lxdj
[2008.04.11 14:51:58 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2008.03.28 21:09:27 | 000,014,852 | ---- | C] () -- C:\Programme\settings.dat
[2008.02.19 16:44:53 | 007,844,864 | ---- | C] () -- C:\Programme\setup.msi
[2008.02.19 16:43:47 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\$_hpcst$.hpc
[2006.02.22 17:30:04 | 000,029,702 | ---- | C] () -- C:\Programme\zinsrechner.lib
[2006.02.22 17:30:04 | 000,016,759 | ---- | C] () -- C:\Programme\zinsrechner.exp
[2006.02.08 13:59:26 | 000,015,606 | ---- | C] () -- C:\Programme\berechnung30.dat
[2005.10.27 11:24:08 | 000,002,597 | ---- | C] () -- C:\Programme\PREVIEW.PIX
[2005.06.01 09:56:10 | 000,311,296 | ---- | C] () -- C:\Programme\rmsspecial.dll
[2004.11.25 18:46:32 | 000,006,558 | ---- | C] () -- C:\Programme\berechnung2.dat
[2004.11.25 18:33:42 | 000,007,055 | ---- | C] () -- C:\Programme\berechnung1.dat
 
========== LOP Check ==========
 
[2012.04.28 21:48:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited
[2012.02.01 18:57:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DriverBoost
[2012.06.08 14:52:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular
[2008.04.25 12:58:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LightScribe
[2011.09.22 17:01:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Premium
[2011.07.17 19:36:48 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2012.01.05 10:38:04 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
[2011.07.28 14:46:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Azureus
[2012.04.28 21:48:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Canneverbe Limited
[2012.04.06 11:24:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\DeepBurner
[2012.06.08 14:59:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\elsterformular
[2012.05.08 16:52:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\eMule
[2011.05.25 10:31:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant
[2012.02.08 21:59:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GrabPro
[2011.09.09 21:31:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\OpenOffice.org
[2012.06.06 15:15:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Oracle
[2012.02.08 21:59:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Orbit
[2012.02.08 22:00:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\ProgSense
[2008.03.06 16:28:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Public Sync
[2011.07.15 23:42:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\QuickScan
[2012.01.06 14:03:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\SkyMonk
[2012.01.24 11:31:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Softplicity
[2012.05.12 16:56:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Windows Search
[2011.07.24 19:39:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\TuneUp Software
[2012.01.06 14:03:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\{DCD48218-E972-4d0c-9E5F-43462BC13E3B}
[2012.07.25 15:35:28 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\OGALogon.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
[2009.10.05 14:41:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Application Data\Office Genuine Advantage
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2008.02.11 18:55:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Adobe
[2008.04.25 12:58:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Ahead
[2008.08.19 18:55:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Apple Computer
[2008.02.08 22:18:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\ATI
[2011.10.25 18:34:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Avira
[2011.07.28 14:46:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Azureus
[2012.04.28 21:48:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Canneverbe Limited
[2008.02.14 13:08:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\CyberLink
[2012.04.06 11:24:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\DeepBurner
[2010.01.12 20:42:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\DivX
[2012.02.01 19:49:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Download Manager
[2009.12.04 14:59:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\dvdcss
[2012.06.08 14:59:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\elsterformular
[2012.05.08 16:52:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\eMule
[2012.03.25 12:54:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Google
[2011.05.25 10:31:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant
[2012.02.08 21:59:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GrabPro
[2008.02.19 17:50:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Help
[2008.02.08 18:19:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Identities
[2008.02.08 21:22:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\InstallShield
[2008.12.10 17:59:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Logitech
[2008.03.03 14:46:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Macromedia
[2012.07.02 14:45:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Malwarebytes
[2011.12.01 16:06:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Media Player Classic
[2008.02.09 00:59:56 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft
[2008.02.11 11:20:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft Web Folders
[2008.02.08 21:05:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla
[2011.09.09 21:31:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\OpenOffice.org
[2008.04.08 13:53:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\OpenOffice.org2
[2012.06.06 15:15:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Oracle
[2012.02.08 21:59:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Orbit
[2012.02.08 22:00:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\ProgSense
[2008.03.06 16:28:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Public Sync
[2011.07.15 23:42:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\QuickScan
[2008.02.20 15:25:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Real
[2012.01.06 14:03:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\SkyMonk
[2012.01.24 11:31:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Softplicity
[2008.02.08 21:14:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Sun
[2010.03.16 15:32:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\vlc
[2012.05.12 16:56:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Windows Search
[2011.07.28 12:49:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\WinRAR
 
< %APPDATA%\*.exe /s >
[2008.06.15 17:38:02 | 022,319,360 | ---- | M] (                                  ) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Adobe\Acrobat\7.0\Updater\AdbeRdr710_de_DE.exe
[2011.07.28 14:47:48 | 000,310,208 | ---- | M] (Georgia Institute of Technology) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Azureus\plugins\mlab\ShaperProbeC.exe
[2011.05.25 11:10:30 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\203D0797-F03A-40D3-9324-E1AF28B7527E\AutoRunCE.exe
[2011.05.25 11:10:34 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\203D0797-F03A-40D3-9324-E1AF28B7527E\1\module.exe
[2011.05.25 11:11:06 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\2FCA7F6D-CE82-47A5-ACFD-E138027994CE\AutoRunCE.exe
[2011.05.25 11:11:06 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\2FCA7F6D-CE82-47A5-ACFD-E138027994CE\1\module.exe
[2011.05.25 11:09:58 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\36643127-6565-4DAD-8B23-472DCA5DB2E7\AutoRunCE.exe
[2011.05.25 11:10:02 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\36643127-6565-4DAD-8B23-472DCA5DB2E7\1\module.exe
[2011.05.25 11:09:54 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\5F85F081-70A4-4FE8-AD4A-82FE0E3BD6EB\AutoRunCE.exe
[2011.05.25 11:09:58 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\5F85F081-70A4-4FE8-AD4A-82FE0E3BD6EB\1\module.exe
[2011.05.25 11:10:24 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\5FD8A8C3-067B-47B1-90EF-331BF3B884B6\AutoRunCE.exe
[2011.05.25 11:10:24 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\5FD8A8C3-067B-47B1-90EF-331BF3B884B6\1\module.exe
[2011.05.25 11:10:06 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\64A8BC77-053A-4B85-8955-C4798D7C2919\AutoRunCE.exe
[2011.05.25 11:10:10 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\64A8BC77-053A-4B85-8955-C4798D7C2919\1\module.exe
[2011.05.25 11:10:40 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\7C1B17F3-92D4-4B3E-AD00-AE6F2490AFE3\AutoRunCE.exe
[2011.05.25 11:10:42 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\7C1B17F3-92D4-4B3E-AD00-AE6F2490AFE3\1\module.exe
[2011.05.25 11:10:44 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\7D5313F0-159F-410B-BC37-8231D6229802\AutoRunCE.exe
[2011.05.25 11:10:48 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\7D5313F0-159F-410B-BC37-8231D6229802\1\module.exe
[2011.05.25 11:10:52 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\8B4455EC-62EC-456C-98FC-5068814AC27E\AutoRunCE.exe
[2011.05.25 11:10:56 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\8B4455EC-62EC-456C-98FC-5068814AC27E\1\module.exe
[2011.05.25 11:10:02 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\8C715C64-E4A6-411B-8AD6-06D7766709E3\AutoRunCE.exe
[2011.05.25 11:10:04 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\8C715C64-E4A6-411B-8AD6-06D7766709E3\1\module.exe
[2011.05.25 11:10:26 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\9B90CA39-537D-455A-A57C-577A518BB2FD\AutoRunCE.exe
[2011.05.25 11:10:28 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\9B90CA39-537D-455A-A57C-577A518BB2FD\1\module.exe
[2011.05.25 11:10:56 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\A24E85D0-DF41-4482-B935-D92E4C2F2D9E\AutoRunCE.exe
[2011.05.25 11:11:00 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\A24E85D0-DF41-4482-B935-D92E4C2F2D9E\1\module.exe
[2011.05.25 11:08:56 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\AD9D1FDD-07C4-44C8-A2D7-BB1ADA5CCEF0\AutoRunCE.exe
[2011.05.25 11:09:40 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\AD9D1FDD-07C4-44C8-A2D7-BB1ADA5CCEF0\1\module.exe
[2011.05.25 11:11:02 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\B8A1D272-FA91-49FB-8FB9-163DC6393203\AutoRunCE.exe
[2011.05.25 11:11:04 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\B8A1D272-FA91-49FB-8FB9-163DC6393203\1\module.exe
[2011.05.25 11:10:14 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\BABBE73B-6E64-4C09-8466-FD7ACC47675C\AutoRunCE.exe
[2011.05.25 11:10:16 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\BABBE73B-6E64-4C09-8466-FD7ACC47675C\1\module.exe
[2011.05.25 11:09:44 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\C43538A4-6DD3-4107-B6AA-50D43FEF9098\AutoRunCE.exe
[2011.05.25 11:09:48 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\C43538A4-6DD3-4107-B6AA-50D43FEF9098\1\module.exe
[2011.05.25 11:10:34 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\C4E92961-B71A-4037-88BD-1404E10B52E8\AutoRunCE.exe
[2011.05.25 11:10:38 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\C4E92961-B71A-4037-88BD-1404E10B52E8\1\module.exe
[2011.05.25 11:10:18 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\E01AA5A6-8676-4907-BEB7-B6C3EBCB5AA0\AutoRunCE.exe
[2011.05.25 11:10:22 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\E01AA5A6-8676-4907-BEB7-B6C3EBCB5AA0\1\module.exe
[2011.05.25 11:09:50 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\F61B692E-3F66-4859-AA1B-74791C02F677\AutoRunCE.exe
[2011.05.25 11:09:52 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\F61B692E-3F66-4859-AA1B-74791C02F677\1\module.exe
[2008.02.08 22:05:40 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{0AD37499-3D5D-12F0-EBEA-46EE9AD02DBF}\ARPPRODUCTICON.exe
[2008.02.08 22:06:06 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{174D7CC5-1117-29D3-8422-2E54ADF7DB5D}\ARPPRODUCTICON.exe
[2008.02.08 22:07:40 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{23894154-0961-CD0A-BAC0-67E6E96165C3}\ARPPRODUCTICON.exe
[2008.02.08 22:07:22 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{24DFAAD6-E1ED-F588-2AD5-2EA4FE9113AE}\ARPPRODUCTICON.exe
[2008.02.08 22:07:18 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{26886987-D038-7438-8DF2-ED3B1888E052}\ARPPRODUCTICON.exe
[2008.02.08 22:05:44 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{2C6D0ACD-DD2B-BFE5-A005-53AFD4AA3175}\ARPPRODUCTICON.exe
[2008.02.08 22:05:52 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{2D50DC1F-FCEC-D970-1DFB-E73CF2404451}\ARPPRODUCTICON.exe
[2008.02.08 22:07:38 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{306682DE-BB8E-CD56-9F6B-DE209469418A}\ARPPRODUCTICON.exe
[2009.02.17 16:19:56 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{3101CB58-3482-4D21-AF1A-7057FC935355}\ARPPRODUCTICON.exe
[2008.02.08 22:07:32 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{310477AD-884B-736D-B2C8-7BE9433B243D}\ARPPRODUCTICON.exe
[2008.02.08 22:07:00 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{31814F2E-FA58-AFE8-DC97-3BD97F7191C2}\ARPPRODUCTICON.exe
[2008.02.08 22:06:58 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{354F7470-D8E3-95D0-3488-B9E32D5E9636}\ARPPRODUCTICON.exe
[2008.02.08 22:05:56 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{380FAC97-C47F-C5A9-2A51-DFF8DE144B37}\ARPPRODUCTICON.exe
[2008.12.10 18:04:54 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
[2008.02.08 22:07:26 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{407A5080-4B1C-A43D-9EED-A3B5EDBCF593}\ARPPRODUCTICON.exe
[2012.01.10 18:21:26 | 000,045,056 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{457791C5-D702-4143-A7B2-2744BE9573F2}\NewShortcut1_5B69D3033CA54B39B5ECE7D051297E77.exe
[2012.07.02 10:45:38 | 000,388,096 | R--- | M] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
[2008.02.08 22:06:16 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{46FE06BF-2A08-9D00-ABFD-7F967817E275}\ARPPRODUCTICON.exe
[2008.02.08 22:05:16 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{4B50D80D-A482-DECD-B584-EB054EBA878A}\ARPPRODUCTICON.exe
[2008.02.08 22:06:04 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{5ABA84ED-D61B-257F-809F-A8C883865854}\ARPPRODUCTICON.exe
[2008.02.08 22:05:48 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{5B464CAC-76BD-BDBB-8066-318D05D171DF}\ARPPRODUCTICON.exe
[2008.02.08 22:06:08 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{5C7332EA-BFB9-24A0-BDD9-254F4B113E41}\ARPPRODUCTICON.exe
[2008.02.08 22:06:30 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{66B5F542-952C-F50D-BFF3-BCA582B65860}\ARPPRODUCTICON.exe
[2008.02.08 22:07:20 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{67213BA8-70C6-458D-9B64-4B93FB35E84B}\ARPPRODUCTICON.exe
[2008.02.08 22:07:26 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{6AA66ACB-E93C-C7CD-F303-D473AEC8A43E}\ARPPRODUCTICON.exe
[2008.02.08 22:05:58 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{6D5DC54D-B06E-32A8-A5D9-4978D7A75FA1}\ARPPRODUCTICON.exe
[2008.02.08 22:07:06 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{782BC438-2C73-77F4-F5B6-7ADC87F611BB}\ARPPRODUCTICON.exe
[2008.02.08 22:07:24 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{7BBA76B4-CC34-0AAB-6D48-BE0181E20832}\ARPPRODUCTICON.exe
[2008.02.08 22:06:14 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{7F311276-1CD6-1661-8BAE-DD9016FE9B8D}\ARPPRODUCTICON.exe
[2008.02.08 22:05:42 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{84C89CF4-F64E-6820-375C-24963DDF99C9}\ARPPRODUCTICON.exe
[2008.02.08 22:07:20 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{8C0D145D-EB41-E1DB-6250-0146B02CBA3A}\ARPPRODUCTICON.exe
[2008.02.08 22:07:14 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{8F5D6849-1A7E-B0B2-F1DE-C0FF21F9E78C}\ARPPRODUCTICON.exe
[2008.02.08 22:06:12 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{944DA8EF-FD4E-1FD9-D88A-B22D78913BE6}\ARPPRODUCTICON.exe
[2008.02.08 22:05:50 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{97F5E039-D2F5-18C0-F0C9-6981F73514CC}\ARPPRODUCTICON.exe
[2008.02.08 22:07:02 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{A35D49A6-F3CF-87AA-6FF1-777D8A06BAB1}\ARPPRODUCTICON.exe
[2008.02.08 22:06:46 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{B2CEACB9-7690-30B5-D80A-B138DB4F0E37}\ARPPRODUCTICON.exe
[2008.02.08 22:07:30 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{D26970AA-C66F-142F-7C66-A73FC3546F57}\ARPPRODUCTICON.exe
[2008.02.08 22:06:24 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{D88DB576-0989-879A-38B1-7ED6224B2F52}\ARPPRODUCTICON.exe
[2008.02.08 22:06:56 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{D8B87EBC-12C2-D4FC-F085-A062D4906216}\ARPPRODUCTICON.exe
[2008.02.08 22:07:08 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{E2A05D36-56EF-84FC-E7D7-090D6E5F09BC}\ARPPRODUCTICON.exe
[2008.02.08 22:06:00 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{E4DA4D2C-F57F-782E-752E-9286E5713297}\ARPPRODUCTICON.exe
[2008.02.08 22:07:28 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{E4E118EF-5286-915B-7DBD-D931AB9AF200}\ARPPRODUCTICON.exe
[2008.02.08 22:07:40 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{E5B85BE7-55B5-0A14-7634-FEF92BCB87FB}\ARPPRODUCTICON.exe
[2008.02.08 22:06:34 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{F384BD83-C317-94DA-A4AB-3E75E43F4F8C}\ARPPRODUCTICON.exe
[2008.02.08 22:07:34 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{F622BE4A-363F-F2B6-1F98-54E5E99B1750}\ARPPRODUCTICON.exe
[2008.02.08 22:06:50 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{F6D39840-BB27-A191-BDF2-1841CA805D24}\ARPPRODUCTICON.exe
[2010.03.06 11:51:58 | 000,443,912 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Real\Update\setup3.10\setup.exe
[2010.03.06 19:52:46 | 010,309,448 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Real\Update\setup3.10\chr\ChromeInstaller.exe
[2010.03.06 19:52:50 | 000,149,000 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Real\Update\setup3.10\chr_helper\LaunchHelper.exe
[2010.03.06 19:53:20 | 008,405,312 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Real\Update\setup3.10\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
[2010.03.06 19:54:24 | 021,292,528 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Real\Update\setup3.10\rp\RealPlayerSPGold_de.exe
[2010.03.06 19:52:08 | 000,079,368 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Real\Update\setup3.10\RUP\vista.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2004.08.04 12:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008.11.04 14:10:44 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008.11.04 14:10:44 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.11.04 14:10:44 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\sp3.cab:AGP440.sys
[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\agp440.sys
[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004.08.04 12:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008.11.04 14:10:44 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.11.04 14:10:44 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.11.04 14:10:44 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\sp3.cab:atapi.sys
[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\atapi.sys
[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.04 12:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\eventlog.dll
[2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004.08.04 12:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 03:22:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 03:22:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\netlogon.dll
[2008.04.14 03:22:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004.08.04 12:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 03:22:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 03:22:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\scecli.dll
[2008.04.14 03:22:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004.08.04 12:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2005.03.02 19:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll
[2007.03.08 16:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2005.03.02 19:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2004.08.04 12:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll
[2007.03.08 16:48:40 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2008.04.14 03:22:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 03:22:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\user32.dll
[2008.04.14 03:22:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 03:23:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 03:23:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\userinit.exe
[2008.04.14 03:23:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004.08.04 12:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004.08.04 12:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008.04.14 03:23:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 03:23:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\winlogon.exe
[2008.04.14 03:23:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.04 12:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004.08.04 12:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.02.09 00:38:00 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2008.02.09 00:38:00 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2008.02.09 00:38:00 | 000,442,368 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >
--- --- ---

[/code]

Schönen Abend und kühle Nacht!

dipl ingwer 25.07.2012 20:34
Konvertiert wurde, danach ge-otl-t.
Tja, mir fällt dazu mal wieder nichts ein...

OTL Logfile:
Code:
OTL logfile created on: 25.07.2012 20:03:25 - Run 4
OTL by OldTimer - Version 3.2.54.1    Folder = C:\Dokumente und Einstellungen\ingwer\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
895,20 Mb Total Physical Memory | 570,16 Mb Available Physical Memory | 63,69% Memory free
2,12 Gb Paging File | 1,69 Gb Available in Paging File | 79,62% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 44,71 Gb Total Space | 6,58 Gb Free Space | 14,71% Space Free | Partition Type: NTFS
Drive D: | 67,07 Gb Total Space | 11,99 Gb Free Space | 17,88% Space Free | Partition Type: NTFS
Drive F: | 1397,26 Gb Total Space | 156,60 Gb Free Space | 11,21% Space Free | Partition Type: NTFS
Drive G: | 931,51 Gb Total Space | 53,05 Gb Free Space | 5,70% Space Free | Partition Type: NTFS
 
Computer Name: sdd_LAPTOP | User Name: ingwer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.24 21:54:22 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\ingwer\Desktop\OTL.exe
PRC - [2012.05.08 20:04:00 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 20:03:58 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 20:03:58 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 20:03:58 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.05.04 19:29:46 | 000,161,664 | ---- | M] (Oracle Corporation) -- C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
PRC - [2012.01.17 11:07:54 | 000,252,296 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2010.03.04 23:38:00 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe
PRC - [2008.04.14 03:22:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.02.25 21:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2006.08.07 13:11:00 | 000,573,440 | ---- | M] (Motorola Inc.) -- C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe
PRC - [2003.09.16 15:50:18 | 000,061,440 | ---- | M] (KYOCERA MITA CORPORATION) -- C:\Programme\Kyocera\FileUtility\SFUSVC.exe
PRC - [2002.12.16 16:51:24 | 000,036,864 | ---- | M] (Hewlett-Packard) -- C:\Programme\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.05.08 20:04:00 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2012.04.04 07:53:56 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
MOD - [2010.03.04 23:38:00 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe
MOD - [2009.06.03 19:00:42 | 000,200,704 | ---- | M] () -- C:\Programme\ImageConverter Plus\gpgate.dll
MOD - [2009.06.03 18:45:16 | 001,179,648 | ---- | M] () -- C:\Programme\ImageConverter Plus\fcrtl.dll
MOD - [2005.01.06 18:33:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\redmonnt.dll
MOD - [2003.08.29 10:24:06 | 000,094,274 | ---- | M] () -- C:\WINDOWS\system32\HPBHEALR.DLL
MOD - [2001.10.28 17:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.07.19 17:27:08 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.19 10:49:22 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.05.08 20:04:00 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 20:03:58 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.04 19:29:46 | 000,161,664 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010.03.04 23:38:00 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccess)
SRV - [2008.05.02 02:42:06 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2007.06.28 11:31:38 | 000,079,136 | ---- | M] (Hewlett-Packard Company) [Disabled | Stopped] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2007.06.01 10:21:30 | 000,271,920 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2007.02.25 21:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2004.01.05 11:44:28 | 000,065,795 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\hpzipm12.exe -- (Pml Driver HPZ12)
SRV - [2003.09.16 15:50:18 | 000,061,440 | ---- | M] (KYOCERA MITA CORPORATION) [Auto | Running] -- C:\Programme\Kyocera\FileUtility\SFUSVC.exe -- (SFUSVC)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (Tosrfcom)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\sunkfiltp.sys -- (Sunkfiltp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\sunkfilt6.sys -- (SunkFilt6)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Hot CPU Tester Pro 4 LE\SysInfo.sys -- (7ByteIo)
DRV - [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.05.08 20:04:00 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 20:04:00 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.04.23 13:39:54 | 000,043,488 | ---- | M] (Oak Technology Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\AFS2K.SYS -- (AFS2K)
DRV - [2011.10.11 15:00:02 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 15:14:28 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.11.12 14:48:56 | 000,005,504 | ---- | M] () [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2008.04.13 19:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2008.02.29 03:13:24 | 000,036,880 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2008.02.29 03:13:16 | 000,035,344 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2007.10.26 02:20:36 | 000,549,184 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211)
DRV - [2007.08.24 11:46:48 | 000,005,760 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2007.07.04 22:55:40 | 002,304,000 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2007.01.24 18:08:40 | 000,005,632 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\kbfiltr.sys -- (kbfiltr)
DRV - [2006.12.14 16:44:06 | 000,085,120 | R--- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2006.11.03 09:32:30 | 004,394,496 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService)
DRV - [2006.08.07 13:13:00 | 000,980,608 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial)
DRV - [2005.07.14 12:14:34 | 000,027,904 | ---- | M] (REDC) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\risdptsk.sys -- (risdptsk)
DRV - [2005.07.12 19:00:30 | 000,051,328 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2004.08.04 12:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2004.08.04 12:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)
DRV - [2004.08.03 22:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139)
DRV - [2004.07.23 14:55:50 | 000,046,536 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sunkfilt62.sys -- (SunkFilt62)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes,DefaultScope = {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes\{31CF9EBE-5755-4a1d-AC25-2834D952D9B4}: "URL" = hxxp://search.pdfcreator-toolbar.org/search?p=Q&ts=ne&w={searchTerms}&csrc=search-field
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes\{B7306BAC-00CC-4318-96FE-26FDD56FCAF7}: "URL" = hxxp://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms}
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes\{BDD3C6FB-37A8-4753-A59C-DB89B6B28E61}: "URL" = hxxp://www.berlinonline.de/berliner-zeitung/archiv/.bin/index.fcgi?q={searchTerms}
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes\{C37E2250-61E7-4DEC-ACD7-9EC8DB64D8CC}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=827316&p={searchTerms}
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes\{CE628715-3D4D-4D12-A846-76E20CF91D4B}: "URL" = hxxp://www.google.com/search?q={searchTerms}&amp;sourceid=ie7&amp;rls=com.microsoft:{language}:{referrer:source}&amp;ie={inputEncoding?}&oe={outputEncoding?}
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes\{E88E0043-C9D4-4e33-8555-FEE4F5B63060}: "URL" = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.77
FF - prefs.js..extensions.enabledItems: en-US@dictionaries.addons.mozilla.org:4.0.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.12.2.16749
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.736
FF - prefs.js..network.proxy.type: 4
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Ask.com"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&SearchSource=3&q={searchTerms}"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "about:home"
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2008.02.08 21:04:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2008.02.08 21:04:46 | 000,000,000 | ---D | M]
 
[2008.09.16 12:52:24 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Extensions
[2012.07.25 16:10:11 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\extensions
[2012.06.28 15:57:50 | 000,000,000 | ---D | M] (IE Tab 2 (FF 3.6+)) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
[2012.01.21 16:18:10 | 000,000,000 | ---D | M] (Vuze Remote Community Toolbar) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2012.06.28 13:41:18 | 000,000,000 | ---D | M] (Bitdefender QuickScan) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011.07.17 19:16:44 | 000,000,000 | ---D | M] (British English Dictionary) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\extensions\en-GB@dictionaries.addons.mozilla.org
[2012.05.19 11:01:52 | 000,000,000 | ---D | M] (United States English Spellchecker) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\extensions\en-US@dictionaries.addons.mozilla.org
[2012.07.25 16:10:11 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\extensions\staged
[2011.07.16 11:48:10 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.05.11 16:41:46 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ingwer\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HFFFQQ59.DEFAULT\EXTENSIONS\{1BC9BA34-1EED-42CA-A505-6D2F1A935BBB}
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ingwer\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HFFFQQ59.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ingwer\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HFFFQQ59.DEFAULT\EXTENSIONS\{E001C731-5E37-4538-A5CB-8168736A2360}
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ingwer\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HFFFQQ59.DEFAULT\EXTENSIONS\EN-GB@DICTIONARIES.ADDONS.MOZILLA.ORG
[2012.07.19 17:27:28 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.06.20 12:58:34 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.20 12:58:34 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.06.20 12:58:34 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.20 12:58:34 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.20 12:58:34 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.20 12:58:34 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.07.03 13:02:58 | 000,442,918 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 15216 more lines...
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Programme\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll ()
O3 - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\Toolbar\WebBrowser: (no name) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - No CLSID value found.
O3 - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll ()
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DXDllRegExe] dxdllreg.exe File not found
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [SMSERIAL] C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [StatusClient] C:\Programme\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe (Hewlett-Packard)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TomcatStartup] C:\Programme\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe (Hewlett-Packard)
O4 - Startup: C:\Dokumente und Einstellungen\Admin\Startmenü\Programme\Autostart\OpenOffice.org 2.3.lnk =  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1645522239-492894223-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Download by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} hxxp://download.bitdefender.com/resources/scan8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} hxxp://support.f-secure.com/ols/fscax.cab (F-Secure Online Scanner 3.3)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0E0E5112-412A-4DE7-A790-4C20ECD9D335}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Programme\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\programme\gemeinsame dateien\logitech\bluetooth\LBTWlgn.dll) - c:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.04.18 20:28:40 | 000,000,641 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011.07.29 19:34:15 | 000,000,000 | RH-D | M] - F:\autorun -- [ NTFS ]
O32 - Unable to obtain root file information for disk F:\
O33 - MountPoints2\{f935f2cb-4f35-11dd-8a5a-0015af664f0e}\Shell - "" = AutoRun
O33 - MountPoints2\{f935f2cb-4f35-11dd-8a5a-0015af664f0e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f935f2cb-4f35-11dd-8a5a-0015af664f0e}\Shell\AutoRun\command - "" = F:\LaunchU3.exe
O34 - HKLM BootExecute: (autocheck autochk /r \??\G:)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - Services: "Apple Mobile Device"
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^HP Digital Imaging Monitor.lnk - C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe - (Hewlett-Packard Co.)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^HP Image Zone Schnellstart.lnk - C:\Programme\HP\Digital Imaging\bin\hpqthb08.exe - (Hewlett-Packard Co.)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^SkyMonk.lnk -  - File not found
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^ingwer^Startmenü^Programme^Autostart^OpenOffice.org 3.1.lnk - C:\Programme\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig - StartUpReg: Sunkist2k - hkey= - key= - C:\Programme\Multimedia Card Reader\shwicon2k.exe (Alcor Micro, Corp.)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: WdfLoadGroup -
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: nm -  File not found
SafeBootNet: nm.sys -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: WdfLoadGroup -
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Programme\Gemeinsame Dateien\LightScribe\LSRunOnce.exe"
ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9309DD7E-EBFE-3C95-8B47-30D3A012F606} - .NET Framework
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C3C986D6-06B1-43BF-90DD-BE30756C00DE} - RevokedRootsUpdate
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.ac3filter - C:\WINDOWS\System32\ac3filter.acm ()
Drivers32: msacm.avis - C:\WINDOWS\System32\ff_acm.acm ()
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.I420 - C:\WINDOWS\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.LEAD - LCODCCMP.DLL File not found
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.25 13:18:42 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\ingwer\Recent
[2012.07.20 14:05:45 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.07.20 12:30:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.07.20 12:30:12 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.07.20 12:30:12 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.07.19 09:29:30 | 000,000,000 | ---D | C] -- C:\Programme\Overland
[2012.07.06 07:29:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\.elfohilfe
[2012.07.04 11:50:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ingwer\Desktop\1207 logs
[2012.07.04 10:14:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ingwer\Eigene Dateien\eMule Downloads
[2012.07.02 14:45:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Malwarebytes
[2012.07.02 14:43:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.07.02 11:08:29 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\ingwer\Desktop\OTL.exe
[2012.07.02 10:45:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ingwer\Startmenü\Programme\HiJackThis
[2012.07.02 10:45:07 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2012.07.01 01:28:02 | 000,000,000 | ---D | C] -- C:\Programme\gmer
[2012.06.30 23:49:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Advanced Task Manager
[2012.06.30 23:49:26 | 000,000,000 | ---D | C] -- C:\Programme\Innovative Solutions
[2012.06.29 16:24:15 | 000,000,000 | ---D | C] -- C:\Programme\Oracle
[2012.06.29 13:24:50 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2012.06.28 19:04:07 | 000,000,000 | ---D | C] -- C:\ProcessExplorer_152
[2012.06.27 16:27:38 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\ingwer\Startmenü\Programme\Verwaltung
[2012.06.27 14:26:10 | 000,000,000 | ---D | C] -- C:\Programme\Hot CPU Tester Pro 4 LE
[2010.08.21 15:10:02 | 000,429,123 | ---- | C] (Sillysot Software                                          ) -- C:\Programme\setup-Iconoid-x86.exe
[2008.03.26 12:45:00 | 023,344,432 | ---- | C] (Apple Inc.) -- C:\Programme\QuickTimeInstaller.exe
[2006.02.22 17:30:04 | 000,405,504 | ---- | C] (cyberLAB GmbH) -- C:\Programme\zinsrechner.exe
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[12 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.25 19:59:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.25 19:48:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.07.25 15:42:14 | 000,013,678 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.07.25 15:35:29 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.25 15:35:28 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job
[2012.07.25 15:33:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.07.24 21:54:22 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\ingwer\Desktop\OTL.exe
[2012.07.24 19:28:06 | 000,051,712 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.24 18:54:56 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2012.07.23 16:37:58 | 000,632,049 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\adwcleaner.exe
[2012.07.20 12:30:26 | 000,000,671 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.20 04:03:36 | 000,358,544 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.07.05 19:10:26 | 000,032,285 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Microsoft Office Outlook - Memoformat.pdf
[2012.07.05 12:16:20 | 000,002,433 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\HiJackThis.lnk
[2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.07.02 11:07:36 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Defogger.exe
[2012.07.02 09:29:34 | 000,002,477 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Microsoft Word.lnk
[2012.07.02 08:34:24 | 000,000,266 | -HS- | M] () -- C:\boot.ini
[2012.07.01 01:41:04 | 000,000,747 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Verknüpfung mit hpqthb08.exe (wenn Scannen mit 5510).lnk
[2012.06.30 23:49:34 | 000,000,710 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Advanced Task Manager.lnk
[2012.06.29 16:18:14 | 000,000,002 | ---- | M] () -- C:\WINDOWS\System32\TempWmicBatchFile.bat
[2012.06.28 19:17:16 | 000,000,507 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Verknüpfung mit procexp.exe.lnk
[2012.06.28 15:27:34 | 000,282,215 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\census.cache
[2012.06.28 15:07:10 | 000,234,801 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\ars.cache
[2012.06.28 13:49:46 | 000,000,036 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\housecall.guid.cache
[2012.06.27 21:23:40 | 000,463,144 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.06.27 21:23:38 | 000,444,506 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.06.27 21:23:38 | 000,086,308 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.06.27 21:23:38 | 000,072,764 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.06.27 20:15:56 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\rp_stats.dat
[2012.06.27 20:15:56 | 000,000,044 | ---- | M] () -- C:\WINDOWS\System32\rp_rules.dat
[2012.06.27 16:54:00 | 000,029,674 | ---- | M] () -- C:\HCTEJun27-165358.dmp
[2012.06.27 16:52:20 | 000,029,674 | ---- | M] () -- C:\HCTEJun27-165218.dmp
[2012.06.27 16:49:04 | 000,029,674 | ---- | M] () -- C:\HCTEJun27-164902.dmp
[2012.06.27 16:47:42 | 000,029,674 | ---- | M] () -- C:\HCTEJun27-164738.dmp
[2012.06.27 14:26:50 | 000,029,674 | ---- | M] () -- C:\HCTEJun27-142646.dmp
[2012.06.26 19:21:20 | 000,002,607 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Microsoft Office Outlook 2007.lnk
[2012.06.26 13:56:58 | 000,000,569 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[12 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.23 16:38:10 | 000,632,049 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\adwcleaner.exe
[2012.07.20 12:30:25 | 000,000,671 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.05 19:10:16 | 000,032,285 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Microsoft Office Outlook - Memoformat.pdf
[2012.07.03 14:58:07 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2012.07.02 11:08:53 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Defogger.exe
[2012.07.02 10:45:11 | 000,002,433 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\HiJackThis.lnk
[2012.07.01 01:41:02 | 000,000,747 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Verknüpfung mit hpqthb08.exe (wenn Scannen mit 5510).lnk
[2012.06.30 23:49:32 | 000,000,710 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Advanced Task Manager.lnk
[2012.06.29 16:18:00 | 000,000,002 | ---- | C] () -- C:\WINDOWS\System32\TempWmicBatchFile.bat
[2012.06.28 19:17:14 | 000,000,507 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Desktop\Verknüpfung mit procexp.exe.lnk
[2012.06.28 15:27:33 | 000,282,215 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\census.cache
[2012.06.28 15:07:09 | 000,234,801 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\ars.cache
[2012.06.28 13:49:45 | 000,000,036 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\housecall.guid.cache
[2012.06.27 16:53:58 | 000,029,674 | ---- | C] () -- C:\HCTEJun27-165358.dmp
[2012.06.27 16:52:18 | 000,029,674 | ---- | C] () -- C:\HCTEJun27-165218.dmp
[2012.06.27 16:49:02 | 000,029,674 | ---- | C] () -- C:\HCTEJun27-164902.dmp
[2012.06.27 16:47:38 | 000,029,674 | ---- | C] () -- C:\HCTEJun27-164738.dmp
[2012.06.27 14:26:46 | 000,029,674 | ---- | C] () -- C:\HCTEJun27-142646.dmp
[2012.05.09 20:04:07 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.04.28 21:19:38 | 000,005,504 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2012.04.23 14:04:13 | 000,038,879 | ---- | C] () -- C:\WINDOWS\hpomdl03.dat.temp
[2012.04.23 14:04:13 | 000,029,240 | ---- | C] () -- C:\WINDOWS\hpoins03.dat.temp
[2012.04.23 13:31:16 | 000,565,248 | R--- | C] () -- C:\WINDOWS\System32\hpotscl.dll
[2012.04.23 13:24:36 | 000,038,879 | ---- | C] () -- C:\WINDOWS\hpomdl03.dat
[2012.04.23 13:24:36 | 000,029,240 | ---- | C] () -- C:\WINDOWS\hpoins03.dat
[2012.02.15 04:18:25 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.02.12 15:25:24 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat
[2012.02.12 15:25:24 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat
[2012.02.09 21:10:19 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2012.01.31 15:43:26 | 000,104,152 | ---- | C] () -- C:\WINDOWS\hpoins04.dat.temp
[2012.01.31 15:43:25 | 000,017,176 | ---- | C] () -- C:\WINDOWS\hpomdl04.dat.temp
[2012.01.12 09:39:34 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2012.01.10 10:43:14 | 000,017,990 | ---- | C] () -- C:\WINDOWS\hplj1010.ini
[2012.01.07 13:07:12 | 000,000,105 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2011.12.05 22:04:00 | 000,059,904 | ---- | C] () -- C:\WINDOWS\System32\OpenVideo.dll
[2011.12.05 22:03:52 | 000,054,784 | ---- | C] () -- C:\WINDOWS\System32\OVDecode.dll
[2011.07.16 11:45:29 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2011.07.08 17:14:59 | 000,000,553 | R--- | C] () -- C:\WINDOWS\System32\drivers\AW1012d.ini
[2010.08.21 15:25:02 | 000,206,817 | ---- | C] () -- C:\Programme\source.zip
[2010.01.11 16:06:34 | 000,051,712 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.12.05 03:22:09 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\$_hpcst$.hpc
[2009.08.17 16:52:56 | 000,000,718 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\German
[2008.05.25 21:46:09 | 000,000,874 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\.recently-used.xbel
[2008.05.22 12:04:32 | 000,000,073 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\lxdj
[2008.04.11 14:51:58 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2008.03.28 21:09:27 | 000,014,852 | ---- | C] () -- C:\Programme\settings.dat
[2008.02.19 16:44:53 | 007,844,864 | ---- | C] () -- C:\Programme\setup.msi
[2008.02.19 16:43:47 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\$_hpcst$.hpc
[2006.02.22 17:30:04 | 000,029,702 | ---- | C] () -- C:\Programme\zinsrechner.lib
[2006.02.22 17:30:04 | 000,016,759 | ---- | C] () -- C:\Programme\zinsrechner.exp
[2006.02.08 13:59:26 | 000,015,606 | ---- | C] () -- C:\Programme\berechnung30.dat
[2005.10.27 11:24:08 | 000,002,597 | ---- | C] () -- C:\Programme\PREVIEW.PIX
[2005.06.01 09:56:10 | 000,311,296 | ---- | C] () -- C:\Programme\rmsspecial.dll
[2004.11.25 18:46:32 | 000,006,558 | ---- | C] () -- C:\Programme\berechnung2.dat
[2004.11.25 18:33:42 | 000,007,055 | ---- | C] () -- C:\Programme\berechnung1.dat
 
========== LOP Check ==========
 
[2012.04.28 21:48:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited
[2012.02.01 18:57:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DriverBoost
[2012.06.08 14:52:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular
[2008.04.25 12:58:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LightScribe
[2011.09.22 17:01:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Premium
[2011.07.17 19:36:48 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2012.01.05 10:38:04 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
[2011.07.28 14:46:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Azureus
[2012.04.28 21:48:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Canneverbe Limited
[2012.04.06 11:24:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\DeepBurner
[2012.06.08 14:59:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\elsterformular
[2012.05.08 16:52:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\eMule
[2011.05.25 10:31:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant
[2012.02.08 21:59:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GrabPro
[2011.09.09 21:31:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\OpenOffice.org
[2012.06.06 15:15:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Oracle
[2012.02.08 21:59:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Orbit
[2012.02.08 22:00:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\ProgSense
[2008.03.06 16:28:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Public Sync
[2011.07.15 23:42:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\QuickScan
[2012.01.06 14:03:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\SkyMonk
[2012.01.24 11:31:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Softplicity
[2012.05.12 16:56:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Windows Search
[2011.07.24 19:39:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\TuneUp Software
[2012.01.06 14:03:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\{DCD48218-E972-4d0c-9E5F-43462BC13E3B}
[2012.07.25 15:35:28 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\OGALogon.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
[2009.10.05 14:41:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Application Data\Office Genuine Advantage
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2008.02.11 18:55:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Adobe
[2008.04.25 12:58:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Ahead
[2008.08.19 18:55:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Apple Computer
[2008.02.08 22:18:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\ATI
[2011.10.25 18:34:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Avira
[2011.07.28 14:46:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Azureus
[2012.04.28 21:48:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Canneverbe Limited
[2008.02.14 13:08:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\CyberLink
[2012.04.06 11:24:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\DeepBurner
[2010.01.12 20:42:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\DivX
[2012.02.01 19:49:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Download Manager
[2009.12.04 14:59:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\dvdcss
[2012.06.08 14:59:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\elsterformular
[2012.05.08 16:52:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\eMule
[2012.03.25 12:54:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Google
[2011.05.25 10:31:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant
[2012.02.08 21:59:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GrabPro
[2008.02.19 17:50:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Help
[2008.02.08 18:19:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Identities
[2008.02.08 21:22:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\InstallShield
[2008.12.10 17:59:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Logitech
[2008.03.03 14:46:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Macromedia
[2012.07.02 14:45:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Malwarebytes
[2011.12.01 16:06:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Media Player Classic
[2008.02.09 00:59:56 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft
[2008.02.11 11:20:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft Web Folders
[2008.02.08 21:05:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla
[2011.09.09 21:31:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\OpenOffice.org
[2008.04.08 13:53:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\OpenOffice.org2
[2012.06.06 15:15:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Oracle
[2012.02.08 21:59:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Orbit
[2012.02.08 22:00:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\ProgSense
[2008.03.06 16:28:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Public Sync
[2011.07.15 23:42:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\QuickScan
[2008.02.20 15:25:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Real
[2012.01.06 14:03:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\SkyMonk
[2012.01.24 11:31:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Softplicity
[2008.02.08 21:14:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Sun
[2010.03.16 15:32:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\vlc
[2012.05.12 16:56:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Windows Search
[2011.07.28 12:49:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\WinRAR
 
< %APPDATA%\*.exe /s >
[2008.06.15 17:38:02 | 022,319,360 | ---- | M] (                                  ) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Adobe\Acrobat\7.0\Updater\AdbeRdr710_de_DE.exe
[2011.07.28 14:47:48 | 000,310,208 | ---- | M] (Georgia Institute of Technology) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Azureus\plugins\mlab\ShaperProbeC.exe
[2011.05.25 11:10:30 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\203D0797-F03A-40D3-9324-E1AF28B7527E\AutoRunCE.exe
[2011.05.25 11:10:34 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\203D0797-F03A-40D3-9324-E1AF28B7527E\1\module.exe
[2011.05.25 11:11:06 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\2FCA7F6D-CE82-47A5-ACFD-E138027994CE\AutoRunCE.exe
[2011.05.25 11:11:06 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\2FCA7F6D-CE82-47A5-ACFD-E138027994CE\1\module.exe
[2011.05.25 11:09:58 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\36643127-6565-4DAD-8B23-472DCA5DB2E7\AutoRunCE.exe
[2011.05.25 11:10:02 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\36643127-6565-4DAD-8B23-472DCA5DB2E7\1\module.exe
[2011.05.25 11:09:54 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\5F85F081-70A4-4FE8-AD4A-82FE0E3BD6EB\AutoRunCE.exe
[2011.05.25 11:09:58 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\5F85F081-70A4-4FE8-AD4A-82FE0E3BD6EB\1\module.exe
[2011.05.25 11:10:24 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\5FD8A8C3-067B-47B1-90EF-331BF3B884B6\AutoRunCE.exe
[2011.05.25 11:10:24 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\5FD8A8C3-067B-47B1-90EF-331BF3B884B6\1\module.exe
[2011.05.25 11:10:06 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\64A8BC77-053A-4B85-8955-C4798D7C2919\AutoRunCE.exe
[2011.05.25 11:10:10 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\64A8BC77-053A-4B85-8955-C4798D7C2919\1\module.exe
[2011.05.25 11:10:40 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\7C1B17F3-92D4-4B3E-AD00-AE6F2490AFE3\AutoRunCE.exe
[2011.05.25 11:10:42 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\7C1B17F3-92D4-4B3E-AD00-AE6F2490AFE3\1\module.exe
[2011.05.25 11:10:44 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\7D5313F0-159F-410B-BC37-8231D6229802\AutoRunCE.exe
[2011.05.25 11:10:48 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\7D5313F0-159F-410B-BC37-8231D6229802\1\module.exe
[2011.05.25 11:10:52 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\8B4455EC-62EC-456C-98FC-5068814AC27E\AutoRunCE.exe
[2011.05.25 11:10:56 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\8B4455EC-62EC-456C-98FC-5068814AC27E\1\module.exe
[2011.05.25 11:10:02 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\8C715C64-E4A6-411B-8AD6-06D7766709E3\AutoRunCE.exe
[2011.05.25 11:10:04 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\8C715C64-E4A6-411B-8AD6-06D7766709E3\1\module.exe
[2011.05.25 11:10:26 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\9B90CA39-537D-455A-A57C-577A518BB2FD\AutoRunCE.exe
[2011.05.25 11:10:28 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\9B90CA39-537D-455A-A57C-577A518BB2FD\1\module.exe
[2011.05.25 11:10:56 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\A24E85D0-DF41-4482-B935-D92E4C2F2D9E\AutoRunCE.exe
[2011.05.25 11:11:00 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\A24E85D0-DF41-4482-B935-D92E4C2F2D9E\1\module.exe
[2011.05.25 11:08:56 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\AD9D1FDD-07C4-44C8-A2D7-BB1ADA5CCEF0\AutoRunCE.exe
[2011.05.25 11:09:40 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\AD9D1FDD-07C4-44C8-A2D7-BB1ADA5CCEF0\1\module.exe
[2011.05.25 11:11:02 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\B8A1D272-FA91-49FB-8FB9-163DC6393203\AutoRunCE.exe
[2011.05.25 11:11:04 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\B8A1D272-FA91-49FB-8FB9-163DC6393203\1\module.exe
[2011.05.25 11:10:14 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\BABBE73B-6E64-4C09-8466-FD7ACC47675C\AutoRunCE.exe
[2011.05.25 11:10:16 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\BABBE73B-6E64-4C09-8466-FD7ACC47675C\1\module.exe
[2011.05.25 11:09:44 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\C43538A4-6DD3-4107-B6AA-50D43FEF9098\AutoRunCE.exe
[2011.05.25 11:09:48 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\C43538A4-6DD3-4107-B6AA-50D43FEF9098\1\module.exe
[2011.05.25 11:10:34 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\C4E92961-B71A-4037-88BD-1404E10B52E8\AutoRunCE.exe
[2011.05.25 11:10:38 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\C4E92961-B71A-4037-88BD-1404E10B52E8\1\module.exe
[2011.05.25 11:10:18 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\E01AA5A6-8676-4907-BEB7-B6C3EBCB5AA0\AutoRunCE.exe
[2011.05.25 11:10:22 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\E01AA5A6-8676-4907-BEB7-B6C3EBCB5AA0\1\module.exe
[2011.05.25 11:09:50 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\F61B692E-3F66-4859-AA1B-74791C02F677\AutoRunCE.exe
[2011.05.25 11:09:52 | 000,083,456 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\GoPal Assistant\Library\F61B692E-3F66-4859-AA1B-74791C02F677\1\module.exe
[2008.02.08 22:05:40 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{0AD37499-3D5D-12F0-EBEA-46EE9AD02DBF}\ARPPRODUCTICON.exe
[2008.02.08 22:06:06 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{174D7CC5-1117-29D3-8422-2E54ADF7DB5D}\ARPPRODUCTICON.exe
[2008.02.08 22:07:40 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{23894154-0961-CD0A-BAC0-67E6E96165C3}\ARPPRODUCTICON.exe
[2008.02.08 22:07:22 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{24DFAAD6-E1ED-F588-2AD5-2EA4FE9113AE}\ARPPRODUCTICON.exe
[2008.02.08 22:07:18 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{26886987-D038-7438-8DF2-ED3B1888E052}\ARPPRODUCTICON.exe
[2008.02.08 22:05:44 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{2C6D0ACD-DD2B-BFE5-A005-53AFD4AA3175}\ARPPRODUCTICON.exe
[2008.02.08 22:05:52 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{2D50DC1F-FCEC-D970-1DFB-E73CF2404451}\ARPPRODUCTICON.exe
[2008.02.08 22:07:38 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{306682DE-BB8E-CD56-9F6B-DE209469418A}\ARPPRODUCTICON.exe
[2009.02.17 16:19:56 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{3101CB58-3482-4D21-AF1A-7057FC935355}\ARPPRODUCTICON.exe
[2008.02.08 22:07:32 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{310477AD-884B-736D-B2C8-7BE9433B243D}\ARPPRODUCTICON.exe
[2008.02.08 22:07:00 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{31814F2E-FA58-AFE8-DC97-3BD97F7191C2}\ARPPRODUCTICON.exe
[2008.02.08 22:06:58 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{354F7470-D8E3-95D0-3488-B9E32D5E9636}\ARPPRODUCTICON.exe
[2008.02.08 22:05:56 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{380FAC97-C47F-C5A9-2A51-DFF8DE144B37}\ARPPRODUCTICON.exe
[2008.12.10 18:04:54 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
[2008.02.08 22:07:26 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{407A5080-4B1C-A43D-9EED-A3B5EDBCF593}\ARPPRODUCTICON.exe
[2012.01.10 18:21:26 | 000,045,056 | R--- | M] (InstallShield Software Corp.) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{457791C5-D702-4143-A7B2-2744BE9573F2}\NewShortcut1_5B69D3033CA54B39B5ECE7D051297E77.exe
[2012.07.02 10:45:38 | 000,388,096 | R--- | M] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
[2008.02.08 22:06:16 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{46FE06BF-2A08-9D00-ABFD-7F967817E275}\ARPPRODUCTICON.exe
[2008.02.08 22:05:16 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{4B50D80D-A482-DECD-B584-EB054EBA878A}\ARPPRODUCTICON.exe
[2008.02.08 22:06:04 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{5ABA84ED-D61B-257F-809F-A8C883865854}\ARPPRODUCTICON.exe
[2008.02.08 22:05:48 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{5B464CAC-76BD-BDBB-8066-318D05D171DF}\ARPPRODUCTICON.exe
[2008.02.08 22:06:08 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{5C7332EA-BFB9-24A0-BDD9-254F4B113E41}\ARPPRODUCTICON.exe
[2008.02.08 22:06:30 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{66B5F542-952C-F50D-BFF3-BCA582B65860}\ARPPRODUCTICON.exe
[2008.02.08 22:07:20 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{67213BA8-70C6-458D-9B64-4B93FB35E84B}\ARPPRODUCTICON.exe
[2008.02.08 22:07:26 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{6AA66ACB-E93C-C7CD-F303-D473AEC8A43E}\ARPPRODUCTICON.exe
[2008.02.08 22:05:58 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{6D5DC54D-B06E-32A8-A5D9-4978D7A75FA1}\ARPPRODUCTICON.exe
[2008.02.08 22:07:06 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{782BC438-2C73-77F4-F5B6-7ADC87F611BB}\ARPPRODUCTICON.exe
[2008.02.08 22:07:24 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{7BBA76B4-CC34-0AAB-6D48-BE0181E20832}\ARPPRODUCTICON.exe
[2008.02.08 22:06:14 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{7F311276-1CD6-1661-8BAE-DD9016FE9B8D}\ARPPRODUCTICON.exe
[2008.02.08 22:05:42 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{84C89CF4-F64E-6820-375C-24963DDF99C9}\ARPPRODUCTICON.exe
[2008.02.08 22:07:20 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{8C0D145D-EB41-E1DB-6250-0146B02CBA3A}\ARPPRODUCTICON.exe
[2008.02.08 22:07:14 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{8F5D6849-1A7E-B0B2-F1DE-C0FF21F9E78C}\ARPPRODUCTICON.exe
[2008.02.08 22:06:12 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{944DA8EF-FD4E-1FD9-D88A-B22D78913BE6}\ARPPRODUCTICON.exe
[2008.02.08 22:05:50 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{97F5E039-D2F5-18C0-F0C9-6981F73514CC}\ARPPRODUCTICON.exe
[2008.02.08 22:07:02 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{A35D49A6-F3CF-87AA-6FF1-777D8A06BAB1}\ARPPRODUCTICON.exe
[2008.02.08 22:06:46 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{B2CEACB9-7690-30B5-D80A-B138DB4F0E37}\ARPPRODUCTICON.exe
[2008.02.08 22:07:30 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{D26970AA-C66F-142F-7C66-A73FC3546F57}\ARPPRODUCTICON.exe
[2008.02.08 22:06:24 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{D88DB576-0989-879A-38B1-7ED6224B2F52}\ARPPRODUCTICON.exe
[2008.02.08 22:06:56 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{D8B87EBC-12C2-D4FC-F085-A062D4906216}\ARPPRODUCTICON.exe
[2008.02.08 22:07:08 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{E2A05D36-56EF-84FC-E7D7-090D6E5F09BC}\ARPPRODUCTICON.exe
[2008.02.08 22:06:00 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{E4DA4D2C-F57F-782E-752E-9286E5713297}\ARPPRODUCTICON.exe
[2008.02.08 22:07:28 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{E4E118EF-5286-915B-7DBD-D931AB9AF200}\ARPPRODUCTICON.exe
[2008.02.08 22:07:40 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{E5B85BE7-55B5-0A14-7634-FEF92BCB87FB}\ARPPRODUCTICON.exe
[2008.02.08 22:06:34 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{F384BD83-C317-94DA-A4AB-3E75E43F4F8C}\ARPPRODUCTICON.exe
[2008.02.08 22:07:34 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{F622BE4A-363F-F2B6-1F98-54E5E99B1750}\ARPPRODUCTICON.exe
[2008.02.08 22:06:50 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Microsoft\Installer\{F6D39840-BB27-A191-BDF2-1841CA805D24}\ARPPRODUCTICON.exe
[2010.03.06 11:51:58 | 000,443,912 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Real\Update\setup3.10\setup.exe
[2010.03.06 19:52:46 | 010,309,448 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Real\Update\setup3.10\chr\ChromeInstaller.exe
[2010.03.06 19:52:50 | 000,149,000 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Real\Update\setup3.10\chr_helper\LaunchHelper.exe
[2010.03.06 19:53:20 | 008,405,312 | ---- | M] () -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Real\Update\setup3.10\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
[2010.03.06 19:54:24 | 021,292,528 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Real\Update\setup3.10\rp\RealPlayerSPGold_de.exe
[2010.03.06 19:52:08 | 000,079,368 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Real\Update\setup3.10\RUP\vista.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2004.08.04 12:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008.11.04 14:10:44 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008.11.04 14:10:44 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.11.04 14:10:44 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\sp3.cab:AGP440.sys
[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\agp440.sys
[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004.08.04 12:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008.11.04 14:10:44 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.11.04 14:10:44 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.11.04 14:10:44 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\sp3.cab:atapi.sys
[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\atapi.sys
[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.04 12:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\eventlog.dll
[2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004.08.04 12:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 03:22:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 03:22:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\netlogon.dll
[2008.04.14 03:22:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004.08.04 12:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 03:22:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 03:22:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\scecli.dll
[2008.04.14 03:22:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004.08.04 12:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2005.03.02 19:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll
[2007.03.08 16:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2005.03.02 19:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2004.08.04 12:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll
[2007.03.08 16:48:40 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2008.04.14 03:22:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 03:22:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\user32.dll
[2008.04.14 03:22:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 03:23:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 03:23:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\userinit.exe
[2008.04.14 03:23:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004.08.04 12:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004.08.04 12:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008.04.14 03:23:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 03:23:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\winlogon.exe
[2008.04.14 03:23:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.04 12:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004.08.04 12:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.02.09 00:38:00 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2008.02.09 00:38:00 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2008.02.09 00:38:00 | 000,442,368 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >
--- --- ---

[/code]

Schönen Abend und kühle Nacht!

cosinus 26.07.2012 14:00
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: "Ask.com"
IE - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\SearchScopes\{31CF9EBE-5755-4a1d-AC25-2834D952D9B4}: "URL" = http://search.pdfcreator-toolbar.org/search?p=Q&ts=ne&w={searchTerms}&csrc=search-field
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Ask.com"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&SearchSource=3&q={searchTerms}"
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.12.2.16749
FF - user.js - File not found
[2012.01.21 16:18:10 | 000,000,000 | ---D | M] (Vuze Remote Community Toolbar) -- C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1645522239-492894223-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O3 - HKU\S-1-5-21-1645522239-492894223-725345543-1003\..\Toolbar\WebBrowser: (no name) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.04.18 20:28:40 | 000,000,641 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011.07.29 19:34:15 | 000,000,000 | RH-D | M] - F:\autorun -- [ NTFS ]
O32 - Unable to obtain root file information for disk F:\
O33 - MountPoints2\{f935f2cb-4f35-11dd-8a5a-0015af664f0e}\Shell - "" = AutoRun
O33 - MountPoints2\{f935f2cb-4f35-11dd-8a5a-0015af664f0e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f935f2cb-4f35-11dd-8a5a-0015af664f0e}\Shell\AutoRun\command - "" = F:\LaunchU3.exe
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^SkyMonk.lnk -  - File not found
[2012.06.28 19:04:07 | 000,000,000 | ---D | C] -- C:\ProcessExplorer_152
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

dipl ingwer 26.07.2012 18:21
Sorry, ich habe Mist gebaut, war gestört worden, erst habe ich vergessen, die Anonymisierung der User-Namen auf dem Rechner zurück zu verwandeln, dann ein zweites Mal gefixt, ohne den Viren-Scanner abzuschalten. Beim dritten Fix-Lauf dann hoffentlich alles richtig gemacht. Jetzt weiß ich nur nicht, ob der Bericht all das wiedergibt, was Du haben musst. Finde aber den log-Bericht vom ersten Mal nicht.
Hoffe, es ist am Ende alles okay, was ich da veranstaltet habe...


Code:
All processes killed
========== OTL ==========
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "" removed from browser.search.defaulturl
Prefs.js: "Ask.com" removed from browser.search.order.1
Registry key HKEY_USERS\S-1-5-21-1645522239-492894223-725345543-1003\Software\Microsoft\Internet Explorer\SearchScopes\{31CF9EBE-5755-4a1d-AC25-2834D952D9B4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31CF9EBE-5755-4a1d-AC25-2834D952D9B4}\ not found.
Prefs.js: "Ask.com" removed from sweetim.toolbar.previous.browser.search.defaultenginename
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&SearchSource=3&q={searchTerms}" removed from sweetim.toolbar.previous.browser.search.defaulturl
Prefs.js: toolbar@ask.com:3.12.2.16749 removed from extensions.enabledItems
Folder C:\Dokumente und Einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting not found.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-21-1645522239-492894223-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-21-1645522239-492894223-725345543-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File C:\AUTOEXEC.BAT not found.
File  not found.
File  not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f935f2cb-4f35-11dd-8a5a-0015af664f0e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f935f2cb-4f35-11dd-8a5a-0015af664f0e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f935f2cb-4f35-11dd-8a5a-0015af664f0e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f935f2cb-4f35-11dd-8a5a-0015af664f0e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f935f2cb-4f35-11dd-8a5a-0015af664f0e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f935f2cb-4f35-11dd-8a5a-0015af664f0e}\ not found.
File F:\LaunchU3.exe not found.
Folder C:\ProcessExplorer_152\ not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Admin
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: All Users
 
User: Christa Holz
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: ingwer
->Temp folder emptied: 590221 bytes
->Temporary Internet Files folder emptied: 33300 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 7018608 bytes
->Flash cache emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Mitarbeiter
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 483 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 7,00 mb
 
 
[EMPTYFLASH]
 
User: Admin
->Flash cache emptied: 0 bytes
 
User: Administrator
 
User: All Users
 
User: Christa Holz
 
User: Default User
 
User: ingwer
->Flash cache emptied: 0 bytes
 
User: LocalService
 
User: Mitarbeiter
 
User: NetworkService
 
Total Flash Files Cleaned = 0,00 mb
 
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.54.1 log created on 07262012_185505

Files\Folders moved on Reboot...
C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Temp\WCESLog.log moved successfully.

PendingFileRenameOperations files...
File C:\Dokumente und Einstellungen\ingwer\Lokale Einstellungen\Temp\WCESLog.log not found!

Registry entries deleted on Reboot...

cosinus 26.07.2012 22:40
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

dipl ingwer 27.07.2012 10:09
Erledigt!

Code:

10:57:42.0312 4012        TDSS rootkit removing tool 2.7.48.0 Jul 24 2012 13:16:32
10:57:42.0734 4012        ============================================================
10:57:42.0734 4012        Current date / time: 2012/07/27 10:57:42.0734
10:57:42.0734 4012        SystemInfo:
10:57:42.0734 4012       
10:57:42.0734 4012        OS Version: 5.1.2600 ServicePack: 3.0
10:57:42.0734 4012        Product type: Workstation
10:57:42.0734 4012        ComputerName: SDD_LAPTOP
10:57:42.0734 4012        UserName: ingwer
10:57:42.0734 4012        Windows directory: C:\WINDOWS
10:57:42.0734 4012        System windows directory: C:\WINDOWS
10:57:42.0734 4012        Processor architecture: Intel x86
10:57:42.0734 4012        Number of processors: 2
10:57:42.0734 4012        Page size: 0x1000
10:57:42.0734 4012        Boot type: Normal boot
10:57:42.0734 4012        ============================================================
10:57:45.0843 4012        Drive \Device\Harddisk0\DR0 - Size: 0x1BF2976000 (111.79 Gb), SectorSize: 0x200, Cylinders: 0x3901, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
10:57:45.0921 4012        Drive \Device\Harddisk1\DR3 - Size: 0x0 (0.00 Gb), SectorSize: 0x200, Cylinders: 0x0, SectorsPerTrack: 0x0, TracksPerCylinder: 0x0, Type 'W'
10:57:53.0250 4012        Drive \Device\Harddisk2\DR4 - Size: 0x15D50D00000 (1397.26 Gb), SectorSize: 0x200, Cylinders: 0x2C881, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
10:57:53.0265 4012        ============================================================
10:57:53.0265 4012        \Device\Harddisk0\DR0:
10:57:53.0328 4012        MBR partitions:
10:57:53.0328 4012        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x596D64E
10:57:53.0343 4012        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x596D6CC, BlocksNum 0x86260F5
10:57:53.0343 4012        \Device\Harddisk2\DR4:
10:57:53.0343 4012        MBR partitions:
10:57:53.0343 4012        \Device\Harddisk2\DR4\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xAEA86000
10:57:53.0343 4012        ============================================================
10:57:53.0406 4012        C: <-> \Device\Harddisk0\DR0\Partition0
10:57:53.0468 4012        D: <-> \Device\Harddisk0\DR0\Partition1
10:57:53.0546 4012        F: <-> \Device\Harddisk2\DR4\Partition0
10:57:53.0546 4012        ============================================================
10:57:53.0546 4012        Initialize success
10:57:53.0546 4012        ============================================================
11:00:06.0718 3304        ============================================================
11:00:06.0718 3304        Scan started
11:00:06.0718 3304        Mode: Manual; SigCheck; TDLFS;
11:00:06.0718 3304        ============================================================
11:00:07.0171 3304        7ByteIo - ok
11:00:07.0640 3304        Abiosdsk - ok
11:00:07.0656 3304        abp480n5 - ok
11:00:07.0828 3304        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
11:00:16.0796 3304        ACPI - ok
11:00:16.0843 3304        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
11:00:17.0046 3304        ACPIEC - ok
11:00:17.0265 3304        AdobeFlashPlayerUpdateSvc (5e1a953c6472e7bb644892a4d0df5e72) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
11:00:17.0453 3304        AdobeFlashPlayerUpdateSvc - ok
11:00:17.0453 3304        adpu160m - ok
11:00:17.0609 3304        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
11:00:17.0890 3304        aec - ok
11:00:18.0015 3304        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
11:00:18.0218 3304        AFD - ok
11:00:18.0281 3304        AFS2K          (c719341a1cf6afd4fa0808ae3d23d6a3) C:\WINDOWS\system32\drivers\AFS2K.sys
11:00:18.0328 3304        AFS2K - ok
11:00:18.0328 3304        Aha154x - ok
11:00:18.0343 3304        aic78u2 - ok
11:00:18.0359 3304        aic78xx - ok
11:00:18.0406 3304        Alerter        (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
11:00:18.0609 3304        Alerter - ok
11:00:18.0718 3304        ALG            (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
11:00:19.0203 3304        ALG - ok
11:00:19.0203 3304        AliIde - ok
11:00:19.0218 3304        amsint - ok
11:00:19.0375 3304        AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Programme\Avira\AntiVir Desktop\sched.exe
11:00:19.0468 3304        AntiVirSchedulerService - ok
11:00:19.0578 3304        AntiVirService  (a489be6bb0aa1ff406b488b60542314b) C:\Programme\Avira\AntiVir Desktop\avguard.exe
11:00:19.0671 3304        AntiVirService - ok
11:00:19.0859 3304        AppMgmt        (d45960be52c3c610d361977057f98c54) C:\WINDOWS\System32\appmgmts.dll
11:00:20.0187 3304        AppMgmt - ok
11:00:20.0625 3304        AR5211          (bd4a059b937a64f403e693dcaa26fe38) C:\WINDOWS\system32\DRIVERS\ar5211.sys
11:00:21.0328 3304        AR5211 - ok
11:00:21.0343 3304        asc - ok
11:00:21.0343 3304        asc3350p - ok
11:00:21.0359 3304        asc3550 - ok
11:00:21.0546 3304        aspnet_state    (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
11:00:21.0609 3304        aspnet_state - ok
11:00:21.0750 3304        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
11:00:21.0953 3304        AsyncMac - ok
11:00:22.0062 3304        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
11:00:22.0203 3304        atapi - ok
11:00:22.0203 3304        Atdisk - ok
11:00:22.0578 3304        Ati HotKey Poller (77c3f65a387f5e24228b7cc3557288e6) C:\WINDOWS\system32\Ati2evxx.exe
11:00:23.0187 3304        Ati HotKey Poller - ok
11:00:24.0890 3304        ati2mtag        (01526c7a691913a7b09d0eb22b70c5d7) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
11:00:27.0937 3304        ati2mtag - ok
11:00:28.0562 3304        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
11:00:28.0781 3304        Atmarpc - ok
11:00:28.0921 3304        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
11:00:29.0078 3304        AudioSrv - ok
11:00:29.0109 3304        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
11:00:29.0250 3304        audstub - ok
11:00:29.0343 3304        avgntflt        (d5541f0afb767e85fc412fc609d96a74) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
11:00:29.0406 3304        avgntflt - ok
11:00:29.0531 3304        avipbb          (7d967a682d4694df7fa57d63a2db01fe) C:\WINDOWS\system32\DRIVERS\avipbb.sys
11:00:29.0640 3304        avipbb - ok
11:00:29.0687 3304        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\WINDOWS\system32\DRIVERS\avkmgr.sys
11:00:29.0718 3304        avkmgr - ok
11:00:29.0765 3304        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
11:00:29.0968 3304        Beep - ok
11:00:30.0281 3304        BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
11:00:30.0875 3304        BITS - ok
11:00:30.0984 3304        Browser        (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
11:00:31.0171 3304        Browser - ok
11:00:31.0234 3304        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
11:00:31.0390 3304        cbidf2k - ok
11:00:31.0406 3304        cd20xrnt - ok
11:00:31.0734 3304        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
11:00:31.0890 3304        Cdaudio - ok
11:00:32.0031 3304        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
11:00:32.0171 3304        Cdfs - ok
11:00:32.0250 3304        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
11:00:32.0421 3304        Cdrom - ok
11:00:32.0437 3304        Changer - ok
11:00:32.0468 3304        CiSvc          (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
11:00:32.0625 3304        CiSvc - ok
11:00:32.0671 3304        ClipSrv        (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
11:00:32.0859 3304        ClipSrv - ok
11:00:33.0093 3304        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:00:33.0187 3304        clr_optimization_v2.0.50727_32 - ok
11:00:33.0218 3304        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
11:00:33.0375 3304        CmBatt - ok
11:00:33.0375 3304        CmdIde - ok
11:00:33.0421 3304        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
11:00:33.0546 3304        Compbatt - ok
11:00:33.0562 3304        COMSysApp - ok
11:00:33.0562 3304        Cpqarray - ok
11:00:33.0656 3304        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
11:00:33.0890 3304        CryptSvc - ok
11:00:33.0906 3304        dac2w2k - ok
11:00:33.0921 3304        dac960nt - ok
11:00:34.0593 3304        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
11:00:35.0312 3304        DcomLaunch - ok
11:00:36.0000 3304        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
11:00:36.0562 3304        Dhcp - ok
11:00:36.0843 3304        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
11:00:37.0109 3304        Disk - ok
11:00:37.0109 3304        dmadmin - ok
11:00:38.0984 3304        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
11:00:40.0468 3304        dmboot - ok
11:00:40.0953 3304        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
11:00:41.0234 3304        dmio - ok
11:00:41.0328 3304        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
11:00:41.0531 3304        dmload - ok
11:00:41.0812 3304        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
11:00:42.0093 3304        dmserver - ok
11:00:42.0234 3304        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
11:00:42.0500 3304        DMusic - ok
11:00:43.0046 3304        Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll
11:00:43.0375 3304        Dnscache - ok
11:00:43.0718 3304        Dot3svc        (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
11:00:44.0125 3304        Dot3svc - ok
11:00:45.0093 3304        Dot4            (3e4b043f8bc6be1d4820cc6c9c500306) C:\WINDOWS\system32\DRIVERS\Dot4.sys
11:00:45.0531 3304        Dot4 - ok
11:00:45.0718 3304        Dot4Print      (77ce63a8a34ae23d9fe4c7896d1debe7) C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys
11:00:45.0937 3304        Dot4Print - ok
11:00:46.0109 3304        dot4usb        (29e86af2f3457d0441348020fe3cfbd0) C:\WINDOWS\system32\DRIVERS\dot4usb.sys
11:00:46.0359 3304        dot4usb - ok
11:00:46.0375 3304        dpti2o - ok
11:00:46.0468 3304        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
11:00:46.0671 3304        drmkaud - ok
11:00:46.0984 3304        EapHost        (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
11:00:47.0187 3304        EapHost - ok
11:00:47.0328 3304        ERSvc          (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
11:00:47.0625 3304        ERSvc - ok
11:00:48.0343 3304        Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
11:00:48.0500 3304        Eventlog - ok
11:00:49.0343 3304        EventSystem    (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll
11:00:51.0000 3304        EventSystem - ok
11:00:51.0140 3304        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
11:00:51.0437 3304        Fastfat - ok
11:00:51.0625 3304        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
11:00:51.0812 3304        FastUserSwitchingCompatibility - ok
11:00:51.0875 3304        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
11:00:52.0078 3304        Fdc - ok
11:00:52.0140 3304        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
11:00:52.0328 3304        Fips - ok
11:00:52.0375 3304        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
11:00:52.0515 3304        Flpydisk - ok
11:00:52.0640 3304        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
11:00:52.0843 3304        FltMgr - ok
11:00:52.0984 3304        FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
11:00:53.0031 3304        FontCache3.0.0.0 - ok
11:00:53.0078 3304        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
11:00:53.0281 3304        Fs_Rec - ok
11:00:53.0453 3304        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
11:00:53.0640 3304        Ftdisk - ok
11:00:53.0687 3304        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
11:00:53.0843 3304        Gpc - ok
11:00:54.0046 3304        gupdate        (506708142bc63daba64f2d3ad1dcd5bf) C:\Programme\Google\Update\GoogleUpdate.exe
11:00:54.0156 3304        gupdate - ok
11:00:54.0234 3304        gupdatem        (506708142bc63daba64f2d3ad1dcd5bf) C:\Programme\Google\Update\GoogleUpdate.exe
11:00:54.0265 3304        gupdatem - ok
11:00:54.0812 3304        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
11:00:55.0234 3304        HDAudBus - ok
11:00:55.0437 3304        helpsvc        (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
11:00:55.0687 3304        helpsvc - ok
11:00:55.0828 3304        HidServ        (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll
11:00:56.0015 3304        HidServ - ok
11:00:56.0109 3304        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
11:00:56.0359 3304        HidUsb - ok
11:00:56.0812 3304        hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
11:00:57.0046 3304        hkmsvc - ok
11:00:57.0046 3304        hpn - ok
11:00:57.0109 3304        HPZid412        (5faba4775d4c61e55ec669d643ffc71f) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
11:00:57.0312 3304        HPZid412 - ok
11:00:57.0359 3304        HPZipr12        (a3c43980ee1f1beac778b44ea65dbdd4) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
11:00:57.0484 3304        HPZipr12 - ok
11:00:57.0515 3304        HPZius12        (2906949bd4e206f2bb0dd1896ce9f66f) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
11:00:57.0671 3304        HPZius12 - ok
11:00:57.0921 3304        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
11:00:58.0203 3304        HTTP - ok
11:00:58.0250 3304        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
11:00:58.0437 3304        HTTPFilter - ok
11:00:58.0453 3304        i2omgmt - ok
11:00:58.0453 3304        i2omp - ok
11:00:58.0625 3304        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
11:00:58.0796 3304        i8042prt - ok
11:00:59.0500 3304        idsvc          (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
11:01:00.0687 3304        idsvc - ok
11:01:00.0750 3304        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
11:01:00.0906 3304        Imapi - ok
11:01:01.0250 3304        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe
11:01:02.0062 3304        ImapiService - ok
11:01:02.0062 3304        ini910u - ok
11:01:05.0250 3304        IntcAzAudAddService (47f27af890da3e51c633fdd510910115) C:\WINDOWS\system32\drivers\RtkHDAud.sys
11:01:11.0437 3304        IntcAzAudAddService - ok
11:01:12.0031 3304        IntelIde - ok
11:01:12.0078 3304        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
11:01:12.0281 3304        intelppm - ok
11:01:12.0406 3304        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
11:01:12.0562 3304        Ip6Fw - ok
11:01:12.0625 3304        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
11:01:12.0796 3304        IpFilterDriver - ok
11:01:12.0843 3304        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
11:01:12.0984 3304        IpInIp - ok
11:01:13.0125 3304        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
11:01:13.0375 3304        IpNat - ok
11:01:13.0453 3304        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
11:01:13.0671 3304        IPSec - ok
11:01:13.0718 3304        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
11:01:13.0875 3304        IRENUM - ok
11:01:13.0937 3304        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
11:01:14.0062 3304        isapnp - ok
11:01:14.0312 3304        JavaQuickStarterService (c2c1660ddcc9bd67eb98d6d5f91c107f) C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
11:01:14.0437 3304        JavaQuickStarterService - ok
11:01:14.0484 3304        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
11:01:14.0656 3304        Kbdclass - ok
11:01:14.0687 3304        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
11:01:14.0937 3304        kbdhid - ok
11:01:14.0953 3304        kbfiltr        (cc2a86d7bbf14977340dca61bbcba771) C:\WINDOWS\system32\DRIVERS\kbfiltr.sys
11:01:15.0046 3304        kbfiltr - ok
11:01:15.0218 3304        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
11:01:15.0484 3304        kmixer - ok
11:01:15.0578 3304        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
11:01:15.0703 3304        KSecDD - ok
11:01:15.0828 3304        lanmanserver    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
11:01:15.0953 3304        lanmanserver - ok
11:01:16.0078 3304        lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
11:01:16.0250 3304        lanmanworkstation - ok
11:01:16.0265 3304        lbrtfdc - ok
11:01:16.0625 3304        LBTServ        (a0f7dc0080e4f97dc97de08b699e231b) C:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTServ.exe
11:01:16.0734 3304        LBTServ - ok
11:01:16.0796 3304        LHidFilt        (24e0ddb99aeccf86bb37702611761459) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
11:01:16.0828 3304        LHidFilt - ok
11:01:16.0953 3304        LightScribeService (98d884adc0b8c0febcc9d7bee6d86f90) C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
11:01:17.0031 3304        LightScribeService - ok
11:01:17.0078 3304        LmHosts        (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
11:01:17.0406 3304        LmHosts - ok
11:01:17.0593 3304        LMouFilt        (d58b330d318361a66a9fe60d7c9b4951) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
11:01:17.0625 3304        LMouFilt - ok
11:01:17.0687 3304        Messenger      (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
11:01:17.0859 3304        Messenger - ok
11:01:17.0890 3304        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
11:01:18.0031 3304        mnmdd - ok
11:01:18.0093 3304        mnmsrvc        (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe
11:01:18.0250 3304        mnmsrvc - ok
11:01:18.0515 3304        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
11:01:18.0671 3304        Modem - ok
11:01:18.0734 3304        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
11:01:18.0875 3304        Mouclass - ok
11:01:18.0921 3304        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
11:01:19.0078 3304        mouhid - ok
11:01:19.0125 3304        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
11:01:19.0281 3304        MountMgr - ok
11:01:19.0609 3304        MozillaMaintenance (46297fa8e30a6007f14118fc2b942fbc) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
11:01:19.0718 3304        MozillaMaintenance - ok
11:01:19.0718 3304        mraid35x - ok
11:01:19.0875 3304        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
11:01:20.0187 3304        MRxDAV - ok
11:01:21.0218 3304        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
11:01:21.0765 3304        MRxSmb - ok
11:01:21.0796 3304        MSDTC          (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe
11:01:21.0968 3304        MSDTC - ok
11:01:22.0078 3304        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
11:01:22.0203 3304        Msfs - ok
11:01:22.0218 3304        MSIServer - ok
11:01:22.0250 3304        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
11:01:22.0390 3304        MSKSSRV - ok
11:01:22.0437 3304        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
11:01:22.0562 3304        MSPCLOCK - ok
11:01:22.0593 3304        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
11:01:22.0734 3304        MSPQM - ok
11:01:22.0765 3304        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
11:01:22.0921 3304        mssmbios - ok
11:01:22.0953 3304        MTsensor        (1c0f480b7c6136ddb5fb909995af014a) C:\WINDOWS\system32\DRIVERS\ATKACPI.sys
11:01:23.0000 3304        MTsensor - ok
11:01:23.0093 3304        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
11:01:23.0187 3304        Mup - ok
11:01:23.0453 3304        napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
11:01:23.0859 3304        napagent - ok
11:01:24.0812 3304        NBService      (6d8fcdd5bb3b676ef58fa234073492c6) C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe
11:01:25.0781 3304        NBService - ok
11:01:25.0953 3304        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
11:01:26.0218 3304        NDIS - ok
11:01:26.0265 3304        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
11:01:26.0390 3304        NdisTapi - ok
11:01:26.0421 3304        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
11:01:26.0593 3304        Ndisuio - ok
11:01:26.0687 3304        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
11:01:26.0875 3304        NdisWan - ok
11:01:26.0937 3304        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
11:01:27.0046 3304        NDProxy - ok
11:01:27.0093 3304        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
11:01:27.0234 3304        NetBIOS - ok
11:01:27.0453 3304        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
11:01:27.0718 3304        NetBT - ok
11:01:27.0828 3304        NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
11:01:28.0078 3304        NetDDE - ok
11:01:28.0078 3304        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
11:01:28.0203 3304        NetDDEdsdm - ok
11:01:28.0281 3304        Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:01:28.0437 3304        Netlogon - ok
11:01:28.0593 3304        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
11:01:28.0875 3304        Netman - ok
11:01:29.0078 3304        NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
11:01:29.0203 3304        NetTcpPortSharing - ok
11:01:29.0437 3304        Nla            (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
11:01:29.0640 3304        Nla - ok
11:01:30.0031 3304        NMIndexingService (060daf68493ad7adf104413e5a62afa8) C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
11:01:30.0265 3304        NMIndexingService - ok
11:01:30.0406 3304        NMSAccess      (7aea4df1ca68fd45dd4bbe1f0243ce7f) C:\Programme\CDBurnerXP\NMSAccessU.exe
11:01:30.0484 3304        NMSAccess - ok
11:01:30.0593 3304        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
11:01:30.0781 3304        Npfs - ok
11:01:31.0218 3304        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
11:01:31.0953 3304        Ntfs - ok
11:01:32.0000 3304        NtLmSsp        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:01:32.0125 3304        NtLmSsp - ok
11:01:32.0484 3304        NtmsSvc        (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
11:01:33.0171 3304        NtmsSvc - ok
11:01:33.0218 3304        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
11:01:33.0375 3304        Null - ok
11:01:33.0406 3304        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
11:01:33.0546 3304        NwlnkFlt - ok
11:01:33.0609 3304        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
11:01:33.0765 3304        NwlnkFwd - ok
11:01:33.0859 3304        NwlnkIpx        (8b8b1be2dba4025da6786c645f77f123) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
11:01:34.0093 3304        NwlnkIpx - ok
11:01:34.0171 3304        NwlnkNb        (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
11:01:34.0390 3304        NwlnkNb - ok
11:01:34.0453 3304        NwlnkSpx        (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
11:01:34.0625 3304        NwlnkSpx - ok
11:01:35.0078 3304        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
11:01:35.0593 3304        odserv - ok
11:01:35.0718 3304        ose            (5a432a042dae460abe7199b758e8606c) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
11:01:35.0828 3304        ose - ok
11:01:35.0937 3304        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
11:01:36.0125 3304        Parport - ok
11:01:36.0171 3304        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
11:01:36.0296 3304        PartMgr - ok
11:01:36.0359 3304        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
11:01:36.0515 3304        ParVdm - ok
11:01:36.0593 3304        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
11:01:36.0718 3304        PCI - ok
11:01:36.0734 3304        PCIDump - ok
11:01:36.0750 3304        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
11:01:36.0890 3304        PCIIde - ok
11:01:37.0000 3304        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
11:01:37.0171 3304        Pcmcia - ok
11:01:37.0187 3304        PDCOMP - ok
11:01:37.0187 3304        PDFRAME - ok
11:01:37.0203 3304        PDRELI - ok
11:01:37.0218 3304        PDRFRAME - ok
11:01:37.0218 3304        perc2 - ok
11:01:37.0234 3304        perc2hib - ok
11:01:37.0421 3304        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
11:01:37.0453 3304        PlugPlay - ok
11:01:37.0562 3304        Pml Driver HPZ12 (5c1cadd1cb67c0b9d8a84ec6e4d6b5cc) C:\WINDOWS\system32\HPZipm12.exe
11:01:37.0765 3304        Pml Driver HPZ12 - ok
11:01:37.0796 3304        PolicyAgent    (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:01:37.0968 3304        PolicyAgent - ok
11:01:38.0093 3304        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
11:01:38.0250 3304        PptpMiniport - ok
11:01:38.0265 3304        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:01:38.0390 3304        ProtectedStorage - ok
11:01:38.0437 3304        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
11:01:38.0625 3304        PSched - ok
11:01:38.0656 3304        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
11:01:38.0812 3304        Ptilink - ok
11:01:38.0875 3304        PxHelp20        (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
11:01:38.0890 3304        PxHelp20 - ok
11:01:38.0890 3304        ql1080 - ok
11:01:38.0906 3304        Ql10wnt - ok
11:01:38.0921 3304        ql12160 - ok
11:01:38.0921 3304        ql1240 - ok
11:01:38.0937 3304        ql1280 - ok
11:01:38.0984 3304        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
11:01:39.0125 3304        RasAcd - ok
11:01:39.0234 3304        RasAuto        (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
11:01:39.0468 3304        RasAuto - ok
11:01:39.0515 3304        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
11:01:39.0687 3304        Rasl2tp - ok
11:01:39.0859 3304        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
11:01:40.0125 3304        RasMan - ok
11:01:40.0187 3304        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
11:01:40.0390 3304        RasPppoe - ok
11:01:40.0421 3304        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
11:01:40.0578 3304        Raspti - ok
11:01:40.0718 3304        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
11:01:40.0937 3304        Rdbss - ok
11:01:40.0953 3304        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
11:01:41.0093 3304        RDPCDD - ok
11:01:41.0250 3304        rdpdr          (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
11:01:41.0593 3304        rdpdr - ok
11:01:41.0718 3304        RDPWD          (6589db6e5969f8eee594cf71171c5028) C:\WINDOWS\system32\drivers\RDPWD.sys
11:01:41.0906 3304        RDPWD - ok
11:01:42.0031 3304        RDSessMgr      (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
11:01:42.0312 3304        RDSessMgr - ok
11:01:42.0453 3304        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
11:01:42.0625 3304        redbook - ok
11:01:42.0718 3304        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
11:01:42.0906 3304        RemoteAccess - ok
11:01:42.0984 3304        RemoteRegistry  (e4cd1f3d84e1c2ca0b8cf7501e201593) C:\WINDOWS\system32\regsvc.dll
11:01:43.0156 3304        RemoteRegistry - ok
11:01:43.0234 3304        rimsptsk        (1bdba2d2d402415a78a4ba766dfe0f7b) C:\WINDOWS\system32\DRIVERS\rimsptsk.sys
11:01:43.0343 3304        rimsptsk - ok
11:01:43.0375 3304        risdptsk        (ace2ce73d7b04eac48fb80482e05e770) C:\WINDOWS\system32\DRIVERS\risdptsk.sys
11:01:43.0406 3304        risdptsk - ok
11:01:43.0500 3304        RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe
11:01:43.0687 3304        RpcLocator - ok
11:01:44.0000 3304        RpcSs          (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
11:01:44.0218 3304        RpcSs - ok
11:01:44.0343 3304        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
11:01:44.0593 3304        RSVP - ok
11:01:44.0671 3304        RTL8023xp      (1e11171c0b9989e1bdaa59e96b2e81c4) C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys
11:01:45.0046 3304        RTL8023xp - ok
11:01:45.0078 3304        rtl8139        (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
11:01:45.0218 3304        rtl8139 - ok
11:01:45.0250 3304        SamSs          (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:01:45.0390 3304        SamSs - ok
11:01:45.0703 3304        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
11:01:46.0031 3304        SCardSvr - ok
11:01:46.0203 3304        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
11:01:46.0468 3304        Schedule - ok
11:01:46.0562 3304        sdbus          (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
11:01:46.0812 3304        sdbus - ok
11:01:46.0906 3304        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
11:01:47.0078 3304        Secdrv - ok
11:01:47.0140 3304        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
11:01:47.0296 3304        seclogon - ok
11:01:47.0359 3304        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
11:01:47.0515 3304        SENS - ok
11:01:47.0593 3304        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
11:01:47.0796 3304        Serial - ok
11:01:47.0875 3304        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
11:01:48.0015 3304        Sfloppy - ok
11:01:48.0218 3304        SFUSVC          (5944ecbcf555dedd7f48f9982d5ddff4) C:\Programme\Kyocera\FileUtility\SFUSVC.exe
11:01:48.0281 3304        SFUSVC ( UnsignedFile.Multi.Generic ) - warning
11:01:48.0281 3304        SFUSVC - detected UnsignedFile.Multi.Generic (1)
11:01:48.0546 3304        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
11:01:49.0171 3304        SharedAccess - ok
11:01:49.0296 3304        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
11:01:49.0343 3304        ShellHWDetection - ok
11:01:49.0343 3304        Simbad - ok
11:01:50.0078 3304        smserial        (84a9af2b348b691453acbab37c8bfb27) C:\WINDOWS\system32\DRIVERS\smserial.sys
11:01:51.0703 3304        smserial - ok
11:01:51.0718 3304        Sparrow - ok
11:01:51.0765 3304        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
11:01:51.0953 3304        splitter - ok
11:01:52.0093 3304        Spooler        (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
11:01:52.0203 3304        Spooler - ok
11:01:52.0281 3304        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
11:01:52.0484 3304        sr - ok
11:01:52.0671 3304        srservice      (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll
11:01:52.0953 3304        srservice - ok
11:01:53.0234 3304        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
11:01:53.0718 3304        Srv - ok
11:01:53.0812 3304        SSDPSRV        (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
11:01:54.0031 3304        SSDPSRV - ok
11:01:54.0109 3304        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
11:01:54.0140 3304        ssmdrv - ok
11:01:54.0156 3304        StarOpen        (e57b778208c783d8debab320c16a1b82) C:\WINDOWS\system32\drivers\StarOpen.sys
11:01:54.0171 3304        StarOpen ( UnsignedFile.Multi.Generic ) - warning
11:01:54.0171 3304        StarOpen - detected UnsignedFile.Multi.Generic (1)
11:01:54.0453 3304        stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
11:01:55.0093 3304        stisvc - ok
11:01:55.0156 3304        SunkFilt6 - ok
11:01:55.0250 3304        SunkFilt62      (38cc705ff41cc49daed796cfb419bea2) C:\WINDOWS\System32\Drivers\sunkfilt62.sys
11:01:55.0296 3304        SunkFilt62 ( UnsignedFile.Multi.Generic ) - warning
11:01:55.0296 3304        SunkFilt62 - detected UnsignedFile.Multi.Generic (1)
11:01:55.0328 3304        Sunkfiltp - ok
11:01:55.0390 3304        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
11:01:55.0515 3304        swenum - ok
11:01:55.0578 3304        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
11:01:55.0734 3304        swmidi - ok
11:01:55.0750 3304        SwPrv - ok
11:01:55.0765 3304        symc810 - ok
11:01:55.0765 3304        symc8xx - ok
11:01:55.0781 3304        sym_hi - ok
11:01:55.0781 3304        sym_u3 - ok
11:01:55.0984 3304        SynTP          (69bf2dd9b1099d1aa3e7cf14b4b842cd) C:\WINDOWS\system32\DRIVERS\SynTP.sys
11:01:56.0218 3304        SynTP - ok
11:01:56.0296 3304        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
11:01:56.0531 3304        sysaudio - ok
11:01:56.0625 3304        SysmonLog      (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
11:01:56.0843 3304        SysmonLog - ok
11:01:57.0046 3304        TapiSrv        (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
11:01:57.0421 3304        TapiSrv - ok
11:01:57.0718 3304        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
11:01:58.0234 3304        Tcpip - ok
11:01:58.0281 3304        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
11:01:58.0406 3304        TDPIPE - ok
11:01:58.0437 3304        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
11:01:58.0593 3304        TDTCP - ok
11:01:58.0640 3304        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
11:01:58.0796 3304        TermDD - ok
11:01:59.0031 3304        TermService    (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
11:01:59.0390 3304        TermService - ok
11:01:59.0515 3304        Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
11:01:59.0531 3304        Themes - ok
11:01:59.0625 3304        TlntSvr        (03681a1ce77f51586903869a5ab1deab) C:\WINDOWS\system32\tlntsvr.exe
11:01:59.0812 3304        TlntSvr - ok
11:02:00.0046 3304        TOSHIBA Bluetooth Service (87843b2da99051bc66e2d6c211e3d6a4) C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
11:02:00.0156 3304        TOSHIBA Bluetooth Service - ok
11:02:00.0156 3304        TosIde - ok
11:02:00.0171 3304        Tosrfcom - ok
11:02:00.0265 3304        TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
11:02:00.0468 3304        TrkWks - ok
11:02:00.0515 3304        tunmp          (8f861eda21c05857eb8197300a92501c) C:\WINDOWS\system32\DRIVERS\tunmp.sys
11:02:00.0656 3304        tunmp - ok
11:02:00.0718 3304        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
11:02:00.0890 3304        Udfs - ok
11:02:00.0906 3304        ultra - ok
11:02:01.0203 3304        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
11:02:01.0796 3304        Update - ok
11:02:01.0953 3304        upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
11:02:02.0250 3304        upnphost - ok
11:02:02.0281 3304        UPS            (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
11:02:02.0421 3304        UPS - ok
11:02:02.0484 3304        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
11:02:02.0625 3304        usbccgp - ok
11:02:02.0671 3304        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
11:02:02.0812 3304        usbehci - ok
11:02:02.0875 3304        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
11:02:03.0046 3304        usbhub - ok
11:02:03.0109 3304        usbohci        (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
11:02:03.0250 3304        usbohci - ok
11:02:03.0312 3304        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
11:02:03.0468 3304        usbprint - ok
11:02:03.0515 3304        usbscan        (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
11:02:03.0671 3304        usbscan - ok
11:02:03.0718 3304        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
11:02:03.0875 3304        USBSTOR - ok
11:02:03.0906 3304        usb_rndisx      (b6cc50279d6cd28e090a5d33244adc9a) C:\WINDOWS\system32\DRIVERS\usb8023x.sys
11:02:04.0046 3304        usb_rndisx - ok
11:02:04.0125 3304        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
11:02:04.0281 3304        VgaSave - ok
11:02:04.0281 3304        ViaIde - ok
11:02:04.0343 3304        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
11:02:04.0468 3304        VolSnap - ok
11:02:04.0703 3304        VSS            (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
11:02:05.0062 3304        VSS - ok
11:02:05.0203 3304        W32Time        (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll
11:02:05.0484 3304        W32Time - ok
11:02:05.0531 3304        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
11:02:05.0687 3304        Wanarp - ok
11:02:05.0750 3304        wceusbsh        (46a247f6617526afe38b6f12f5512120) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
11:02:05.0843 3304        wceusbsh - ok
11:02:06.0250 3304        Wdf01000        (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
11:02:06.0781 3304        Wdf01000 - ok
11:02:06.0796 3304        WDICA - ok
11:02:06.0890 3304        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
11:02:07.0125 3304        wdmaud - ok
11:02:07.0203 3304        WebClient      (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
11:02:07.0375 3304        WebClient - ok
11:02:07.0562 3304        winmgmt        (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
11:02:07.0796 3304        winmgmt - ok
11:02:07.0875 3304        WmdmPmSN        (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
11:02:08.0062 3304        WmdmPmSN - ok
11:02:08.0593 3304        Wmi            (ffa4d901d46d07a5bab2d8307fbb51a6) C:\WINDOWS\System32\advapi32.dll
11:02:09.0453 3304        Wmi - ok
11:02:09.0593 3304        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe
11:02:09.0828 3304        WmiApSrv - ok
11:02:10.0890 3304        WMPNetworkSvc  (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe
11:02:12.0203 3304        WMPNetworkSvc - ok
11:02:12.0328 3304        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
11:02:12.0531 3304        wscsvc - ok
11:02:12.0578 3304        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
11:02:12.0781 3304        wuauserv - ok
11:02:13.0000 3304        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
11:02:13.0140 3304        WudfPf - ok
11:02:13.0218 3304        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
11:02:13.0312 3304        WudfRd - ok
11:02:13.0390 3304        WudfSvc        (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
11:02:13.0453 3304        WudfSvc - ok
11:02:13.0828 3304        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
11:02:14.0468 3304        WZCSVC - ok
11:02:14.0593 3304        xmlprov        (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
11:02:14.0812 3304        xmlprov - ok
11:02:14.0875 3304        MBR (0x1B8)    (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
11:02:15.0750 3304        \Device\Harddisk0\DR0 - ok
11:02:15.0781 3304        MBR (0x1B8)    (8f558eb6672622401da993e1e865c861) \Device\Harddisk2\DR4
11:02:15.0984 3304        \Device\Harddisk2\DR4 - ok
11:02:16.0062 3304        Boot (0x1200)  (bf40309e15b69f1bc40b559c472b3711) \Device\Harddisk0\DR0\Partition0
11:02:16.0078 3304        \Device\Harddisk0\DR0\Partition0 - ok
11:02:16.0078 3304        Boot (0x1200)  (8b5bfbe4663cc3cb37b375abfc2e7222) \Device\Harddisk0\DR0\Partition1
11:02:16.0093 3304        \Device\Harddisk0\DR0\Partition1 - ok
11:02:16.0093 3304        Boot (0x1200)  (a9f7bb9c29d396bf6b97e5f16cb8d2a6) \Device\Harddisk2\DR4\Partition0
11:02:16.0109 3304        \Device\Harddisk2\DR4\Partition0 - ok
11:02:16.0109 3304        ============================================================
11:02:16.0109 3304        Scan finished
11:02:16.0109 3304        ============================================================
11:02:16.0234 2496        Detected object count: 3
11:02:16.0234 2496        Actual detected object count: 3

cosinus 27.07.2012 13:15
Log ist unvollständig, die untere Zusammenfassung fehlt

dipl ingwer 27.07.2012 14:31
Sorry, Mist!
So, nun hoffentlich alles dabei, mehr habe ich wohl nicht...

Was mache ich denn mit den 3 Funden? Da kann man "copy all to quarantine" anklicken.

Übrigens: der Rechner läuft wieder ziemlich gut.

Code:

10:57:42.0312 4012        TDSS rootkit removing tool 2.7.48.0 Jul 24 2012 13:16:32
10:57:42.0734 4012        ============================================================
10:57:42.0734 4012        Current date / time: 2012/07/27 10:57:42.0734
10:57:42.0734 4012        SystemInfo:
10:57:42.0734 4012       
10:57:42.0734 4012        OS Version: 5.1.2600 ServicePack: 3.0
10:57:42.0734 4012        Product type: Workstation
10:57:42.0734 4012        ComputerName: SDD_LAPTOP
10:57:42.0734 4012        UserName: ingwer
10:57:42.0734 4012        Windows directory: C:\WINDOWS
10:57:42.0734 4012        System windows directory: C:\WINDOWS
10:57:42.0734 4012        Processor architecture: Intel x86
10:57:42.0734 4012        Number of processors: 2
10:57:42.0734 4012        Page size: 0x1000
10:57:42.0734 4012        Boot type: Normal boot
10:57:42.0734 4012        ============================================================
10:57:45.0843 4012        Drive \Device\Harddisk0\DR0 - Size: 0x1BF2976000 (111.79 Gb), SectorSize: 0x200, Cylinders: 0x3901, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
10:57:45.0921 4012        Drive \Device\Harddisk1\DR3 - Size: 0x0 (0.00 Gb), SectorSize: 0x200, Cylinders: 0x0, SectorsPerTrack: 0x0, TracksPerCylinder: 0x0, Type 'W'
10:57:53.0250 4012        Drive \Device\Harddisk2\DR4 - Size: 0x15D50D00000 (1397.26 Gb), SectorSize: 0x200, Cylinders: 0x2C881, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
10:57:53.0265 4012        ============================================================
10:57:53.0265 4012        \Device\Harddisk0\DR0:
10:57:53.0328 4012        MBR partitions:
10:57:53.0328 4012        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x596D64E
10:57:53.0343 4012        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x596D6CC, BlocksNum 0x86260F5
10:57:53.0343 4012        \Device\Harddisk2\DR4:
10:57:53.0343 4012        MBR partitions:
10:57:53.0343 4012        \Device\Harddisk2\DR4\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xAEA86000
10:57:53.0343 4012        ============================================================
10:57:53.0406 4012        C: <-> \Device\Harddisk0\DR0\Partition0
10:57:53.0468 4012        D: <-> \Device\Harddisk0\DR0\Partition1
10:57:53.0546 4012        F: <-> \Device\Harddisk2\DR4\Partition0
10:57:53.0546 4012        ============================================================
10:57:53.0546 4012        Initialize success
10:57:53.0546 4012        ============================================================
11:00:06.0718 3304        ============================================================
11:00:06.0718 3304        Scan started
11:00:06.0718 3304        Mode: Manual; SigCheck; TDLFS;
11:00:06.0718 3304        ============================================================
11:00:07.0171 3304        7ByteIo - ok
11:00:07.0640 3304        Abiosdsk - ok
11:00:07.0656 3304        abp480n5 - ok
11:00:07.0828 3304        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
11:00:16.0796 3304        ACPI - ok
11:00:16.0843 3304        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
11:00:17.0046 3304        ACPIEC - ok
11:00:17.0265 3304        AdobeFlashPlayerUpdateSvc (5e1a953c6472e7bb644892a4d0df5e72) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
11:00:17.0453 3304        AdobeFlashPlayerUpdateSvc - ok
11:00:17.0453 3304        adpu160m - ok
11:00:17.0609 3304        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
11:00:17.0890 3304        aec - ok
11:00:18.0015 3304        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
11:00:18.0218 3304        AFD - ok
11:00:18.0281 3304        AFS2K          (c719341a1cf6afd4fa0808ae3d23d6a3) C:\WINDOWS\system32\drivers\AFS2K.sys
11:00:18.0328 3304        AFS2K - ok
11:00:18.0328 3304        Aha154x - ok
11:00:18.0343 3304        aic78u2 - ok
11:00:18.0359 3304        aic78xx - ok
11:00:18.0406 3304        Alerter        (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
11:00:18.0609 3304        Alerter - ok
11:00:18.0718 3304        ALG            (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
11:00:19.0203 3304        ALG - ok
11:00:19.0203 3304        AliIde - ok
11:00:19.0218 3304        amsint - ok
11:00:19.0375 3304        AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Programme\Avira\AntiVir Desktop\sched.exe
11:00:19.0468 3304        AntiVirSchedulerService - ok
11:00:19.0578 3304        AntiVirService  (a489be6bb0aa1ff406b488b60542314b) C:\Programme\Avira\AntiVir Desktop\avguard.exe
11:00:19.0671 3304        AntiVirService - ok
11:00:19.0859 3304        AppMgmt        (d45960be52c3c610d361977057f98c54) C:\WINDOWS\System32\appmgmts.dll
11:00:20.0187 3304        AppMgmt - ok
11:00:20.0625 3304        AR5211          (bd4a059b937a64f403e693dcaa26fe38) C:\WINDOWS\system32\DRIVERS\ar5211.sys
11:00:21.0328 3304        AR5211 - ok
11:00:21.0343 3304        asc - ok
11:00:21.0343 3304        asc3350p - ok
11:00:21.0359 3304        asc3550 - ok
11:00:21.0546 3304        aspnet_state    (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
11:00:21.0609 3304        aspnet_state - ok
11:00:21.0750 3304        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
11:00:21.0953 3304        AsyncMac - ok
11:00:22.0062 3304        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
11:00:22.0203 3304        atapi - ok
11:00:22.0203 3304        Atdisk - ok
11:00:22.0578 3304        Ati HotKey Poller (77c3f65a387f5e24228b7cc3557288e6) C:\WINDOWS\system32\Ati2evxx.exe
11:00:23.0187 3304        Ati HotKey Poller - ok
11:00:24.0890 3304        ati2mtag        (01526c7a691913a7b09d0eb22b70c5d7) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
11:00:27.0937 3304        ati2mtag - ok
11:00:28.0562 3304        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
11:00:28.0781 3304        Atmarpc - ok
11:00:28.0921 3304        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
11:00:29.0078 3304        AudioSrv - ok
11:00:29.0109 3304        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
11:00:29.0250 3304        audstub - ok
11:00:29.0343 3304        avgntflt        (d5541f0afb767e85fc412fc609d96a74) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
11:00:29.0406 3304        avgntflt - ok
11:00:29.0531 3304        avipbb          (7d967a682d4694df7fa57d63a2db01fe) C:\WINDOWS\system32\DRIVERS\avipbb.sys
11:00:29.0640 3304        avipbb - ok
11:00:29.0687 3304        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\WINDOWS\system32\DRIVERS\avkmgr.sys
11:00:29.0718 3304        avkmgr - ok
11:00:29.0765 3304        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
11:00:29.0968 3304        Beep - ok
11:00:30.0281 3304        BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
11:00:30.0875 3304        BITS - ok
11:00:30.0984 3304        Browser        (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
11:00:31.0171 3304        Browser - ok
11:00:31.0234 3304        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
11:00:31.0390 3304        cbidf2k - ok
11:00:31.0406 3304        cd20xrnt - ok
11:00:31.0734 3304        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
11:00:31.0890 3304        Cdaudio - ok
11:00:32.0031 3304        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
11:00:32.0171 3304        Cdfs - ok
11:00:32.0250 3304        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
11:00:32.0421 3304        Cdrom - ok
11:00:32.0437 3304        Changer - ok
11:00:32.0468 3304        CiSvc          (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
11:00:32.0625 3304        CiSvc - ok
11:00:32.0671 3304        ClipSrv        (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
11:00:32.0859 3304        ClipSrv - ok
11:00:33.0093 3304        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:00:33.0187 3304        clr_optimization_v2.0.50727_32 - ok
11:00:33.0218 3304        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
11:00:33.0375 3304        CmBatt - ok
11:00:33.0375 3304        CmdIde - ok
11:00:33.0421 3304        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
11:00:33.0546 3304        Compbatt - ok
11:00:33.0562 3304        COMSysApp - ok
11:00:33.0562 3304        Cpqarray - ok
11:00:33.0656 3304        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
11:00:33.0890 3304        CryptSvc - ok
11:00:33.0906 3304        dac2w2k - ok
11:00:33.0921 3304        dac960nt - ok
11:00:34.0593 3304        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
11:00:35.0312 3304        DcomLaunch - ok
11:00:36.0000 3304        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
11:00:36.0562 3304        Dhcp - ok
11:00:36.0843 3304        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
11:00:37.0109 3304        Disk - ok
11:00:37.0109 3304        dmadmin - ok
11:00:38.0984 3304        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
11:00:40.0468 3304        dmboot - ok
11:00:40.0953 3304        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
11:00:41.0234 3304        dmio - ok
11:00:41.0328 3304        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
11:00:41.0531 3304        dmload - ok
11:00:41.0812 3304        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
11:00:42.0093 3304        dmserver - ok
11:00:42.0234 3304        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
11:00:42.0500 3304        DMusic - ok
11:00:43.0046 3304        Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll
11:00:43.0375 3304        Dnscache - ok
11:00:43.0718 3304        Dot3svc        (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
11:00:44.0125 3304        Dot3svc - ok
11:00:45.0093 3304        Dot4            (3e4b043f8bc6be1d4820cc6c9c500306) C:\WINDOWS\system32\DRIVERS\Dot4.sys
11:00:45.0531 3304        Dot4 - ok
11:00:45.0718 3304        Dot4Print      (77ce63a8a34ae23d9fe4c7896d1debe7) C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys
11:00:45.0937 3304        Dot4Print - ok
11:00:46.0109 3304        dot4usb        (29e86af2f3457d0441348020fe3cfbd0) C:\WINDOWS\system32\DRIVERS\dot4usb.sys
11:00:46.0359 3304        dot4usb - ok
11:00:46.0375 3304        dpti2o - ok
11:00:46.0468 3304        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
11:00:46.0671 3304        drmkaud - ok
11:00:46.0984 3304        EapHost        (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
11:00:47.0187 3304        EapHost - ok
11:00:47.0328 3304        ERSvc          (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
11:00:47.0625 3304        ERSvc - ok
11:00:48.0343 3304        Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
11:00:48.0500 3304        Eventlog - ok
11:00:49.0343 3304        EventSystem    (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll
11:00:51.0000 3304        EventSystem - ok
11:00:51.0140 3304        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
11:00:51.0437 3304        Fastfat - ok
11:00:51.0625 3304        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
11:00:51.0812 3304        FastUserSwitchingCompatibility - ok
11:00:51.0875 3304        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
11:00:52.0078 3304        Fdc - ok
11:00:52.0140 3304        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
11:00:52.0328 3304        Fips - ok
11:00:52.0375 3304        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
11:00:52.0515 3304        Flpydisk - ok
11:00:52.0640 3304        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
11:00:52.0843 3304        FltMgr - ok
11:00:52.0984 3304        FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
11:00:53.0031 3304        FontCache3.0.0.0 - ok
11:00:53.0078 3304        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
11:00:53.0281 3304        Fs_Rec - ok
11:00:53.0453 3304        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
11:00:53.0640 3304        Ftdisk - ok
11:00:53.0687 3304        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
11:00:53.0843 3304        Gpc - ok
11:00:54.0046 3304        gupdate        (506708142bc63daba64f2d3ad1dcd5bf) C:\Programme\Google\Update\GoogleUpdate.exe
11:00:54.0156 3304        gupdate - ok
11:00:54.0234 3304        gupdatem        (506708142bc63daba64f2d3ad1dcd5bf) C:\Programme\Google\Update\GoogleUpdate.exe
11:00:54.0265 3304        gupdatem - ok
11:00:54.0812 3304        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
11:00:55.0234 3304        HDAudBus - ok
11:00:55.0437 3304        helpsvc        (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
11:00:55.0687 3304        helpsvc - ok
11:00:55.0828 3304        HidServ        (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll
11:00:56.0015 3304        HidServ - ok
11:00:56.0109 3304        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
11:00:56.0359 3304        HidUsb - ok
11:00:56.0812 3304        hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
11:00:57.0046 3304        hkmsvc - ok
11:00:57.0046 3304        hpn - ok
11:00:57.0109 3304        HPZid412        (5faba4775d4c61e55ec669d643ffc71f) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
11:00:57.0312 3304        HPZid412 - ok
11:00:57.0359 3304        HPZipr12        (a3c43980ee1f1beac778b44ea65dbdd4) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
11:00:57.0484 3304        HPZipr12 - ok
11:00:57.0515 3304        HPZius12        (2906949bd4e206f2bb0dd1896ce9f66f) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
11:00:57.0671 3304        HPZius12 - ok
11:00:57.0921 3304        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
11:00:58.0203 3304        HTTP - ok
11:00:58.0250 3304        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
11:00:58.0437 3304        HTTPFilter - ok
11:00:58.0453 3304        i2omgmt - ok
11:00:58.0453 3304        i2omp - ok
11:00:58.0625 3304        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
11:00:58.0796 3304        i8042prt - ok
11:00:59.0500 3304        idsvc          (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
11:01:00.0687 3304        idsvc - ok
11:01:00.0750 3304        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
11:01:00.0906 3304        Imapi - ok
11:01:01.0250 3304        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe
11:01:02.0062 3304        ImapiService - ok
11:01:02.0062 3304        ini910u - ok
11:01:05.0250 3304        IntcAzAudAddService (47f27af890da3e51c633fdd510910115) C:\WINDOWS\system32\drivers\RtkHDAud.sys
11:01:11.0437 3304        IntcAzAudAddService - ok
11:01:12.0031 3304        IntelIde - ok
11:01:12.0078 3304        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
11:01:12.0281 3304        intelppm - ok
11:01:12.0406 3304        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
11:01:12.0562 3304        Ip6Fw - ok
11:01:12.0625 3304        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
11:01:12.0796 3304        IpFilterDriver - ok
11:01:12.0843 3304        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
11:01:12.0984 3304        IpInIp - ok
11:01:13.0125 3304        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
11:01:13.0375 3304        IpNat - ok
11:01:13.0453 3304        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
11:01:13.0671 3304        IPSec - ok
11:01:13.0718 3304        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
11:01:13.0875 3304        IRENUM - ok
11:01:13.0937 3304        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
11:01:14.0062 3304        isapnp - ok
11:01:14.0312 3304        JavaQuickStarterService (c2c1660ddcc9bd67eb98d6d5f91c107f) C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
11:01:14.0437 3304        JavaQuickStarterService - ok
11:01:14.0484 3304        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
11:01:14.0656 3304        Kbdclass - ok
11:01:14.0687 3304        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
11:01:14.0937 3304        kbdhid - ok
11:01:14.0953 3304        kbfiltr        (cc2a86d7bbf14977340dca61bbcba771) C:\WINDOWS\system32\DRIVERS\kbfiltr.sys
11:01:15.0046 3304        kbfiltr - ok
11:01:15.0218 3304        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
11:01:15.0484 3304        kmixer - ok
11:01:15.0578 3304        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
11:01:15.0703 3304        KSecDD - ok
11:01:15.0828 3304        lanmanserver    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
11:01:15.0953 3304        lanmanserver - ok
11:01:16.0078 3304        lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
11:01:16.0250 3304        lanmanworkstation - ok
11:01:16.0265 3304        lbrtfdc - ok
11:01:16.0625 3304        LBTServ        (a0f7dc0080e4f97dc97de08b699e231b) C:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTServ.exe
11:01:16.0734 3304        LBTServ - ok
11:01:16.0796 3304        LHidFilt        (24e0ddb99aeccf86bb37702611761459) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
11:01:16.0828 3304        LHidFilt - ok
11:01:16.0953 3304        LightScribeService (98d884adc0b8c0febcc9d7bee6d86f90) C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
11:01:17.0031 3304        LightScribeService - ok
11:01:17.0078 3304        LmHosts        (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
11:01:17.0406 3304        LmHosts - ok
11:01:17.0593 3304        LMouFilt        (d58b330d318361a66a9fe60d7c9b4951) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
11:01:17.0625 3304        LMouFilt - ok
11:01:17.0687 3304        Messenger      (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
11:01:17.0859 3304        Messenger - ok
11:01:17.0890 3304        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
11:01:18.0031 3304        mnmdd - ok
11:01:18.0093 3304        mnmsrvc        (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe
11:01:18.0250 3304        mnmsrvc - ok
11:01:18.0515 3304        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
11:01:18.0671 3304        Modem - ok
11:01:18.0734 3304        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
11:01:18.0875 3304        Mouclass - ok
11:01:18.0921 3304        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
11:01:19.0078 3304        mouhid - ok
11:01:19.0125 3304        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
11:01:19.0281 3304        MountMgr - ok
11:01:19.0609 3304        MozillaMaintenance (46297fa8e30a6007f14118fc2b942fbc) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
11:01:19.0718 3304        MozillaMaintenance - ok
11:01:19.0718 3304        mraid35x - ok
11:01:19.0875 3304        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
11:01:20.0187 3304        MRxDAV - ok
11:01:21.0218 3304        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
11:01:21.0765 3304        MRxSmb - ok
11:01:21.0796 3304        MSDTC          (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe
11:01:21.0968 3304        MSDTC - ok
11:01:22.0078 3304        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
11:01:22.0203 3304        Msfs - ok
11:01:22.0218 3304        MSIServer - ok
11:01:22.0250 3304        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
11:01:22.0390 3304        MSKSSRV - ok
11:01:22.0437 3304        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
11:01:22.0562 3304        MSPCLOCK - ok
11:01:22.0593 3304        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
11:01:22.0734 3304        MSPQM - ok
11:01:22.0765 3304        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
11:01:22.0921 3304        mssmbios - ok
11:01:22.0953 3304        MTsensor        (1c0f480b7c6136ddb5fb909995af014a) C:\WINDOWS\system32\DRIVERS\ATKACPI.sys
11:01:23.0000 3304        MTsensor - ok
11:01:23.0093 3304        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
11:01:23.0187 3304        Mup - ok
11:01:23.0453 3304        napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
11:01:23.0859 3304        napagent - ok
11:01:24.0812 3304        NBService      (6d8fcdd5bb3b676ef58fa234073492c6) C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe
11:01:25.0781 3304        NBService - ok
11:01:25.0953 3304        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
11:01:26.0218 3304        NDIS - ok
11:01:26.0265 3304        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
11:01:26.0390 3304        NdisTapi - ok
11:01:26.0421 3304        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
11:01:26.0593 3304        Ndisuio - ok
11:01:26.0687 3304        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
11:01:26.0875 3304        NdisWan - ok
11:01:26.0937 3304        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
11:01:27.0046 3304        NDProxy - ok
11:01:27.0093 3304        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
11:01:27.0234 3304        NetBIOS - ok
11:01:27.0453 3304        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
11:01:27.0718 3304        NetBT - ok
11:01:27.0828 3304        NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
11:01:28.0078 3304        NetDDE - ok
11:01:28.0078 3304        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
11:01:28.0203 3304        NetDDEdsdm - ok
11:01:28.0281 3304        Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:01:28.0437 3304        Netlogon - ok
11:01:28.0593 3304        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
11:01:28.0875 3304        Netman - ok
11:01:29.0078 3304        NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
11:01:29.0203 3304        NetTcpPortSharing - ok
11:01:29.0437 3304        Nla            (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
11:01:29.0640 3304        Nla - ok
11:01:30.0031 3304        NMIndexingService (060daf68493ad7adf104413e5a62afa8) C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
11:01:30.0265 3304        NMIndexingService - ok
11:01:30.0406 3304        NMSAccess      (7aea4df1ca68fd45dd4bbe1f0243ce7f) C:\Programme\CDBurnerXP\NMSAccessU.exe
11:01:30.0484 3304        NMSAccess - ok
11:01:30.0593 3304        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
11:01:30.0781 3304        Npfs - ok
11:01:31.0218 3304        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
11:01:31.0953 3304        Ntfs - ok
11:01:32.0000 3304        NtLmSsp        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:01:32.0125 3304        NtLmSsp - ok
11:01:32.0484 3304        NtmsSvc        (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
11:01:33.0171 3304        NtmsSvc - ok
11:01:33.0218 3304        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
11:01:33.0375 3304        Null - ok
11:01:33.0406 3304        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
11:01:33.0546 3304        NwlnkFlt - ok
11:01:33.0609 3304        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
11:01:33.0765 3304        NwlnkFwd - ok
11:01:33.0859 3304        NwlnkIpx        (8b8b1be2dba4025da6786c645f77f123) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
11:01:34.0093 3304        NwlnkIpx - ok
11:01:34.0171 3304        NwlnkNb        (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
11:01:34.0390 3304        NwlnkNb - ok
11:01:34.0453 3304        NwlnkSpx        (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
11:01:34.0625 3304        NwlnkSpx - ok
11:01:35.0078 3304        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
11:01:35.0593 3304        odserv - ok
11:01:35.0718 3304        ose            (5a432a042dae460abe7199b758e8606c) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
11:01:35.0828 3304        ose - ok
11:01:35.0937 3304        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
11:01:36.0125 3304        Parport - ok
11:01:36.0171 3304        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
11:01:36.0296 3304        PartMgr - ok
11:01:36.0359 3304        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
11:01:36.0515 3304        ParVdm - ok
11:01:36.0593 3304        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
11:01:36.0718 3304        PCI - ok
11:01:36.0734 3304        PCIDump - ok
11:01:36.0750 3304        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
11:01:36.0890 3304        PCIIde - ok
11:01:37.0000 3304        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
11:01:37.0171 3304        Pcmcia - ok
11:01:37.0187 3304        PDCOMP - ok
11:01:37.0187 3304        PDFRAME - ok
11:01:37.0203 3304        PDRELI - ok
11:01:37.0218 3304        PDRFRAME - ok
11:01:37.0218 3304        perc2 - ok
11:01:37.0234 3304        perc2hib - ok
11:01:37.0421 3304        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
11:01:37.0453 3304        PlugPlay - ok
11:01:37.0562 3304        Pml Driver HPZ12 (5c1cadd1cb67c0b9d8a84ec6e4d6b5cc) C:\WINDOWS\system32\HPZipm12.exe
11:01:37.0765 3304        Pml Driver HPZ12 - ok
11:01:37.0796 3304        PolicyAgent    (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:01:37.0968 3304        PolicyAgent - ok
11:01:38.0093 3304        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
11:01:38.0250 3304        PptpMiniport - ok
11:01:38.0265 3304        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:01:38.0390 3304        ProtectedStorage - ok
11:01:38.0437 3304        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
11:01:38.0625 3304        PSched - ok
11:01:38.0656 3304        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
11:01:38.0812 3304        Ptilink - ok
11:01:38.0875 3304        PxHelp20        (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
11:01:38.0890 3304        PxHelp20 - ok
11:01:38.0890 3304        ql1080 - ok
11:01:38.0906 3304        Ql10wnt - ok
11:01:38.0921 3304        ql12160 - ok
11:01:38.0921 3304        ql1240 - ok
11:01:38.0937 3304        ql1280 - ok
11:01:38.0984 3304        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
11:01:39.0125 3304        RasAcd - ok
11:01:39.0234 3304        RasAuto        (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
11:01:39.0468 3304        RasAuto - ok
11:01:39.0515 3304        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
11:01:39.0687 3304        Rasl2tp - ok
11:01:39.0859 3304        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
11:01:40.0125 3304        RasMan - ok
11:01:40.0187 3304        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
11:01:40.0390 3304        RasPppoe - ok
11:01:40.0421 3304        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
11:01:40.0578 3304        Raspti - ok
11:01:40.0718 3304        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
11:01:40.0937 3304        Rdbss - ok
11:01:40.0953 3304        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
11:01:41.0093 3304        RDPCDD - ok
11:01:41.0250 3304        rdpdr          (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
11:01:41.0593 3304        rdpdr - ok
11:01:41.0718 3304        RDPWD          (6589db6e5969f8eee594cf71171c5028) C:\WINDOWS\system32\drivers\RDPWD.sys
11:01:41.0906 3304        RDPWD - ok
11:01:42.0031 3304        RDSessMgr      (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
11:01:42.0312 3304        RDSessMgr - ok
11:01:42.0453 3304        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
11:01:42.0625 3304        redbook - ok
11:01:42.0718 3304        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
11:01:42.0906 3304        RemoteAccess - ok
11:01:42.0984 3304        RemoteRegistry  (e4cd1f3d84e1c2ca0b8cf7501e201593) C:\WINDOWS\system32\regsvc.dll
11:01:43.0156 3304        RemoteRegistry - ok
11:01:43.0234 3304        rimsptsk        (1bdba2d2d402415a78a4ba766dfe0f7b) C:\WINDOWS\system32\DRIVERS\rimsptsk.sys
11:01:43.0343 3304        rimsptsk - ok
11:01:43.0375 3304        risdptsk        (ace2ce73d7b04eac48fb80482e05e770) C:\WINDOWS\system32\DRIVERS\risdptsk.sys
11:01:43.0406 3304        risdptsk - ok
11:01:43.0500 3304        RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe
11:01:43.0687 3304        RpcLocator - ok
11:01:44.0000 3304        RpcSs          (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
11:01:44.0218 3304        RpcSs - ok
11:01:44.0343 3304        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
11:01:44.0593 3304        RSVP - ok
11:01:44.0671 3304        RTL8023xp      (1e11171c0b9989e1bdaa59e96b2e81c4) C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys
11:01:45.0046 3304        RTL8023xp - ok
11:01:45.0078 3304        rtl8139        (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
11:01:45.0218 3304        rtl8139 - ok
11:01:45.0250 3304        SamSs          (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:01:45.0390 3304        SamSs - ok
11:01:45.0703 3304        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
11:01:46.0031 3304        SCardSvr - ok
11:01:46.0203 3304        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
11:01:46.0468 3304        Schedule - ok
11:01:46.0562 3304        sdbus          (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
11:01:46.0812 3304        sdbus - ok
11:01:46.0906 3304        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
11:01:47.0078 3304        Secdrv - ok
11:01:47.0140 3304        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
11:01:47.0296 3304        seclogon - ok
11:01:47.0359 3304        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
11:01:47.0515 3304        SENS - ok
11:01:47.0593 3304        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
11:01:47.0796 3304        Serial - ok
11:01:47.0875 3304        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
11:01:48.0015 3304        Sfloppy - ok
11:01:48.0218 3304        SFUSVC          (5944ecbcf555dedd7f48f9982d5ddff4) C:\Programme\Kyocera\FileUtility\SFUSVC.exe
11:01:48.0281 3304        SFUSVC ( UnsignedFile.Multi.Generic ) - warning
11:01:48.0281 3304        SFUSVC - detected UnsignedFile.Multi.Generic (1)
11:01:48.0546 3304        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
11:01:49.0171 3304        SharedAccess - ok
11:01:49.0296 3304        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
11:01:49.0343 3304        ShellHWDetection - ok
11:01:49.0343 3304        Simbad - ok
11:01:50.0078 3304        smserial        (84a9af2b348b691453acbab37c8bfb27) C:\WINDOWS\system32\DRIVERS\smserial.sys
11:01:51.0703 3304        smserial - ok
11:01:51.0718 3304        Sparrow - ok
11:01:51.0765 3304        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
11:01:51.0953 3304        splitter - ok
11:01:52.0093 3304        Spooler        (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
11:01:52.0203 3304        Spooler - ok
11:01:52.0281 3304        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
11:01:52.0484 3304        sr - ok
11:01:52.0671 3304        srservice      (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll
11:01:52.0953 3304        srservice - ok
11:01:53.0234 3304        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
11:01:53.0718 3304        Srv - ok
11:01:53.0812 3304        SSDPSRV        (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
11:01:54.0031 3304        SSDPSRV - ok
11:01:54.0109 3304        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
11:01:54.0140 3304        ssmdrv - ok
11:01:54.0156 3304        StarOpen        (e57b778208c783d8debab320c16a1b82) C:\WINDOWS\system32\drivers\StarOpen.sys
11:01:54.0171 3304        StarOpen ( UnsignedFile.Multi.Generic ) - warning
11:01:54.0171 3304        StarOpen - detected UnsignedFile.Multi.Generic (1)
11:01:54.0453 3304        stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
11:01:55.0093 3304        stisvc - ok
11:01:55.0156 3304        SunkFilt6 - ok
11:01:55.0250 3304        SunkFilt62      (38cc705ff41cc49daed796cfb419bea2) C:\WINDOWS\System32\Drivers\sunkfilt62.sys
11:01:55.0296 3304        SunkFilt62 ( UnsignedFile.Multi.Generic ) - warning
11:01:55.0296 3304        SunkFilt62 - detected UnsignedFile.Multi.Generic (1)
11:01:55.0328 3304        Sunkfiltp - ok
11:01:55.0390 3304        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
11:01:55.0515 3304        swenum - ok
11:01:55.0578 3304        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
11:01:55.0734 3304        swmidi - ok
11:01:55.0750 3304        SwPrv - ok
11:01:55.0765 3304        symc810 - ok
11:01:55.0765 3304        symc8xx - ok
11:01:55.0781 3304        sym_hi - ok
11:01:55.0781 3304        sym_u3 - ok
11:01:55.0984 3304        SynTP          (69bf2dd9b1099d1aa3e7cf14b4b842cd) C:\WINDOWS\system32\DRIVERS\SynTP.sys
11:01:56.0218 3304        SynTP - ok
11:01:56.0296 3304        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
11:01:56.0531 3304        sysaudio - ok
11:01:56.0625 3304        SysmonLog      (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
11:01:56.0843 3304        SysmonLog - ok
11:01:57.0046 3304        TapiSrv        (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
11:01:57.0421 3304        TapiSrv - ok
11:01:57.0718 3304        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
11:01:58.0234 3304        Tcpip - ok
11:01:58.0281 3304        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
11:01:58.0406 3304        TDPIPE - ok
11:01:58.0437 3304        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
11:01:58.0593 3304        TDTCP - ok
11:01:58.0640 3304        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
11:01:58.0796 3304        TermDD - ok
11:01:59.0031 3304        TermService    (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
11:01:59.0390 3304        TermService - ok
11:01:59.0515 3304        Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
11:01:59.0531 3304        Themes - ok
11:01:59.0625 3304        TlntSvr        (03681a1ce77f51586903869a5ab1deab) C:\WINDOWS\system32\tlntsvr.exe
11:01:59.0812 3304        TlntSvr - ok
11:02:00.0046 3304        TOSHIBA Bluetooth Service (87843b2da99051bc66e2d6c211e3d6a4) C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
11:02:00.0156 3304        TOSHIBA Bluetooth Service - ok
11:02:00.0156 3304        TosIde - ok
11:02:00.0171 3304        Tosrfcom - ok
11:02:00.0265 3304        TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
11:02:00.0468 3304        TrkWks - ok
11:02:00.0515 3304        tunmp          (8f861eda21c05857eb8197300a92501c) C:\WINDOWS\system32\DRIVERS\tunmp.sys
11:02:00.0656 3304        tunmp - ok
11:02:00.0718 3304        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
11:02:00.0890 3304        Udfs - ok
11:02:00.0906 3304        ultra - ok
11:02:01.0203 3304        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
11:02:01.0796 3304        Update - ok
11:02:01.0953 3304        upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
11:02:02.0250 3304        upnphost - ok
11:02:02.0281 3304        UPS            (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
11:02:02.0421 3304        UPS - ok
11:02:02.0484 3304        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
11:02:02.0625 3304        usbccgp - ok
11:02:02.0671 3304        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
11:02:02.0812 3304        usbehci - ok
11:02:02.0875 3304        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
11:02:03.0046 3304        usbhub - ok
11:02:03.0109 3304        usbohci        (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
11:02:03.0250 3304        usbohci - ok
11:02:03.0312 3304        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
11:02:03.0468 3304        usbprint - ok
11:02:03.0515 3304        usbscan        (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
11:02:03.0671 3304        usbscan - ok
11:02:03.0718 3304        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
11:02:03.0875 3304        USBSTOR - ok
11:02:03.0906 3304        usb_rndisx      (b6cc50279d6cd28e090a5d33244adc9a) C:\WINDOWS\system32\DRIVERS\usb8023x.sys
11:02:04.0046 3304        usb_rndisx - ok
11:02:04.0125 3304        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
11:02:04.0281 3304        VgaSave - ok
11:02:04.0281 3304        ViaIde - ok
11:02:04.0343 3304        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
11:02:04.0468 3304        VolSnap - ok
11:02:04.0703 3304        VSS            (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
11:02:05.0062 3304        VSS - ok
11:02:05.0203 3304        W32Time        (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll
11:02:05.0484 3304        W32Time - ok
11:02:05.0531 3304        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
11:02:05.0687 3304        Wanarp - ok
11:02:05.0750 3304        wceusbsh        (46a247f6617526afe38b6f12f5512120) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
11:02:05.0843 3304        wceusbsh - ok
11:02:06.0250 3304        Wdf01000        (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
11:02:06.0781 3304        Wdf01000 - ok
11:02:06.0796 3304        WDICA - ok
11:02:06.0890 3304        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
11:02:07.0125 3304        wdmaud - ok
11:02:07.0203 3304        WebClient      (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
11:02:07.0375 3304        WebClient - ok
11:02:07.0562 3304        winmgmt        (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
11:02:07.0796 3304        winmgmt - ok
11:02:07.0875 3304        WmdmPmSN        (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
11:02:08.0062 3304        WmdmPmSN - ok
11:02:08.0593 3304        Wmi            (ffa4d901d46d07a5bab2d8307fbb51a6) C:\WINDOWS\System32\advapi32.dll
11:02:09.0453 3304        Wmi - ok
11:02:09.0593 3304        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe
11:02:09.0828 3304        WmiApSrv - ok
11:02:10.0890 3304        WMPNetworkSvc  (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe
11:02:12.0203 3304        WMPNetworkSvc - ok
11:02:12.0328 3304        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
11:02:12.0531 3304        wscsvc - ok
11:02:12.0578 3304        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
11:02:12.0781 3304        wuauserv - ok
11:02:13.0000 3304        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
11:02:13.0140 3304        WudfPf - ok
11:02:13.0218 3304        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
11:02:13.0312 3304        WudfRd - ok
11:02:13.0390 3304        WudfSvc        (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
11:02:13.0453 3304        WudfSvc - ok
11:02:13.0828 3304        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
11:02:14.0468 3304        WZCSVC - ok
11:02:14.0593 3304        xmlprov        (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
11:02:14.0812 3304        xmlprov - ok
11:02:14.0875 3304        MBR (0x1B8)    (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
11:02:15.0750 3304        \Device\Harddisk0\DR0 - ok
11:02:15.0781 3304        MBR (0x1B8)    (8f558eb6672622401da993e1e865c861) \Device\Harddisk2\DR4
11:02:15.0984 3304        \Device\Harddisk2\DR4 - ok
11:02:16.0062 3304        Boot (0x1200)  (bf40309e15b69f1bc40b559c472b3711) \Device\Harddisk0\DR0\Partition0
11:02:16.0078 3304        \Device\Harddisk0\DR0\Partition0 - ok
11:02:16.0078 3304        Boot (0x1200)  (8b5bfbe4663cc3cb37b375abfc2e7222) \Device\Harddisk0\DR0\Partition1
11:02:16.0093 3304        \Device\Harddisk0\DR0\Partition1 - ok
11:02:16.0093 3304        Boot (0x1200)  (a9f7bb9c29d396bf6b97e5f16cb8d2a6) \Device\Harddisk2\DR4\Partition0
11:02:16.0109 3304        \Device\Harddisk2\DR4\Partition0 - ok
11:02:16.0109 3304        ============================================================
11:02:16.0109 3304        Scan finished
11:02:16.0109 3304        ============================================================
11:02:16.0234 2496        Detected object count: 3
11:02:16.0234 2496        Actual detected object count: 3
11:07:55.0515 2496        SFUSVC ( UnsignedFile.Multi.Generic ) - skipped by user
11:07:55.0515 2496        SFUSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip
11:07:55.0531 2496        StarOpen ( UnsignedFile.Multi.Generic ) - skipped by user
11:07:55.0531 2496        StarOpen ( UnsignedFile.Multi.Generic ) - User select action: Skip
11:07:55.0531 2496        SunkFilt62 ( UnsignedFile.Multi.Generic ) - skipped by user
11:07:55.0531 2496        SunkFilt62 ( UnsignedFile.Multi.Generic ) - User select action: Skip
11:09:56.0015 3500        Deinitialize success

cosinus 27.07.2012 15:25
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

dipl ingwer 27.07.2012 17:14
Alles gut gegangen, keine Probleme bisher mit Anwendungen.
Allerdings ist auf meinem Desktop eine zweite InternetExplorer-Verknüpfung aufgetaucht. Nun ja.
Nochmals meine Frage, was mache ich denn mit den 3 Funden aus dem vorhergehenden Scan mit Kaspersky TDSS Killer? Bisher nur ge-skipt.

Habe hier den log von combofix eingefügt:

Combofix Logfile:
Code:
ComboFix 12-07-27.03 - ingwer 27.07.2012  17:35:32.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.895.450 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Hõrx\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
c:\windows\system32\dllcache\dlimport.exe
c:\windows\system32\setup.ini
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-06-27 bis 2012-07-27  ))))))))))))))))))))))))))))))
.
.
2012-07-26 16:04 . 2012-07-26 16:04        --------        d-----w-        C:\_OTL
2012-07-26 09:50 . 2012-07-26 09:50        --------        d-----w-        c:\dokumente und einstellungen\ingwer\Anwendungsdaten\Ashampoo Slideshow Studio Elements
2012-07-26 09:47 . 2012-07-26 09:47        --------        d-----w-        c:\programme\Ashampoo
2012-07-25 11:43 . 2012-07-25 11:43        --------        d-----w-        c:\dokumente und einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Sun
2012-07-25 06:33 . 2012-07-25 06:33        --------        d-----w-        c:\dokumente und einstellungen\Admin\Anwendungsdaten\Avira
2012-07-20 12:05 . 2012-07-20 12:05        --------        d-----w-        c:\programme\ESET
2012-07-19 07:29 . 2012-07-19 07:29        --------        d-----w-        c:\programme\Overland
2012-07-06 05:29 . 2012-07-06 05:29        --------        d-----w-        c:\dokumente und einstellungen\ingwer\Lokale Einstellungen\Anwendungsdaten\.elfohilfe
2012-07-03 12:58 . 2011-06-21 09:24        32768        ----a-w-        c:\windows\system32\drivers\sp_rsdrv2.sys
2012-07-02 12:45 . 2012-07-02 12:45        --------        d-----w-        c:\dokumente und einstellungen\ingwer\Anwendungsdaten\Malwarebytes
2012-07-02 12:43 . 2012-07-02 12:43        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-06-30 23:28 . 2012-06-30 23:28        --------        d-----w-        c:\programme\gmer
2012-06-30 21:49 . 2012-06-30 21:49        --------        d-----w-        c:\programme\Innovative Solutions
2012-06-29 14:24 . 2012-06-29 14:24        --------        d-----w-        c:\programme\Oracle
2012-06-29 14:18 . 2012-06-29 14:18        2        ----a-w-        c:\windows\system32\TempWmicBatchFile.bat
2012-06-29 11:24 . 2012-06-29 11:24        --------        d--h--w-        c:\windows\ie8
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-19 08:49 . 2012-04-09 18:38        426184        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-07-19 08:49 . 2011-07-25 11:54        70344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-13 13:55 . 2004-08-04 10:00        1866240        ----a-w-        c:\windows\system32\win32k.sys
2012-06-05 15:49 . 2007-05-15 13:43        1372672        ----a-w-        c:\windows\system32\msxml6.dll
2012-06-05 15:49 . 2004-08-04 10:00        1172480        ----a-w-        c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2004-08-04 10:00        152576        ----a-w-        c:\windows\system32\schannel.dll
2012-06-02 13:19 . 2008-02-08 16:09        329240        ----a-w-        c:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2008-02-08 16:09        210968        ----a-w-        c:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2008-02-08 16:09        219160        ----a-w-        c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2007-07-30 17:20        15896        ----a-w-        c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2007-07-30 17:18        18456        ----a-w-        c:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2008-02-08 16:09        35864        ----a-w-        c:\windows\system32\wups.dll
2012-06-02 13:19 . 2008-02-08 16:09        53784        ----a-w-        c:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2007-07-30 17:20        15896        ----a-w-        c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2007-07-30 17:19        45080        ----a-w-        c:\windows\system32\wups2.dll
2012-06-02 13:19 . 2004-08-04 10:00        97304        ----a-w-        c:\windows\system32\cdm.dll
2012-06-02 13:19 . 2007-07-30 17:18        23576        ----a-w-        c:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2008-02-08 16:09        577048        ----a-w-        c:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2008-02-08 16:09        1933848        ----a-w-        c:\windows\system32\wuaueng.dll
2012-06-02 13:18 . 2008-06-12 07:14        275696        ----a-w-        c:\windows\system32\mucltui.dll
2012-06-02 13:18 . 2008-06-12 07:14        214256        ----a-w-        c:\windows\system32\muweb.dll
2012-06-02 13:18 . 2008-06-12 07:14        18160        ----a-w-        c:\windows\system32\mucltui.dll.mui
2012-05-31 13:22 . 2004-08-04 10:00        604160        ----a-w-        c:\windows\system32\crypt32.dll
2012-05-16 15:07 . 2004-08-04 10:00        916992        ----a-w-        c:\windows\system32\wininet.dll
2012-05-11 14:40 . 2004-08-04 10:00        43520        ----a-w-        c:\windows\system32\licmgr10.dll
2012-05-11 14:40 . 2004-08-04 10:00        1469440        ----a-w-        c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2004-08-04 10:00        385024        ----a-w-        c:\windows\system32\html.iec
2012-05-08 18:04 . 2011-10-25 16:33        83392        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2012-05-08 18:04 . 2011-10-25 16:33        137928        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-05-05 03:14 . 2004-08-04 10:00        2150912        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-05-05 03:14 . 2004-08-03 22:50        2029056        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2012-05-04 17:29 . 2008-02-08 19:15        143872        ----a-w-        c:\windows\system32\javacpl.cpl
2012-05-04 17:29 . 2012-06-06 13:15        772504        ----a-w-        c:\windows\system32\npDeployJava1.dll
2012-05-04 17:29 . 2012-06-06 13:15        687504        ----a-w-        c:\windows\system32\deployJava1.dll
2012-05-02 13:46 . 2008-02-08 16:06        139656        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2010-08-21 13:10 . 2010-08-21 13:10        429123        ----a-w-        c:\programme\setup-Iconoid-x86.exe
2008-03-26 10:46 . 2008-03-26 10:45        23344432        ----a-w-        c:\programme\QuickTimeInstaller.exe
2008-02-19 14:45 . 2008-02-19 14:44        7844864        ----a-w-        c:\programme\setup.msi
2006-02-22 15:30 . 2006-02-22 15:30        405504        ----a-w-        c:\programme\zinsrechner.exe
2005-06-01 07:56 . 2005-06-01 07:56        311296        ----a-w-        c:\programme\rmsspecial.dll
2012-07-19 15:27 . 2012-06-20 10:58        136672        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\programme\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-30 16269312]
"SMSERIAL"="c:\programme\Motorola\SMSERIAL\sm56hlpr.exe" [2006-08-07 573440]
"NeroFilterCheck"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 76304]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2012-01-17 252296]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2012-05-08 348624]
"StatusClient"="c:\programme\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 36864]
"TomcatStartup"="c:\programme\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-03-31 155648]
"HP Software Update"="c:\programme\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"HP Component Manager"="c:\programme\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\Admin\Startmenü\Programme\Autostart\
OpenOffice.org 2.3.lnk - c:\programme\OpenOffice.org 2.3\program\quickstart.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 00:42        72208        ----a-w-        c:\programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk /r \??\G:\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^HP Digital Imaging Monitor.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^HP Image Zone Schnellstart.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\HP Image Zone Schnellstart.lnk
backup=c:\windows\pss\HP Image Zone Schnellstart.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^ingwer^Startmenü^Programme^Autostart^OpenOffice.org 3.1.lnk]
path=c:\dokumente und einstellungen\ingwer\Startmenü\Programme\Autostart\OpenOffice.org 3.1.lnk
backup=c:\windows\pss\OpenOffice.org 3.1.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sunkist2k]
2004-08-06 15:01        135168        ----a-w-        c:\programme\Multimedia Card Reader\shwicon2k.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Apple Mobile Device"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" -atboottime
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\programme\Microsoft ActiveSync\rapimgr.exe"= c:\programme\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\programme\Microsoft ActiveSync\wcescomm.exe"= c:\programme\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\programme\Microsoft ActiveSync\WCESMgr.exe"= c:\programme\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"%windir%\\system32\\pol32evt.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programme\\Public SyncTool\\PublicSyncTool.exe"=
"c:\\Programme\\Mozilla Firefox\\FIREFOX.EXE"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Programme\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Programme\\Orbitdownloader\\orbitdm.exe"=
"c:\\Programme\\Orbitdownloader\\orbitnet.exe"=
"c:\\Programme\\eMule\\emule.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"135:TCP"= 135:TCP:Public ShareFolder - DCOM Access
"4662:TCP"= 4662:TCP:127.0.0.1
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [25.10.2011 18:33 36000]
R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [25.10.2011 18:33 86224]
S2 gupdate;Google Update-Dienst (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [25.03.2012 12:48 116648]
S3 7ByteIo;7ByteIo;\??\c:\programme\Hot CPU Tester Pro 4 LE\SysInfo.sys --> c:\programme\Hot CPU Tester Pro 4 LE\SysInfo.sys [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [09.04.2012 20:38 250056]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [25.03.2012 12:48 116648]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\programme\Mozilla Maintenance Service\maintenanceservice.exe [03.05.2012 11:10 113120]
S3 SunkFilt6;Alcor Micro Corp - 6360;\??\c:\windows\System32\Drivers\sunkfilt6.sys --> c:\windows\System32\Drivers\sunkfilt6.sys [?]
S3 SunkFilt62;Alcor Micro Corp - 6362;c:\windows\system32\drivers\sunkfilt62.sys [23.07.2004 14:55 46536]
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 44812359
*NewlyCreated* - 78550474
*Deregistered* - 44812359
*Deregistered* - 78550474
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-06-20 10:47        451872        ----a-w-        c:\programme\Gemeinsame Dateien\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2012-07-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-09 08:49]
.
2012-07-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2012-03-25 10:48]
.
2012-07-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2012-03-25 10:48]
.
2012-07-26 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = <local>
IE: &Download by Orbit - c:\programme\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\programme\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\programme\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\programme\Orbitdownloader\orbitmxt.dll/202
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\dokumente und einstellungen\ingwer\Anwendungsdaten\Mozilla\Firefox\Profiles\hfffqq59.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-DXDllRegExe - dxdllreg.exe
AddRemove-Pocket PC-Verbindungsassistent - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2012-07-27 17:54
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\DbgagD\1*]
"value"="?\07\04\1c\0c6\10}"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(596)
c:\windows\system32\Ati2evxx.dll
c:\programme\gemeinsame dateien\logitech\bluetooth\LBTWlgn.dll
c:\programme\gemeinsame dateien\logitech\bluetooth\LBTServ.dll
.
Zeit der Fertigstellung: 2012-07-27  18:02:47
ComboFix-quarantined-files.txt  2012-07-27 16:02
.
Vor Suchlauf: 6.891.297.792 Bytes frei
Nach Suchlauf: 7.159.806.464 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
C:\ = "Nicht erkanntes Betriebssystem auf Laufwerk C"
.
- - End Of File - - EDAFBCF6CFACD25447AC4EB9CECBD03F
--- --- ---

cosinus 27.07.2012 21:27
Ich hätte dir schon geschrieben wenn Funde vom TDSS-Killer weg müssen! Deswegen soll ja auch nichts voreilig damit entfernt werden!

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.


Alle Zeitangaben in WEZ +1. Es ist jetzt 11:36 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19